- Hacker forum post claims UnitedHealth paid $22 mln ransom in bid to recover data
March 5, 2024
A post on a hacker forum popular with cybercriminals has claimed UnitedHealth Group opens new tab paid $22 million in a bid to recover access to data and systems encrypted by the “Blackcat” ransomware gang, according to two researchers. Neither UnitedHealth nor the hackers involved have commented on the alleged ransom payment, but a cryptocurrency tracing ...
- Germany: Use of non-secure line behind Taurus talk leak to Russia
March 5, 2024
The Ministry of Defence blamed an unnamed individual’s improper use of a “non-secure data line” for the recent leak of a German army conversation about the Taurus weapon system to Russia. The mistake was made by the participant who took part in the conversation from Singapore and had dialled in via a “non-secure data line” such ...
- Network tunneling with… QEMU?
March 5, 2024
While investigating an incident at a large company a few months ago, kaspersky researchers detected uncommon malicious activity inside one of the systems. They ran an analysis on the artifacts, only to find that the adversary had deployed and launched the following: The Angry IP Scanner network scanning utility The mimikatz password, hash, and Kerberos ticket extractor, and ...
- US airman pleads guilty to leaking classified documents
March 5, 2024
Jack Teixeira, a member of the Massachusetts Air National Guard charged with leaking classified military documents on a social media platform, pleaded guilty on Monday to carrying out one of the most serious U.S. national security breaches in years. The 22-year-old pleaded guilty to six counts of willful retention and transmission of classified information relating to ...
- Iran foiled nearly 200 cyber-attacks in month to elections
March 5, 2024
Head of Iran’s Civil Defense Organization Brigadier General Gholamreza Jalali says Iran has foiled nearly 200 cyber-attacks in the month leading up to the recent parliamentary elections. In an interview with Iranian television on Monday, Jalali said some 4 or 5 major cyber-attacks were carried out during the same period but were foiled by the experts ...
- Third-party breach leads to American Express customer data compromise
March 4, 2024
Payment card provider American Express Company is warning customers that their credit card details may have been exposed following a breach involving a third-party provider. The details were first revealed in a filing with the State of Massachusetts, with a form letter sent to affected customers stating that a third-party service provider “engaged by numerous merchants ...
- New Marsilia Ransomware Downloader Found
March 4, 2024
This week, the SonicWall Capture Labs threat research team analyzed a sample of Marsilia malware, also known as Mallox. This is a multi-stage sample that, when functional, will have a first stage that enumerates system information and creates persistence. The second stage is then downloaded and will perform data extraction and encryption for ransomware purposes. The ...
- New Banking Trojan “CHAVECLOAK” Targets Brazil
March 4, 2024
FortiGuard Labs recently uncovered a threat actor employing a malicious PDF file to propagate the banking Trojan CHAVECLOAK. This intricate attack involves the PDF downloading a ZIP file and subsequently utilizing DLL side-loading techniques to execute the final malware. Notably, CHAVECLOAK is specifically designed to target users in Brazil, aiming to steal sensitive information linked to ...
- Three underwater data cables providing Internet through Red Sea are cut amid Al Houthi militant attacks
March 4, 2024
An incident in the Red Sea has cut three underwater sea cables providing internet and telecommunications around the world as the waterway remains a target of Yemen’s Houthi militants, officials said on Monday. A statement by Hong Kong-based HGC Global Communications acknowledged the cuts but did not say what caused the lines to be severed. Read more… Source: ...
- FCC and crypto firms are being hit in advanced phishing attacks using fake Okta logins
March 4, 2024
Security researchers have observed a highly sophisticated phishing campaign targeting employees of the US Federal Communications Commission (FCC), as well as popular crypto exchanges Binance, Coinbase, Kraken, and Gemini. First, they would create landing pages for logging into places like the FCC portal, or Binance. These landing pages would be seemingly identical to the authentic ones, ...