cyberveille.decio.ch

cyberveille.decio.ch

5334 bookmarks
Custom sorting
Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Variant | United States Department of Justice
Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Variant | United States Department of Justice
The Justice Department announced today a disruption campaign against the Blackcat ransomware group — also known as ALPHV or Noberus — that has targeted the computer networks of more than 1,000 victims and caused harm around the world since its inception, including networks that support U.S. critical infrastructure.
#justice.gov#EN#2023#ALPHV#Blackcat#ransomware#group#Disrupts#announce
·justice.gov·
Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Variant | United States Department of Justice
Ransomware Diaries: Volume 1
Ransomware Diaries: Volume 1
The LockBit ransomware gang is one of the most notorious organized cybercrime syndicates that exists today. The gang is behind attacks targeting private-sector corporations and other high-profile industries worldwide. News and media outlets have documented many LockBit attacks, while security vendors offer technical assessments explaining how each occurred. Although these provide insight into the attacks, I wanted to know more about the human side of the operation to learn about the insights, motivations, and behaviors of the individuals on the other side of the keyboard. To prepare for this project, I spent months developing several online personas and established their credibility over time to gain access to the gang’s operation.
#analyst1#EN#2023#LockBit#ransomware#Insights
·analyst1.com·
Ransomware Diaries: Volume 1
Shc Linux Malware Installing CoinMiner
Shc Linux Malware Installing CoinMiner
The ASEC analysis team recently discovered that a Linux malware developed with Shc has been installing a CoinMiner. It is presumed that after successful authentication through a dictionary attack on inadequately managed Linux SSH servers, various malware were installed on the target system. Among those installed were the Shc downloader, XMRig CoinMiner installed through the former, and DDoS IRC Bot, developed with Perl.
#asec#2023#EN#Shell#Script#Compiler#analysis#Linux#Malware#CoinMiner#Shc
·asec.ahnlab.com·
Shc Linux Malware Installing CoinMiner
LockBit ransomware suspect nabbed in Canada, faces charges in the US
LockBit ransomware suspect nabbed in Canada, faces charges in the US
Automation features make LockBit one of the more destructive pieces of ransomware. Federal prosecutors on Thursday charged a dual Russian and Canadian national for his alleged participation in a global campaign to spread ransomware known as LockBit. Mikhail Vasiliev, 33, of Bradford, Ontario, Canada, was taken into custody in late October by authorities in Ontario, officials at Interpol said. He is now in custody in Canada awaiting extradition to the US.
#arstechnica#EN#2022#LockBit#Canada#member#arrest
·arstechnica.com·
LockBit ransomware suspect nabbed in Canada, faces charges in the US
Crimson Kingsnake: BEC Group Impersonates…
Crimson Kingsnake: BEC Group Impersonates…
Recently, we identified a new BEC group leveraging blind third-party impersonation tactics to swindle companies around the world. The group, which we call Crimson Kingsnake, impersonates real attorneys, law firms, and debt recovery services to deceive accounting professionals into quickly paying bogus invoices.
#abnormalsecurity#EN#2022#BEC#invoices#Crimson-Kingsnake#impersonation#scam
·abnormalsecurity.com·
Crimson Kingsnake: BEC Group Impersonates…
Tech tool offers police ‘mass surveillance on a budget’
Tech tool offers police ‘mass surveillance on a budget’
Local law enforcement agencies from suburban Southern California to rural North Carolina have been using an obscure cellphone tracking tool, at times without search warrants, that gives them the power to follow people’s movements months back in time, according to public records and internal emails obtained by The Associated Press.
#ApNews#EN#2022#AP-Investigations#Technology#Police#California#Arkansas#Weekend-Reads#North-Carolina#privacy#Government-surveillance#Law-enforcement-agencies#Criminal-investigations
·apnews.com·
Tech tool offers police ‘mass surveillance on a budget’
Comprehensive Threat Intelligence: Cisco Talos shares insights related to recent cyber attack on Cisco
Comprehensive Threat Intelligence: Cisco Talos shares insights related to recent cyber attack on Cisco
  • On May 24, 2022, Cisco became aware of a potential compromise. Since that point, Cisco Security Incident Response (CSIRT) and Cisco Talos have been working to remediate. * During the investigation, it was determined that a Cisco employee’s credentials were compromised after an attacker gained control of a personal Google account where credentials saved in the victim’s browser were being synchronized.
#talosintelligence#EN#2022#Cisco#attack#Google#sync#password#insights
·blog.talosintelligence.com·
Comprehensive Threat Intelligence: Cisco Talos shares insights related to recent cyber attack on Cisco
A new botnet Orchard Generates DGA Domains with Bitcoin Transaction Information
A new botnet Orchard Generates DGA Domains with Bitcoin Transaction Information
DGA is one of the classic techniques for botnets to hide their C2s, attacker only needs to selectively register a very small number of C2 domains, while for the defenders, it is difficult to determine in advance which domain names will be generated and registered.
#netlab360#EN#2022#Orchard#botnet#C2#bitcoin#domains
·blog.netlab.360.com·
A new botnet Orchard Generates DGA Domains with Bitcoin Transaction Information
Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns
Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns
  • Dark Utilities, released in early 2022, is a platform that provides full-featured C2 capabilities to adversaries. It is marketed as a means to enable remote access, command execution, distributed denial-of-service (DDoS) attacks and cryptocurrency mining operations on infected systems. Payloads provided by the platform support Windows, Linux and Python-based implementations and are hosted within the Interplanetary File System (IPFS), making them resilient to content moderation or law enforcement intervention. Since its initial release, we've observed malware samples in the wild leveraging it to facilitate remote access and cryptocurrency mining.
#talosintelligence#2022#dark-utilities#DarkUtilities#C2
·blog.talosintelligence.com·
Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns