Two spyware tied with China found hiding on the Google Play Store
This week, our engine detected two spyware hiding on the Google Play Store and affecting up to 1.5 million users.
cyberveille.decio.ch
Operation Brainleeches: Malicious npm packages fuel supply chain and phishing attacks
“Write once, infect everywhere” might be the new cybercrime motto, with newly discovered campaigns showing malicious npm packages powering phishing kits and supply chain attacks.
Hacks targeting British exam boards raise fears of students cheating
One incident affected the OCR and Pearson Edexcel examiners, and another hit AQA, Britain's largest exam board.
FBI digital sting against Hive cybercrime group shows the promise — and limits — of hacking hackers
The bureau is trying to take the fight to foreign ransomware gangs, even if it means giving up on bringing some of them behind bars.
Port of Nagoya cyberattack: Japanese port paralysed by LockBit
Japan’s biggest port, the Port of Nagoya, has been shut down after a cyberattack by the LockBit ransomware gang. The Russian cybercriminals have been on a crime spree this week, claiming ten new victims in the last five days.
BlueNoroff | How DPRK’s macOS RustBucket Seeks to Evade Analysis and Detection -
Threat actors are using increasingly sophisticated forms of evasion and anti-analysis as they respond to increased attention to macOS security in the enterprise.
Suspected key figure of notorious cybercrime group arrested in joint operation
Operation Nervone has dealt a significant blow to the OPERA1ER group.
Clop Ransomware: History, Timeline, And Adversary Simulation
The infamous Clop ransomware, mainly known as Cl0p, targets various industries and organizations, extorting data for a huge amount of ransom. It advances actively with new emerging campaigns. This blog walks through the Clop timeline, Mitre TTPs and their emulation.
BlackCat Operators Distributing Ransomware Disguised as WinSCP via Malvertising
Threat actors associated with the BlackCat ransomware have been observed employing malvertising tricks to distribute rogue installers of the WinSCP file transfer application.
Campagne MOVEit : Cl0p divulgue une grande quantité de données volées à Cegedim
Le groupe Cl0p a poursuivi la diffusion des données volées à Cegedim à l’occasion de sa campagne de cyberattaques contre les instances MOVEit Transfer. Il met désormais à disposition plus de 1,5 To de données.
Au mois de juin, la menace des infostealers n’a pas faibli
Plus furtive et discrète que les cyberattaques avec rançongiciel, la menace des maliciels dérobeurs se maintient à un niveau élevé. Panorama de la menace en collaboration avec Sekoia.io.
Following NoName057(16) DDoSia Project’s Targets
DDoSia is a DDoS attack toolkit used by the pro-Russia hacktivist group NoName057(16) against countries critical the invasion of Ukraine.
Chinese Threat Actors Targeting Europe in SmugX Campaign
In the last couple of months, Check Point Research (CPR) has been tracking the activity of a Chinese threat actor targeting Foreign Affairs ministries and embassies in Europe. Combined with other Chinese activity previously reported by Check Point Research, this represents a larger trend within the Chinese ecosystem, pointing to a shift to targeting European entities, with a focus on their foreign policy. The activity described in this report, utilizes HTML Smuggling to target governmental entities in Eastern Europe. This specific campaign has been active since at least December 2022, and is likely a direct continuation of a previously reported campaign attributed to RedDelta (and also to Mustang Panda, to some extent).
Detecting Popular Cobalt Strike Malleable C2 Profile Techniques
We examine malicious Cobalt Strike case studies with distinct techniques using Malleable C2 profiles.
Malvertising Used as Entry Vector for BlackCat Actors Also Leverage SpyBoy Terminator
We found that malicious actors used malvertising to distribute malware via cloned webpages of legitimate organizations. The distribution involved a webpage of the well-known application WinSCP, an open-source Windows application for file transfer. We were able to identify that this activity led to a BlackCat (aka ALPHV) infection, and actors also used SpyBoy, a terminator that tampers with protection provided by agents.
Decrypted: Akira Ransomware
Researchers for Avast have developed a decryptor for the Akira ransomware and released it for public download. The Akira ransomware appeared in March 2023 and since then, the gang claims successful attacks on various organizations in the education, finance and real estate industries, amongst others.
NCSC marks 20th anniversary of first response to state-sponsored cyber attack
In June 2003, GCHQ experts were involved in responding to a cyber attack against the UK Government for the first time.
TSMC Says Supplier Hacked After Ransomware Group Claims Attack on Chip Giant
The LockBit ransomware group claims to have hacked Taiwan Semiconductor Manufacturing Company (TSMC), but the chip giant says only one of its suppliers was breached. The notorious cybercrime group announced on Thursday on its website that it targeted TSMC, suggesting — based on the $70 million ransom demand — that it has stolen vast amounts of sensitive information. The victim was initially given seven days to respond, but the deadline has been extended to August 6 at the time of writing.
Hacker stehlen bei der Fedpol sensible Daten zu Bundesräten und Botschaften
Dokumente der Bundespolizei Fedpol sind im Darknet gelandet - darunter auch Schutzmassnahmen für ausländische Botschaften und den Bundesrat.
A cause de la cyberattaque contre Xplain, des secrets d'Etat sont en ligne
Après la cyberattaque contre Xplain – un des prestataires de la Confédération – les dispositifs de sécurité détaillés de Fedpol et des données de connexions de certains offices fédéraux se retrouvent sur le Darknet. Le Parlement demande des comptes.
Des données confidentielles sur des conseillers fédéraux volées lors de la cyberattaque
Des pirates informatiques ont dérobé des documents confidentiels du Service fédéral de sécurité (SFS) lors de l'attaque contre le prestataire de la Confédération Xplain, selon des informations concordantes des médias. Des fichiers ont été publiés sur le DarkNet.
High school changes every student’s password to ‘Ch@ngeme!’
After a cybersecurity audit mistakenly reset everyone’s password, a high school changed every student’s password to “Ch@ngeme!” giving every student the chance to hack into any other student’s account, according to emails obtained by TechCrunch.
CVE-2023-27997 is Exploitable, and 69% of FortiGate…
Bishop Fox internally developed an exploit for CVE-2023-27997, a heap overflow in FortiOS—the OS behind FortiGate firewalls—that allows remote code execution. There are 490,000 affected SSL VPN interfaces exposed on the internet, and roughly 69% of them are currently unpatched. You should patch yours now
TSMC confirms data breach after LockBit cyberattack on third-party supplier
One of the world's biggest chipmakers confirmed a data breach after the LockBit ransomware gang targeted one of its third-party providers.
Malware Execution Method Using DNS TXT Record
AhnLab Security Emergency response Center (ASEC) has confirmed instances where DNS TXT records were being utilized during the execution process of malware. This is considered meaningful from various perspectives, including analysis and detection as this method has not been widely utilized as a means of executing malware.
Meduza Stealer or The Return of The Infamous Aurora Stealer
Meduza Stealer malware analysis
SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation
The Securities and Exchange Commission has notified the chief financial officer and CISO of SolarWinds about potential enforcement actions related to the 2020 cyberattack against the company’s Orion software platform, the company disclosed in a regulatory filing with the agency.
Tracing Ransomware Threat Actors Through Stylometric Analysis and Chat Log Examination
I stumbled upon an intriguing concept presented by Will Thomas (BushidoToken) in his blog post titled “Unmasking Ransomware Using Stylometric Analysis: Shadow, 8BASE, Rancoz.” This concept revolves around utilizing stylometry to identify potential modifications in new ransomware variants based on existing popular strains. If you’re interested, you can read the blog post here. (Notably, Will Thomas also appeared on Dark Net Diaries, discussing his tracking of the Revil ransomware.)
Une équipe d’intervention cantonale épaulera les communes vaudoises en cas de cyberattaque
Via une convention avec les communes, l’IT du canton de Vaud va créer une équipe d’intervention chargée de leur prêter main forte aux niveaux organisationnel et technique en cas de cyberattaque. La force de réaction s'appuiera également sur des prestataires spécialisés locaux.
Akira Ransomware Extends Reach to Linux Platform
Cyble Research & Intelligence Labs examines the Linux variant of Akira Ransomware and assesses its impact on various sectors.