Krebs on Security

JANUARY 8, 2024

From January 2005 to April 2013, there were two primary administrators of the cybercrime forum Spamdot (a.k.a In December 2023, KrebsOnSecurity published new details about the identity of “Rescator,” a Russian cybercriminal who is thought to be closely connected to the 2013 data breach at Target.

Cybercrime 269

Cybercrime Banking Computers and Electronics DDOS 269

Security Affairs

JUNE 18, 2020

The group has been active since at least 2013, ESET experts linked the group to the Gamaredon Russian APT group Gamaredon despite considers the two crews independent. They use DNS tunneling for stealthier C&C communications, and place execution guardrails on the malicious components to hide the malware from security researchers.”

DNS 121

DNS Advertising Spyware Software 121

Security Affairs

AUGUST 28, 2018

Many of the domains used by COBALT DICKENS were registered between May and August 2018, most of them resolved to the same IP address and DNS name server. Iranian hacking activity is intensifying in the last years, security firms uncovered the activities of many Iran-linked APT groups. Securi ty Affairs – COBALT DICKENS, hacking).

Phishing 105

Phishing Advertising DNS Hacking 105

Security Affairs

JANUARY 18, 2022

The Winnti group was first spotted by Kaspersky in 2013, but according to the researchers the gang has been active since 2007. This script shows a social engineering message, such as a Flash update popup or a DNS error, and attempts to trick the victim into downloading a malicious file deploy a Cobalt Strike loader. Pierluigi Paganini.

Cryptocurrency 136

Cryptocurrency Media Social Engineering Phishing 136

Security Affairs

DECEMBER 11, 2018

The Novidade exploit kit leverages cross-site request forgery (CSRF) to change the Domain Name System (DNS) settings of SOHO routers and redirect traffic from the connected devices to the IP address under the control of the attackers. Security Affairs – Novidade exploit kit, hacking). ” continues the analysis.

DNS 111

DNS Advertising Firmware Banking 111

Security Affairs

MARCH 21, 2022

Then the backdoor contacts the command-and-control (C2) server to downloads and executes other malicious payloads, including the TunnelMole, malware that abuses the DNS protocol to establish a tunnel for malicious purposes, and RC2FM and RC2CL. SecurityAffairs – hacking, InvisiMole). ” reads the advisory published by CERT-UA.

Spyware 98

Spyware DNS Phishing Government 98

Security Affairs

SEPTEMBER 18, 2021

” Evidence collected by the experts suggests that the threat actor has been active at least since 2013. They abandon the C2 hostnames — which in this case are free DNS-based and they may change the crypter and initial vector, but they won’t stop their activity. SecurityAffairs – hacking, malware).

Malware 123

Malware Phishing DNS Cybercrime 123

Security Affairs

JULY 16, 2022

affects nginx resolver and can allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. some of them date back 2013. . some of them date back 2013. SecurityAffairs – hacking, Juniper Networks).

DNS 105

DNS Network Security Hacking Software 105

Security Affairs

JUNE 9, 2022

The group has been active since at least 2013, the Aoqin Dragon was observed seeking initial access primarily through document exploits and the use of fake removable devices. Other techniques employed by the APT group include DLL hijacking, Themida-packed files, and DNS tunneling to evade post-compromise detection. Pierluigi Paganini.

Malware 98

Malware DNS Encryption Education 98

Security Affairs

APRIL 27, 2023

Microsoft has been tracking the threat actors at least since 2013, but experts believe that the cyberespionage group has been active since at least 2011 targeting journalists and activists in the Middle East, as well as organizations in the United States, and entities in the U.K., Israel, Iraq, and Saudi Arabia.

Malware 98

Malware DNS Media Architecture 98

Security Affairs

DECEMBER 7, 2019

The hacking campaign confirmed that the Gamaredon operations are still ongoing and the high interest of the Kremlin in infiltrating the East European ecosystem, especially the Ukranian one. The group was first discovered by Symantec and TrendMicro in 2015 but evidence of its activities has been dated back to 2013.

Government 89

Government Advertising Media DNS 89

Cisco Security

OCTOBER 19, 2021

Much of this traffic is comprised of suspicious DNS queries, which point to known or likely Command and Control sites. DNS BIND information disclosure attempts were also commonly encountered. CVE-2013-2185. Like ShellShock, the exploit for this vulnerability is present in many automated hacking tools. CVE-2013-2134.

Firewall 145

Firewall Authentication DNS Accountability 145

Security Affairs

NOVEMBER 14, 2018

The email message contains a pdf document named ”Marine_Engine_Spare__Parts_Order.pdf”, originally prepared from an Office document using “ Microsoft Word 2013 ” and then converted into PDF format using the “ Online2PDF.com ” online service. DNS requests intercepted. possible usage of “ Microsoft Word 2013 ”. Attachment.

Computers and Electronics 109

Computers and Electronics Penetration Testing Malware Phishing 109

Security Affairs

OCTOBER 14, 2019

The Winnti group was first spotted by Kaspersky in 2013, according to the researchers the gang has been active since 2007. Each variant spotted by the experts was targeting different services and ports, including DNS over TCP (53), HTTP (80), HTTPS (443), Remote Desktop Protocol (3389) and Windows Remote Management (5985).

Manufacturing 107

Manufacturing Mobile Malware Software 107

Security Affairs

JUNE 4, 2019

The group was first discovered by Symantec and TrendMicro in 2015 but evidence of its activities has been dated back to 2013. Moreover, querying the services behind the latest associated DNS record the host responds with “403 Forbidden” message too, indicating the infrastructure may still be operative. Pierluigi Paganini.

Passwords 94

Passwords DNS Engineering Malware 94

Security Affairs

JULY 1, 2019

The OceanLotus APT group, also known as APT32 or Cobalt Kitty , is state-sponsored group that has been active since at least 2013. Experts at the security firm Cylance detected a new RAT dubbed Ratsnif that was used in cyber espionage operations conducted by the OceanLotus APT group.

Malware 84

Malware Advertising DNS Manufacturing 84

Security Affairs

JANUARY 15, 2020

If so we are facing a state-sponsored group with high capabilities in developing persistence and hidden communication channels (for example over DNS) but without a deep interest in exploiting services. According to MITRE: “APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. CopyKittens.

Computers and Electronics 98

Computers and Electronics Penetration Testing Malware Government 98

Security Affairs

OCTOBER 21, 2019

The Winnti group was first spotted by Kaspersky in 2013, according to the researchers the gang has been active since 2007. Each variant spotted by the experts was targeting different services and ports, including DNS over TCP (53), HTTP (80), HTTPS (443), Remote Desktop Protocol (3389) and Windows Remote Management (5985).

Malware 71

Malware Passwords Advertising DNS 71

SecureList

DECEMBER 8, 2022

Janicab was first introduced in 2013 as malware able to run on MacOS and Windows operating systems. Despite it being an old malware family that dates back to 2013, not much public information has been available on it in recent years and we see that the threat actor kept developing and updating the malware code.

Malware 134

Malware DNS Engineering Internet 134

Cisco Security

AUGUST 28, 2023

At each conference, we have a hack-a-thon: to create, prove, test, improve and finally put into production new or improved integrations. XDR (eXtended Detection and Response) Integrations At Black Hat USA 2023, Cisco Secure was the official Mobile Device Management, DNS (Domain Name Service) and Malware Analysis Provider.

Wireless 97

Wireless DNS Mobile Technology 97

eSecurity Planet

MARCH 10, 2021

The least common of SQL injection attacks, the out-of-band method relies on the database server to make DNS or HTTP requests delivering data to an attacker. . . . Also Read: Apple White Hat Hack Shows Value of Pen Testers . Out-of-band. Testing for SQL Injection Vulnerabilities. Enforce Prepared Statements and Parameterization.

Penetration Testing 119

Penetration Testing Firewall Software Accountability 119

eSecurity Planet

DECEMBER 3, 2021

Shah provides her expertise in hacking, software development, and kernel development and advocates for open source initiatives. Lots of accounts including Bezos, Elon Musk, Joe Biden, Barack Obama, Bill Gates, Mr Beast, and a ton more getting hacked for a bitcoin scheme. Tabriz is a tireless advocate for ethical hacking.

Accountability 139

Accountability Cybersecurity Penetration Testing InfoSec 139

ForAllSecure

APRIL 19, 2023

I first met Dan when he was literally saving the world; okay, at least saving the internet as we know it today by disclosing to the major ISPs in the world a flaw he’d found in the Domain Name System or DNS. It’s about challenging our expectations about people who hack for a living. I hope you stick around.

Software 40

Software Backups Computers and Electronics Technology 40

Security Affairs

MARCH 6, 2019

On April 7th, 2013, for instance, the most successful attack executed by Anonymous group using data leakage and DoS conditions against a huge number of Israeli websites was noted. According to media (see this link ), since the attack in 2013, the number of participants and supporters is decreasing. Pierluigi Paganini.

Ransomware 106

Ransomware Encryption Malware Cyber Attacks 106

SecureList

APRIL 27, 2021

It was first publicly documented in 2014, in the aftermath of the Gamma Group hacking incident. Although Lyceum still prefers taking advantage of DNS tunneling, it appears to have replaced the previously documented.NET payload with a new C++ backdoor and a PowerShell script that serve the same purpose.

Malware 145

Malware Government Spyware Social Engineering 145

Security Affairs

MARCH 6, 2019

On April 7th, 2013, for instance, the most successful attack executed by Anonymous group using data leakage and DoS conditions against a huge number of Israeli websites was noted. According to media (see this link ), since the attack in 2013, the number of participants and supporters is decreasing. Pierluigi Paganini.

Ransomware 40

Ransomware Encryption Malware Cyber Attacks 40

Herjavec Group

AUGUST 26, 2021

1834 — French Telegraph System — A pair of thieves hack the French Telegraph System and steal financial market information, effectively conducting the world’s first cyberattack. 1870 — Switchboard Hack — A teenager hired as a switchboard operator is able to disconnect and redirect calls and use the line for personal usage. .

Cybercrime 135

Cybercrime Computers and Electronics Banking Hacking 135