Recently, Check Point Research observed threat actors using GitHub to achieve initial infections by utilizing new methods.
Previously, GitHub was used to distribute malicious software directly, with a malicious script downloading either raw encrypted scripting code or malicious executables. Their tactics have now changed and evolved. Threat actors now operate a network of “Ghost” accounts that distribute malware via malicious links on their repositories and encrypted archives as releases. This network not only distributes malware but also provides various other activities that make these “Ghost” accounts appear as normal users.
Read more…
Source: Check Point
Related:
- Cyber attack hits Pennsylvania Courts’ website
February 5, 2024
Pennsylvania Courts’ website was targeted in a cyber attack on Sunday. Pennsylvania’s Chief Justice Debra Todd made the announcement, saying portions of the website were made unavailable due to the attack. The situation was described as a denial of service cyber attack. Todd said there was no indication any court data was compromised and courts will ...
- Exploring the (Not So) Secret Code of Black Hunt Ransomware
February 5, 2024
It seems like every week, the cybersecurity landscape sees the emergence of yet another ransomware variant, with Black Hunt being one of the latest additions. Initially reported by cybersecurity researchers in 2022, this new threat has quickly made its presence known. In a recent incident, Black Hunt ransomware wreaked havoc by compromising around 300 companies in ...
- Philippines: Cyber attack on Overseas Workers Welfare Administration website foiled
February 3, 2024
The Department of Information and Communications Technology (DICT) has prevented a cyber attack aimed at taking down the website of the Overseas Workers Welfare Administration (OWWA). At the Saturday News Forum, DICT Undersecretary for Cybersecurity Jeff Ian Dy said the DICT was able to “defend” various web applications related to OWWA from cyber attacks. The DICT ...
- Europcar’s Alleged Data Breach Wasn’t Done Using AI, Experts Argue
February 2, 2024
French car rental company Europcar made headlines earlier this week following reports of an alleged data breach affecting nearly 50 million customers. Cyber security platform HackManac reported the incident on January 30th, noting that the stolen database containing usernames, passwords, full names, addresses, and several other user-identifying information had been listed for sale on a hacking ...
- Cloudflare blames previous Okta breach for November 2023 cyberattack
February 2, 2024
Cloudflare is laying the blame for the cyberattack it suffered late last year the after-effects of the critical Okta breach. The content delivery service provider has published a blog post detailing the cybersecurity incident it suffered on Thanksgiving Day 2023, noting that on November 23, 2023, a threat actor accessed the company’s self-hosted Atlassian server. Read more… Source: ...
- US imposes fresh sanctions over Iranian arms, cyber activity
February 2, 2024
The United States on Friday imposed sanctions targeting Iran’s ballistic missile and drone procurement programmes as well as officials it said were involved in hacking US infrastructure, as Washington looks to increase pressure on Tehran. The US Treasury Department said in a statement on Friday it had imposed sanctions on four Iran- and Hong Kong-based companies ...