Found 5714 bookmarks
Newest
Decrypted: Akira Ransomware
Decrypted: Akira Ransomware
Researchers for Avast have developed a decryptor for the Akira ransomware and released it for public download. The Akira ransomware appeared in March 2023 and since then, the gang claims successful attacks on various organizations in the education, finance and real estate industries, amongst others.
#avast#EN#2023#Akira#decryptor#Windows#ransomware
·decoded.avast.io·
Decrypted: Akira Ransomware
TSMC Says Supplier Hacked After Ransomware Group Claims Attack on Chip Giant
TSMC Says Supplier Hacked After Ransomware Group Claims Attack on Chip Giant
The LockBit ransomware group claims to have hacked Taiwan Semiconductor Manufacturing Company (TSMC), but the chip giant says only one of its suppliers was breached. The notorious cybercrime group announced on Thursday on its website that it targeted TSMC, suggesting — based on the $70 million ransom demand — that it has stolen vast amounts of sensitive information. The victim was initially given seven days to respond, but the deadline has been extended to August 6 at the time of writing.
#securityweek#EN#2023#LockBit#TSMC#ransomware
·securityweek.com·
TSMC Says Supplier Hacked After Ransomware Group Claims Attack on Chip Giant
Des données confidentielles sur des conseillers fédéraux volées lors de la cyberattaque
Des données confidentielles sur des conseillers fédéraux volées lors de la cyberattaque
Des pirates informatiques ont dérobé des documents confidentiels du Service fédéral de sécurité (SFS) lors de l'attaque contre le prestataire de la Confédération Xplain, selon des informations concordantes des médias. Des fichiers ont été publiés sur le DarkNet.
#rts#FR#2023#suisse#SFS#confidentielles#conseillers-fédéraux#Xplain#Confédération
·rts.ch·
Des données confidentielles sur des conseillers fédéraux volées lors de la cyberattaque
CVE-2023-27997 is Exploitable, and 69% of FortiGate…
CVE-2023-27997 is Exploitable, and 69% of FortiGate…
Bishop Fox internally developed an exploit for CVE-2023-27997, a heap overflow in FortiOS—the OS behind FortiGate firewalls—that allows remote code execution. There are 490,000 affected SSL VPN interfaces exposed on the internet, and roughly 69% of them are currently unpatched. You should patch yours now
#bishopfox#EN#2023#FortiGate#CVE-2023-27997
·bishopfox.com·
CVE-2023-27997 is Exploitable, and 69% of FortiGate…
Malware Execution Method Using DNS TXT Record
Malware Execution Method Using DNS TXT Record
AhnLab Security Emergency response Center (ASEC) has confirmed instances where DNS TXT records were being utilized during the execution process of malware. This is considered meaningful from various perspectives, including analysis and detection as this method has not been widely utilized as a means of executing malware.
#ASEC#EN#2023#DNS#TXT#malware#analysis
·asec.ahnlab.com·
Malware Execution Method Using DNS TXT Record
SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation
SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation
The Securities and Exchange Commission has notified the chief financial officer and CISO of SolarWinds about potential enforcement actions related to the 2020 cyberattack against the company’s Orion software platform, the company disclosed in a regulatory filing with the agency.
#cybersecuritydive#EN#2023#regulation#SolarWinds#CISO#CFO#cyberattack#action#justice#legal
·cybersecuritydive.com·
SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation
Tracing Ransomware Threat Actors Through Stylometric Analysis and Chat Log Examination
Tracing Ransomware Threat Actors Through Stylometric Analysis and Chat Log Examination
I stumbled upon an intriguing concept presented by Will Thomas (BushidoToken) in his blog post titled “Unmasking Ransomware Using Stylometric Analysis: Shadow, 8BASE, Rancoz.” This concept revolves around utilizing stylometry to identify potential modifications in new ransomware variants based on existing popular strains. If you’re interested, you can read the blog post here. (Notably, Will Thomas also appeared on Dark Net Diaries, discussing his tracking of the Revil ransomware.)
#callyso0414#YUCA#medium#EN#2023#ransomware#logs#log#chats#Stylometric#Analysis
·medium.com·
Tracing Ransomware Threat Actors Through Stylometric Analysis and Chat Log Examination
Une équipe d’intervention cantonale épaulera les communes vaudoises en cas de cyberattaque
Une équipe d’intervention cantonale épaulera les communes vaudoises en cas de cyberattaque
Via une convention avec les communes, l’IT du canton de Vaud va créer une équipe d’intervention chargée de leur prêter main forte aux niveaux organisationnel et technique en cas de cyberattaque. La force de réaction s'appuiera également sur des prestataires spécialisés locaux.
#ictjournal#CH#FR#VD#Vaud#convention#cyberattaque
·ictjournal.ch·
Une équipe d’intervention cantonale épaulera les communes vaudoises en cas de cyberattaque
Dismantling encrypted criminal EncroChat communications leads to over 6 500 arrests and close to EUR 900 million seized
Dismantling encrypted criminal EncroChat communications leads to over 6 500 arrests and close to EUR 900 million seized
The dismantling of EncroChat in 2020 sent shockwaves across OCGs in Europe and beyond. It helped to prevent violent attacks, attempted murders, corruption and large-scale drug transports, as well as obtain large-scale information on organised crime.   OCGs worldwide illegally used the encryption tool EncroChat for criminal purposes. Since the dismantling, investigators managed to intercept, share and analyse over 115...
#europol#EN#2023#EncroChat#encrypted
·europol.europa.eu·
Dismantling encrypted criminal EncroChat communications leads to over 6 500 arrests and close to EUR 900 million seized
Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution
Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution
Our research team is committed to continuously identifying potential security vulnerabilities and techniques that threat actors may exploit to bypass existing security controls. In this blog post, our team is detailing on a comprehensive research specifically focused on process injection techniques utilized by attackers to deceive robust security products integrated into the security stack, such as EDRs and XDRs. Throughout the blog post, we will delve into various process injection techniques e
#securityjoes#EN#2023#Mockingjay#EDR#bypass#technique#RWX#Code#Execution
·securityjoes.com·
Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution
PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID
PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID
Deep Instinct’s Threat Research Lab recently noticed a new strain of a JavaScript-based dropper that is delivering Bumblebee and IcedID. The dropper contains comments in Russian and employs the unique user-agent string “PindOS”, which may be a reference to current (and past) anti-American sentiment in Russia. Bumblebee is a malware loader first discovered in March 2022. It was associated with Conti group and was being used as a replacement for BazarLoader. It acts as a primary vector for multiple types of other malware, including ransomware. IcedID is a modular banking malware designed to steal financial information. It has been seen in the wild since at least 2017 and has recently been observed shifting some of its focus to malware delivery.
#deepinstinct#EN#2023#JavaScript#Dropper#PindOS#Bumblebee#analysis
·deepinstinct.com·
PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID
Fragments of Cross-Platform Backdoor Hint at Larger Mac OS Attack
Fragments of Cross-Platform Backdoor Hint at Larger Mac OS Attack
During routine detection maintenance, our Mac researchers stumbled upon a small set of files with backdoor capabilities that seem to form part of a more complex malware toolkit. The following analysis is incomplete, as we are trying to identify the puzzle pieces that are still missing.
#bitdefender#EN#2023#macOS#malware#Cross-Platform#Backdoor
·bitdefender.com·
Fragments of Cross-Platform Backdoor Hint at Larger Mac OS Attack