Krebs on Security

SEPTEMBER 26, 2024

Sometime around 2013, Taleon launched a partnership with a money transfer business called pm2btc[.]me. Passive domain name system (DNS) records show that in its early days BriansClub shared a server in Lithuania along with just a handful of other domains, including secure.pinpays[.]com A screenshot of a website reviewing PM2BTC.

Cryptocurrency 244

Cryptocurrency Cybercrime Retail Government 244

Krebs on Security

MARCH 2, 2020

HYAS said it quickly notified the French national computer emergency team and the FBI about its findings, which pointed to a dynamic domain name system (DNS) provider on which the purveyors of this attack campaign relied for their various malware servers. ‘FATAL’ ERROR.

DNS 272

DNS Penetration Testing Malware Hacking 272

Security Affairs

APRIL 22, 2020

The Winnti group was first spotted by Kaspersky in 2013, but according to the researchers the gang has been active since 2007. “The technique relies on a DNS Tunneling communication channel through a custom implementation of the iodine source code , an open-source software that enables the tunneling of IPv4 data through a DNS server.

DNS 144

DNS Malware Advertising Software 144

Krebs on Security

DECEMBER 8, 2020

Additionally, Microsoft released an advisory on how to minimize the risk from a DNS spoofing weakness in Windows Server 2008 through 2019. These vulnerabilities affect Microsoft Excel 2013 through 2019, Microsoft 365 32 and 64 bit versions, Microsoft Office 2019 32 and 64 bit versions, and Microsoft Excel for Mac 2019.”

DNS 301

DNS Backups Malware Software 301

Security Boulevard

MAY 17, 2023

Most of these steps could’ve been blocked with the aid of DNS protection. It would be easy to chalk up this increase to the development and introduction of new advanced types of malware, but the surprising fact is that many of the same threats and exploits used in data breaches in 2013 are still being successfully employed 10 years later.

Data breaches 52

Data breaches DNS Malware Phishing 52

Security Affairs

JUNE 18, 2020

The group has been active since at least 2013, ESET experts linked the group to the Gamaredon Russian APT group Gamaredon despite considers the two crews independent. They use DNS tunneling for stealthier C&C communications, and place execution guardrails on the malicious components to hide the malware from security researchers.”

DNS 123

DNS Advertising Spyware Software 123

Security Affairs

MARCH 21, 2022

Then the backdoor contacts the command-and-control (C2) server to downloads and executes other malicious payloads, including the TunnelMole, malware that abuses the DNS protocol to establish a tunnel for malicious purposes, and RC2FM and RC2CL. The LoadEdge backdoor maintains persistence through the Windows registry.

Spyware 98

Spyware DNS Phishing Government 98

Security Affairs

JULY 16, 2022

affects nginx resolver and can allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. some of them date back 2013. . some of them date back 2013. The most severe flaw, tracked as CVE-2021-23017 (CVSS score 9.4)

DNS 106

DNS Network Security Hacking Software 106

Krebs on Security

JANUARY 8, 2024

From January 2005 to April 2013, there were two primary administrators of the cybercrime forum Spamdot (a.k.a In December 2023, KrebsOnSecurity published new details about the identity of “Rescator,” a Russian cybercriminal who is thought to be closely connected to the 2013 data breach at Target.

Cybercrime 231

Cybercrime Banking Computers and Electronics DDOS 231

Security Affairs

APRIL 27, 2023

Microsoft has been tracking the threat actors at least since 2013, but experts believe that the cyberespionage group has been active since at least 2011 targeting journalists and activists in the Middle East, as well as organizations in the United States, and entities in the U.K., Israel, Iraq, and Saudi Arabia.

Malware 98

Malware DNS Media Architecture 98

Security Affairs

JANUARY 18, 2022

The Winnti group was first spotted by Kaspersky in 2013, but according to the researchers the gang has been active since 2007. This script shows a social engineering message, such as a Flash update popup or a DNS error, and attempts to trick the victim into downloading a malicious file deploy a Cobalt Strike loader.

Cryptocurrency 137

Cryptocurrency Social Engineering Media Phishing 137

Security Affairs

JUNE 9, 2022

The group has been active since at least 2013, the Aoqin Dragon was observed seeking initial access primarily through document exploits and the use of fake removable devices. Other techniques employed by the APT group include DLL hijacking, Themida-packed files, and DNS tunneling to evade post-compromise detection.

Malware 98

Malware DNS Encryption Education 98

Security Affairs

SEPTEMBER 18, 2021

” Evidence collected by the experts suggests that the threat actor has been active at least since 2013. They abandon the C2 hostnames — which in this case are free DNS-based and they may change the crypter and initial vector, but they won’t stop their activity. ” Follow me on Twitter: @securityaffairs and Facebook.

Malware 124

Malware Phishing DNS Cybercrime 124

Security Affairs

DECEMBER 11, 2018

The Novidade exploit kit leverages cross-site request forgery (CSRF) to change the Domain Name System (DNS) settings of SOHO routers and redirect traffic from the connected devices to the IP address under the control of the attackers. The exploit kit blindly attacks the detected IP address with all its exploits. .

DNS 111

DNS Advertising Firmware Banking 111

Krebs on Security

JULY 3, 2023

However, searching passive DNS records at DomainTools.com for thedomainsvault[.]com The shenhavgroup@gmail.com address was used to register a Twitter account for a Sam Orit Alon in 2013, whose account says they are affiliated with the Shenhav Group. Thedomainsvault[.]com

Scams 260

Scams Business Services Accountability Marketing 260

Security Boulevard

DECEMBER 11, 2021

In 2013 ( version 2.0-beta9 Using a DNS logger (such as dnslog.cn ), you can generate a domain name and use this in your test payloads: // if server in test is running on localhost curl 127.0.0.1:8080 Refreshing the page will show DNS queries which identify hosts who have triggered the vulnerability.

DNS 134

DNS Internet Internet Accountability 134

Security Affairs

AUGUST 26, 2018

Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Spyware 61

Spyware Banking DNS Advertising 61

Security Affairs

DECEMBER 7, 2019

The group was first discovered by Symantec and TrendMicro in 2015 but evidence of its activities has been dated back to 2013. Upon reboot, the VBScript performs an HTTP GET request to fetch an encrypted stage from a dynamic DNS domain. The Gamaredon group. The payload, however, is only sent if the target is deemed of interest.

Government 88

Government Advertising Media DNS 88

Cisco Security

OCTOBER 19, 2021

Much of this traffic is comprised of suspicious DNS queries, which point to known or likely Command and Control sites. DNS BIND information disclosure attempts were also commonly encountered. CVE-2013-2185. CVE-2013-2134. Command and Control activity came in third, where 48.7 CVE-2018-10562. CVE-2007-1036. CVE-2018-7600.

Firewall 138

Firewall Authentication DNS Accountability 138

Malwarebytes

APRIL 6, 2023

Malwarebytes CEO Marcin Kleczynski summed it up in 2013, promising more show-stopping acts in the future: “We have been making great progress since the launch of MEE, and this is just the start. ” And you best believe that Marcin was true to his word. But wait, there's more!

Cybersecurity 67

Cybersecurity Malware Cyber threats Small Business 67

Security Affairs

OCTOBER 14, 2019

The Winnti group was first spotted by Kaspersky in 2013, according to the researchers the gang has been active since 2007. Each variant spotted by the experts was targeting different services and ports, including DNS over TCP (53), HTTP (80), HTTPS (443), Remote Desktop Protocol (3389) and Windows Remote Management (5985).

Manufacturing 107

Manufacturing Mobile Malware Software 107

Krebs on Security

SEPTEMBER 6, 2021

” The IT network of The Manipulaters, circa 2013. As I noted in 2015, The Manipulaters Team used domain name service (DNS) settings from another blatantly fraudulent service called ‘ FreshSpamTools[.]eu Regarding phishing, whenever we receive complaint, we remove the services immediately. Image: Facebook.

Software 262

Software Phishing Cybercrime Accountability 262

Security Affairs

OCTOBER 21, 2019

The Winnti group was first spotted by Kaspersky in 2013, according to the researchers the gang has been active since 2007. Each variant spotted by the experts was targeting different services and ports, including DNS over TCP (53), HTTP (80), HTTPS (443), Remote Desktop Protocol (3389) and Windows Remote Management (5985).

Malware 71

Malware Passwords Advertising DNS 71

Security Affairs

JULY 1, 2019

The OceanLotus APT group, also known as APT32 or Cobalt Kitty , is state-sponsored group that has been active since at least 2013. Experts at the security firm Cylance detected a new RAT dubbed Ratsnif that was used in cyber espionage operations conducted by the OceanLotus APT group.

Malware 84

Malware Advertising DNS Manufacturing 84

Security Affairs

JUNE 4, 2019

The group was first discovered by Symantec and TrendMicro in 2015 but evidence of its activities has been dated back to 2013. Moreover, querying the services behind the latest associated DNS record the host responds with “403 Forbidden” message too, indicating the infrastructure may still be operative.

Passwords 95

Passwords DNS Engineering Malware 95

Security Affairs

NOVEMBER 14, 2018

The email message contains a pdf document named ”Marine_Engine_Spare__Parts_Order.pdf”, originally prepared from an Office document using “ Microsoft Word 2013 ” and then converted into PDF format using the “ Online2PDF.com ” online service. DNS requests intercepted. possible usage of “ Microsoft Word 2013 ”. Attachment.

Computers and Electronics 109

Computers and Electronics Penetration Testing Malware Phishing 109

Cisco Security

AUGUST 28, 2023

XDR (eXtended Detection and Response) Integrations At Black Hat USA 2023, Cisco Secure was the official Mobile Device Management, DNS (Domain Name Service) and Malware Analysis Provider. SCA detected 289 alerts including Suspected Port Abuse, Internal Port Scanner, New Unusual DNS Resolver,and Protocol Violation (Geographic).

Wireless 81

Wireless DNS Mobile Technology 81

eSecurity Planet

FEBRUARY 8, 2021

vSkimmer malware, a successor to Dexter, dates back to 2013. Backoff malware, which also dates back to 2013, scrapes memory for track data, logs keystrokes, and connects to a command and control server to upload stolen data and download additional malware. Errors to avoid.

Retail 52

Retail Encryption Malware Artificial Intelligence 52

Troy Hunt

MARCH 1, 2018

This is a little project I started whilst killing time in a hotel room in late 2013 after thinking "I wonder if people actually know where their data has been exposed?" If I'm honest, I'm constantly surprised by the extent of how far Have I Been Pwned (HIBP) is reaching these days.

Government 186

Government Data breaches Passwords Authentication 186

Malwarebytes

JULY 19, 2021

Because this IP address has not changed over several months, we investigated the passive DNS records to see if the infrastructure may have been used in other recent attacks. Furthermore, analysis also revealed that the #totalhash malware database contains malware associated with this address going back as far as 2013. 168 on port 8888.

Malware 144

Malware DNS Software Marketing 144

eSecurity Planet

JANUARY 26, 2022

Catchpoint Features. Dynatrace offers a full-stack application performance monitoring and digital experience platform for modern hybrid environments. Read more : Best Intrusion Detection and Prevention Systems for 2022. ManageEngine.

Marketing 120

Marketing DDOS Threat Detection DNS 120

NopSec

JANUARY 27, 2015

Applications have access to the DNS resolver primarily through the gethostbyname*() set of functions. In particular, it was discovered that the bug was fixed on May 21, 2013 (between the releases of glibc-2.17 The vulnerability is a buffer overflow in the __nss_hostname_digits_dots() function of glibc. released on November 10, 2000.

DNS 52

DNS Internet Internet Risk 52

Cisco Security

MAY 12, 2022

Their activities can be traced back as early as 2013, prior to Russia’s annexation of the Crimean Peninsula. Therefore, DNS and outgoing web traffic is crucial for its detection. Gamaredon group, also known as Primitive Bear, Shuckworm and ACTINIUM, is an advanced persistent threat (APT) based in Russia.

Malware 120

Malware DNS DDOS Phishing 120

Troy Hunt

JUNE 15, 2023

We can't touch DNS. And so on and so forth until my inbox looked like this: This was Azure auto-scale doing its thing and it was one of the early attractions for me building HIBP on Microsoft's PaaS offering way back in 2013. We don't have any of those 4 aliases on our domain. We can't add a meta tag.

Accountability 229

Accountability Small Business InfoSec DNS 229

eSecurity Planet

MARCH 25, 2022

N-able – formerly SolarWinds MSP between 2013 and 2021 – has over two decades of experience in integrated monitoring and management tools for enterprise organizations. Other cybersecurity tools offered include DNS filtering, disk encryption , backups , and email security for Microsoft-oriented infrastructure.

VPN 120

VPN Software Authentication Encryption 120

SecureList

DECEMBER 8, 2022

Janicab was first introduced in 2013 as malware able to run on MacOS and Windows operating systems. Despite it being an old malware family that dates back to 2013, not much public information has been available on it in recent years and we see that the threat actor kept developing and updating the malware code.

Malware 111

Malware DNS Engineering Internet 111

Malwarebytes

JULY 19, 2021

Because this IP address has not changed over several months, we investigated the passive DNS records to see if the infrastructure may have been used in other recent attacks. Furthermore, analysis also revealed that the #totalhash malware database contains malware associated with this address going back as far as 2013. 168 on port 8888.

Malware 52

Malware DNS Software Marketing 52