Kaspersky continue to share details on the malicious techniques and toolsets used by the ToddyCat APT group. In the first part of this report, they examined the group’s attacks aimed at stealing data from browsers, as well as from local and cloud email services. The methods used in that campaign indicated that ToddyCat was attempting to access corporate correspondence while evading monitoring tools. However, all of the group’s methods Kaspersky described previously are effectively detected by EPP and EDR solutions.
The attackers continued their search for ways to bypass security solutions and developed a new tool to gain access to a victim’s cloud account via the Google API. Armed with this tool, the group automated all stages of the attack and managed to remain undetected by monitoring systems.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- China’s Ministry of State Security warns of data security risks after Wuhan Earthquake Monitoring Center cyberattack
August 16, 2023
China’s Ministry of State Security (MSS) on Wednesday warned of data security risks after recent reports identified US intelligence agencies were behind a cyberattack on Wuhan Earthquake Monitoring Center. A joint investigation team formed by the National Computer Virus Emergency Response Center (CVERC) and Chinese cybersecurity company 360 discovered malicious backdoor software that exhibits characteristics of ...
- Cyber crimes in Germany down 6.5% in 2022, federal police say
August 16, 2023
Cyber crimes in Germany fell by 6.5% in 2022, federal police said on Wednesday, but the decline was not a “relief” as the attacks were more severe and those originating from overseas rose by more than 8%. The economic damage was 203 billion euros ($221.59 billion), down slightly from last year, but still double that of ...
- More than 100,000 hackers have details exposed through malware on cyber crime forums
August 15, 2023
Researchers have revealed that more than 100,000 hackers could be operating on compromised devices due to their involvement on cyber crime forums. A study from Hudson Rock identified around 120,000 devices infected with malware that contained login credentials for cyber crime forums. The firm said that many of the individuals operating with compromised machines may have ...
- Discord.io gets taken down after massive data breach
August 15, 2023
Discord.io, a third-party service that helps people generate custom invites for their Discord channels, has been hacked, and information on some 760,000 members stolen. The service has since suspended its operations, and the attacker explained that this is actually a ransom attack – with a twist. As seen on BleepingComputer, a user going by the name ...
- New widespread IoT compromise could affect millions of logic controller chips
August 15, 2023
Microsoft security researcher Vladimir Tokarev demonstrated an interesting attack on the industrial internet of things automation software called Codesys. Tokarev, who showed the exploit last week at the annual BlackHat security conference in Las Vegas, used a miniature elevator model to demonstrate how the attack could crash its cab. The software – and more importantly, its ...
- UK: Victims and witnesses personal data leaked by Norfolk and Suffolk police
August 15, 2023
A total of 1,230 people, including victims of crime and witnesses, have had their data breached by Norfolk and Suffolk police forces. The constabularies said the personal information was included in Freedom of Information (FOI) responses due to a “technical issue”. They said the data was hidden from anyone opening the files but should not have ...