Recently, Check Point Research observed threat actors using GitHub to achieve initial infections by utilizing new methods.
Previously, GitHub was used to distribute malicious software directly, with a malicious script downloading either raw encrypted scripting code or malicious executables. Their tactics have now changed and evolved. Threat actors now operate a network of “Ghost” accounts that distribute malware via malicious links on their repositories and encrypted archives as releases. This network not only distributes malware but also provides various other activities that make these “Ghost” accounts appear as normal users.
Read more…
Source: Check Point
Related:
- Storm-0978 attacks reveal financial and espionage motives
July 11, 2023
Microsoft has identified a phishing campaign conducted by the threat actor tracked as Storm-0978 targeting defense and government entities in Europe and North America. The campaign involved the abuse of CVE-2023-36884, which included a remote code execution vulnerability exploited before disclosure to Microsoft via Word documents, using lures related to the Ukrainian World Congress. Read more… Source: Microsoft
- Florida patients among 11 million affected by HCA Healthcare data breach
July 10, 2023
Data on roughly 11 million HCA Healthcare patients in 20 states including Florida, was stolen and recently posted on an online forum, the hospital chain reported on Sunday. According to the company, an unauthorized party gained access to 27 million rows of data stored at an external location that is used to to automate company email ...
- Ventia takes systems offline to contain cyber attack
July 10, 2023
Ventia has taken an undisclosed number of “key systems” offline to contain a cyber security incident. The listed company, which provides long-term operation, maintenance, and management for critical public and private assets and infrastructure, disclosed the incident on Saturday. Read more… Source: IT News
- The TOITOIN Trojan: Analyzing a New Multi-Stage Attack Targeting LATAM Region
July 7, 2023
This sophisticated campaign targeting LATAM region employs a trojan that follows a multi-staged infection chain, utilizing specially crafted modules throughout each stage. These modules are custom designed to carry out malicious activities, such as injecting harmful code into remote processes, circumventing User Account Control via COM Elevation Moniker, and evading detection by Sandboxes through clever ...
- Major cyber attack at Scottish university as police and government called in
July 7, 2023
The University of the West of Scotland (UWS) said it is working with experts from the national cyber security centre, Police Scotland and the Scottish Government after its website was shut down for several days. A message on the site displays a message warning it is “currently down” for maintenance and apologises for any inconvenience. Read more… Source: ...
- The five-day job: A BlackByte ransomware intrusion case study
July 6, 2023
As ransomware attacks continue to grow in number and sophistication, threat actors can quickly impact business operations if organizations are not well prepared. In a recent investigation by Microsoft Incident Response (previously known as Microsoft Detection and Response Team – DART) of an intrusion, they found that the threat actor progressed through the full attack ...