Kaspersky continue to share details on the malicious techniques and toolsets used by the ToddyCat APT group. In the first part of this report, they examined the group’s attacks aimed at stealing data from browsers, as well as from local and cloud email services. The methods used in that campaign indicated that ToddyCat was attempting to access corporate correspondence while evading monitoring tools. However, all of the group’s methods Kaspersky described previously are effectively detected by EPP and EDR solutions.
The attackers continued their search for ways to bypass security solutions and developed a new tool to gain access to a victim’s cloud account via the Google API. Armed with this tool, the group automated all stages of the attack and managed to remain undetected by monitoring systems.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Bringing Access Back — Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect
March 21, 2024
During the course of an intrusion investigation in late October 2023, Mandiant observed novel N-day exploitation of CVE-2023-46747 affecting F5 BIG-IP Traffic Management User Interface. Additionally, in February 2024, Mandiant researchers observed exploitation of Connectwise ScreenConnect CVE-2024-1709 by the same actor. This mix of custom tooling and the SUPERSHELL framework leveraged in these incidents is assessed ...
- Patch Ivanti Standalone Sentry and Ivanti Neurons for ITSM now
March 21, 2024
Ivanti has issued patches for two vulnerabilities. One was discovered in the Ivanti Standalone Sentry, which impacts all supported versions 9.17.0, 9.18.0, and 9.19.0. Older versions are also at risk. The other vulnerability impacts all supported versions of Ivanti Neurons for ITSM—2023.3, 2023.2 and 2023.1, as well as unsupported versions which will need an upgrade before ...
- Ring doorbell owners warned of bank raiding attack as thieves target Brits
March 21, 2024
Home security gadgets like Ring doorbells are increasingly being targeted by cyber crooks and their nasty phishing campaigns. Cybersecurity experts at Trustwave have warned Ring customers – and owners of similar gadgets from other brands – that home security tech is being used against the people its supposed to protect. Read more… Source: The Sun
- China’s MSS publicizes typical case to remind public of overseas cyber ransom attacks
March 21, 2024
China’s national security authorities publicized on Thursday a typical case of cyber ransom attacks to help raise public awareness over online blackmail and attacks from overseas, which not only affects social stability and economic development but also threatens China’s national security and interests. A Chinese high-tech company recently filed a report through the hotline 12339 about ...
- Android malware, Android malware and more Android malware
March 20, 2024
Among the mobile platforms, Android remains the most popular target operating system for cybercriminals. Last month, Kaspersky wrote a total of four private crimeware reports on Android malware, three of which are summarized below. Tambir Tambir is an Android backdoor that targets users in Turkey. It disguises itself as an IPTV app, but does not manifest any ...
- Microsoft Threat Intelligence unveils targets and innovative tactics amidst tax season
March 20, 2024
Cybercriminals use social engineering during holidays and important events like tax season to steal user information. Microsoft Threat Intelligence tax season report outlines some of the various techniques that threat actors use to craft their campaigns and mislead taxpayers into revealing sensitive information, making payments to fake services, or installing malicious payloads. These include phishing emails, ...