How BPF-Enabled Malware Works

Berkeley Packet Filtering (BPF) is a kind of technology that allows programs to effectively execute code in the kernels of modern operating systems, such as Linux and Berkeley Software Distribution (BSD) variants. Soon, Windows will also add support for BPF. Read More …

Kaspersky reveals three-year long suspected supply chain attack targeting Linux

UPDATE 13.09.2023. Free Download Manager team issued an official statement regarding this incident. Kaspersky unveiled a malicious campaign in which an installer of the Free Download Manager software was employed to disseminate a Linux backdoor for a minimum of three Read More …

Storm-0558: Understanding How Microsoft Failed to Protect Itself

You’re undoubtedly familiar with the so-called Storm-0558 attacks from July 2023. If not a quick recap: these attacks (widely attributed as the work of the Chinese government) compromised a number of high-value Exchange Online mailboxes, including the US Secretary of Read More …

Leaseweb trying to restore service following cyberattack

Cloud provider Leaseweb was forced to take some of its critical systems down to mitigate the effects of an ongoing cyberattack. One of the world’s largest cloud and hosting providers, Leasweb contacted its customers to alert them it spotted “unusual” Read More …

Cryptojacking: Understanding and defending against cloud compute resource abuse

In cloud environments, cryptojacking – a type of cyberattack that uses computing power to mine cryptocurrency – takes the form of cloud compute resource abuse, which involves a threat actor compromising legitimate tenants. Cloud compute resource abuse could result in Read More …

Analysis of Storm-0558 techniques for unauthorized email access

As described in more detail in our July 11 blogs, Storm-0558 is a China-based threat actor with espionage objectives. Beginning May 15, 2023, Storm-0558 used forged authentication tokens to access user email from approximately 25 organizations, including government agencies and Read More …

Microsoft Azure and Outlook outages were caused by DDoS attacks

Microsoft has confirmed that outages to its Azure and Outlook services were caused by DDoS attacks, which the company puts down to the threat actor that it tracks as Storm-1359. This follows the tech giant’s new nomenclature for threats, whereby Read More …

Cloud misconfiguration causes massive data breach at Toyota Motor

Japanese automaker Toyota Motor said approximately 260,000 customers’ data was exposed online due to a misconfigured cloud environment. Along with customers in Japan, data of certain customers in Asia and Oceania was also exposed. Toyota Motor has implemented measures to Read More …