News


  • US Cyber Command, DHS, and FBI expose new North Korean malware

    February 14, 2020

    US Cyber Command, the Department of Homeland Security, and the Federal Bureau of Investigations have exposed today a new North Korean hacking operation. Authorities have published security advisories detailing six new malware families that are currently being used by North Korean hackers. According to the Twitter account of the Cyber National Mission Force (CNMF), a subordinate unit ...

  • Wireshark Tutorial: Examining Qakbot Infections

    February 13, 2020

    Qakbot is an information stealer also known as Qbot. This family of malware has been active for years, and Qakbot generates distinct traffic patterns. This Wireshark tutorial reviews a recent packet capture (pcap) from a Qakbot infection. Understanding these traffic patterns can be critical for security professionals when detecting and investigating Qakbot infections. Note: This tutorial assumes you have ...

  • Emotet Now Spreads via Wi-Fi

    February 13, 2020

    A new strain of Emotet was found spreading through wireless internet connections, deviating from the email spam campaigns that the malware commonly utilizes as a means of propagation. According to researchers from Binary Defense, this new loader type takes advantage of the wlanAPI interface to spread from an infected device to an unsecure Wi-Fi network. Emotet was discovered by Trend ...

  • An In-Depth Technical Analysis of CurveBall (CVE-2020-0601)

    February 13, 2020

    The first Microsoft patch Tuesday of 2020 contained fixes for CVE-2020-0601, a vulnerability discovered by the United States’ National Security Agency (NSA) that affects how cryptographic certificates are verified by one of the core cryptography libraries in Windows that make up part of the CryptoAPI system. Dubbed CurveBall or “Chain of Fools,” an attacker exploiting this vulnerability could potentially create ...

  • New Cyber Espionage Campaigns Targeting Palestinians: The Spark and Pierogi Campaigns

    February 13, 2020

    Over the last several months, the Cybereason Nocturnus team has been tracking recent espionage campaigns targeting the Middle East. These campaigns are specifically directed at entities and individuals in the Palestinian territories. This investigation shows multiple similarities to previous attacks attributed to a group called MoleRATs (aka The Gaza Cybergang), an Arabic-speaking, politically motivated group that has operated ...

  • Puerto Rico Government Hit By $2.6M Phishing Scam

    February 13, 2020

    A phishing scam has swindled a Puerto Rico government agency out of more than $2.6 million, according to reports. According to reports, the email-based phishing scam hit Puerto Rico’s Industrial Development Company, which is a government-owned corporation aimed at driving economic development to the island along with local and foreign investors. The agency reportedly received an email alleging ...

  • Knock, Knock – Who’s There?

    February 11, 2020

    Following our research from Evil Twins and Windows Linux Subsystem, interoperability between different WSL versions was something that caught our attention. The protocol and mechanism to do file management from/to WSL is a must for Blue and Red Teams whose research will provide new ways to execute known techniques to achieve tactics such as Persistence, Defense ...

  • Apple Mac malware detections overtake Windows for the first time

    February 11, 2020

    Cyber threats aimed at Macs have outpaced those targeted at Windows PCs for the first time, signalling that Apple’s computers are not as secure as they once might have been. For some time, it was a commonly held belief that Apple Mac computers, such as the iMac, were pretty much immune to malware. This was largely due to the ...

  • U.S. Charges Chinese Military Officers in 2017 Equifax Hacking

    February 10, 2020

    Four members of China’s military were charged on Monday with hacking into Equifax, one of the nation’s largest credit reporting agencies, and stealing trade secrets and the personal data of about 145 million Americans in 2017. The charges underscored China’s quest to obtain Americans’ data and its willingness to flout a 2015 agreement with the United States to refrain from ...

  • How Chinese Cybercriminals Use Business Playbook to Revamp Underground

    February 10, 2020

    Because of its longevity and technical sophistication, the Russian cybercriminal underground has long been the benchmark for threat researchers focused on studying cybercrime tactics and techniques; there is a plethora of publications dedicated to analyzing its economy and hacking forums. However, only a handful of studies have centered on the emerging threats and trends from ...

  • KBOT: sometimes they come back

    February 10, 2020

    Although by force of habit many still refer to any malware as a virus, this once extremely common class of threats is gradually becoming a thing of the past. However, there are some interesting exceptions to this trend: we recently discovered malware that spread through injecting malicious code into Windows executable files; in other words, ...

  • Update your security strategy at IFSEC International

    February 10, 2020

    19–21 May 2020, ExCeL London IFSEC International 2020 is Europe’s largest and most comprehensive event for the global integrated security industry. It connects over 34,000 visitors from 113 countries with 450+ exhibitors showcasing some of the most innovative products and solutions on the market, as well as a full seminar programme, legislation updates, guidance and best practice. The exhibition ...

  • Introducing Loda Malware

    February 10, 2020

    Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name ‘Loda’ is derived from a directory to which the malware author chose to write keylogger logs (Figure 14). It should be noted that some ...

  • Facebook’s Instagram and Twitter accounts hijacked

    February 8, 2020

    Facebook has had several of its Instagram and Twitter accounts hijacked by a group who previously took credit for hacking the social media profiles of more than a dozen NFL teams. OurMine published the same message via @Facebook and @Messenger on Twitter, saying it had taken control of the accounts to prove how easily their security ...

  • Leaked Code from Docker Registries

    February 7, 2020

    The Unit 42 Cloud Threat Report: Spring 2020 focused on the practices of DevOps to determine where misconfigurations are happening in the cloud. Our research found a large number of DevOps services (e.g., SSH, Database, Code Repository) inadvertently exposed to the internet due to misconfigured infrastructure. This blog offers a detailed analysis of leaked code from Docker ...

  • Happy New Fear! Gift-wrapped spam and phishing

    February 7, 2020

    In the run-up to Christmas and New Year, scam е-mails mentioning easy pickings, lottery winnings, and other cash surprises are especially popular. All the more so given how simple it is to adapt existing schemes simply by mentioning the holiday in the subject line. For example, one scam е-mail with the subject line “Xsmas gift” or ...

  • Researchers Use Smart Light Bulbs to Infiltrate Networks

    February 6, 2020

    Researchers successfully infiltrated networks through a vulnerability in Philips Hue light bulbs. The CVE-2020-6007 vulnerability, which involves the ZigBee communication protocol, can be abused to remotely install malicious firmware in smart light bulbs and spread malware to other internet-of-things (IoT) devices. To make the discovery, Check Point researchers built on earlier studies that showed how to control smart light bulbs. The new finding focused ...

  • Bouygues Construction falls victim to ransomware

    February 5, 2020

    Bouygues Construction has confirmed falling victim to ransomware that it detected across its network on January 30. “As a precautionary measure, information systems have been shut down to prevent any propagation,” the company said in a brief statement. “Our teams are currently fully focused on returning to normal as quickly as possible, with the support of experts. “Installations are ...

  • SORA and UNSTABLE: 2 Mirai Variants Target Video Surveillance Storage Systems

    February 5, 2020

    Trend Micro researchers encountered two variants of the notorious internet of things (IoT) malware, Mirai, employing a new propagation method. The two variants, namely SORA (detected as IoT.Linux.MIRAI.DLEU) and UNSTABLE (detected as IoT.Linux.MIRAI.DLEV), gain entry through Rasilient PixelStor5000 video surveillance storage systems by exploiting CVE-2020-6756. Mirai is a type of malware that actively searches for IoT devices with vulnerabilities, infects them, and turns ...

  • Gamaredon APT Improves Toolset to Target Ukraine Government, Military

    February 5, 2020

    The Gamaredon advanced persistent threat (APT) group has been supercharging its operations lately, improving its toolset and ramping up attacks on Ukrainian national security targets. Vitali Kremez, head of SentinelLabs, said in research released on Wednesday that he has been tracking an uptick in Gamaredon cyberattacks on Ukrainian military and security institutions that started in December. ...