Security Affairs

MAY 13, 2019

Yoroi Cyber Security Annual Report 2018 – In 2018 cyber-security experts observed an increased number of cyber attacks, malware endure to be the most aggressive and pervasive threat. Yoroi Cyber Security Annual Report 2018 analyzes the evolution of the threat landscape observed between January 2018 and December 2018.

Malware 108

Malware Advertising DNS Surveillance 108

Krebs on Security

JANUARY 22, 2019

In July 2018, email users around the world began complaining of receiving spam which began with a password the recipient used at some point in the past and threatened to release embarrassing videos of the recipient unless a bitcoin ransom was paid. 13, 2018 bomb threat hoax. ” SAY WHAT? ” SAY WHAT?

DNS 244

DNS Internet Internet Computers and Electronics 244

Krebs on Security

FEBRUARY 4, 2019

But several more recent malware spam campaigns suggest GoDaddy’s fix hasn’t gone far enough, and that scammers likely still have a sizable arsenal of hijacked GoDaddy domains at their disposal. The domains documented by MyOnlineSecurity all had their DNS records altered between Jan. 31 and Feb. Image: Farsight Security.

DNS 246

DNS Ransomware Accountability Internet 246

Security Affairs

FEBRUARY 1, 2019

Security experts at Cybaze – Yoroi ZLab have analyzed a new sample of the AdvisorsBot malware, a downloader that was first spotted in August 2018. As usual, the malware looks like a legitimate e-mail attachment, named as “invoice.doc”. Figure 3 – Piece of VBS script that starts malware infection. DLL Analysis.

Malware 109

Malware DNS Social Engineering Advertising 109

Security Affairs

JANUARY 14, 2021

Malware researchers from ESET uncovered an ongoing surveillance campaign, dubbed Operation Spalax , against Colombian entities exclusively. The operations described by QiAnXin are attributed to an APT group active since at least April 2018. Attackers probably compromised devices to use them as proxies for their C2 servers.

Malware 140

Malware Surveillance Phishing Government 140

Security Affairs

JULY 15, 2020

Security researchers discovered another malware family delivered through tax software that some businesses operating in China are required to install. Security researchers at Trustwave have discovered another malware family delivered through tax software that Chinese banks require companies operating in the country to install.

Software 125

Software Malware Banking Advertising 125

Security Affairs

JANUARY 24, 2019

A still ongoing spam campaign that has been active during the last months has been distributing the Redaman banking malware. Experts at Palo Alto Networks continue to monitor an ongoing spam campaign that has been distributing the Redaman banking malware. “We found over 100 examples of malspam during the last four months of 2018.

Banking 110

Banking Malware Advertising DNS 110

Security Affairs

MARCH 22, 2019

The financially-motivated hacking group FIN7 is back and used a new piece of malware in a recent hacking campaign. Security experts at Flashpoint revealed that the financially-motivated cybercrime group FIN7 (aka Anunak and Carbanak ) used new malware in a recent hacking campaign. ” continues the analysis. Pierluigi Paganini.

Malware 109

Malware Identity Theft Cybercrime Hacking 109

Malwarebytes

DECEMBER 1, 2023

The list includes Amazon (banned in 2018), Google (2018), Microsoft (2022), and Cloudflare (2015). For a “normal” connection to a website, a Domian Name System (DNS) finds the IP address for the requested domain name. They are also known as content distribution networks.

DNS 86

DNS Internet Internet Encryption 86

Krebs on Security

MARCH 2, 2020

A large number of French critical infrastructure firms were hacked as part of an extended malware campaign that appears to have been orchestrated by at least one attacker based in Morocco, KrebsOnSecurity has learned.

DNS 272

DNS Penetration Testing Malware Hacking 272

Security Affairs

JUNE 22, 2021

Experts defined DirtyMoe as a complex malware that has been designed as a modular system. The Windows botnet has been active since late 2017, it was mainly used to mine cryptocurrency, but it was also involved in DDoS attacks in 2018. “Both PurpleFox and DirtyMoe are still active malware and gaining strength.”

DNS 145

DNS Internet Internet Malware 145

Security Affairs

JUNE 27, 2021

Researchers have discovered a strain of cryptocurrency-mining malware, tracked as Crackonosh, that abuses Windows Safe mode to avoid detection. . The researchers started investigating the threat after they became aware that the malware was disabling and uninstalling its antivirus from infected devices. ” continues the report.

Antivirus 144

Antivirus Cryptocurrency Malware Software 144

Krebs on Security

OCTOBER 31, 2023

The top-level domain for the United States — US — is home to thousands of newly-registered domains tied to a malicious link shortening service that facilitates malware and phishing scams, new research suggests. As far back as 2018, Interisle found.US The findings come close on the heels of a report that identified.US

Phishing 294

Phishing Telecommunications Malware Scams 294

Security Affairs

MARCH 17, 2022

Microsoft released an open-source tool to secure MikroTik routers and check for indicators of compromise for Trickbot malware infections. Microsoft has released an open-source tool, dubbed RouterOS Scanner, that can be used to secure MikroTik routers and check for indicators of compromise associated with Trickbot malware infections.

Malware 133

Malware DNS Passwords Ransomware 133

Cisco Security

AUGUST 12, 2021

For several years, Cisco Secure provided DNS visibility and architecture intelligence with Cisco Umbrella and Cisco Umbrella Investigate ; and automated malware analysis and threat intelligence with Cisco Secure Malware Analytics (Threat Grid) , backed by Cisco Talos Intelligence and Cisco SecureX. Malware Analysis.

DNS 145

DNS Firewall Malware Mobile 145

Security Affairs

SEPTEMBER 17, 2018

Palo Alto Network researchers discovered a new malware, tracked as XBash, that combines features from ransomware, cryptocurrency miners, botnets, and worms. Security researchers at Palo Alto Networks have discovered a new piece of malware, dubbed XBash piece that is targeting both Linux and Microsoft Windows servers.

Cryptocurrency 111

Cryptocurrency Malware Ransomware Cybercrime 111

Security Boulevard

JUNE 20, 2024

Passive DNS: The Context of IP Addresses When threat actors target financial institutions using ransomware, they deploy it via multiple IP addresses. (If Passive DNS — automatic, continuous monitoring of potential threats — is (and should be) a feature of complete DNS protection solutions. Download the use cases 1.

Cyber Attacks 69

Cyber Attacks DNS Phishing Cyber threats 69

Security Affairs

OCTOBER 15, 2019

The group has been observed using new tactics, techniques, and procedures (TTPs), it is also using updated malware to evade detection. “the actor moved away from hosting the scripts on dedicated servers and instead started to use Domain Name System (DNS) text records.

Cybercrime 93

Cybercrime DNS Malware Advertising 93

Security Affairs

APRIL 8, 2019

Kaspersky Lab reported that hundreds of users have been targeted with malware over the past month as part of a recent Roaming Mantis campaign. Security experts at Kaspersky Lab reported that hundreds of users have been targeted with malware over the past month as part of a new campaign associated with Roaming Mantis gang.

DNS 110

DNS Mobile Phishing Malware 110

Security Affairs

MAY 2, 2021

Every week the best security articles from Security Affairs free for you in your email box. Every week the best security articles from Security Affairs free for you in your email box.

Password Management 89

Password Management DNS Ransomware Malware 89

Security Affairs

SEPTEMBER 14, 2018

“In August 2018, Unit 42 observed OilRig targeting a government organization using spear-phishing emails to deliver an updated version of a Trojan known as BONDUPDATER. The malware checks that only one instance of it is running at one time, it also locks files to determine how long the main PowerShell process has been executing.

DNS 104

DNS Phishing Government Malware 104

Krebs on Security

FEBRUARY 26, 2023

Web hosting giant GoDaddy made headlines this month when it disclosed that a multi-year breach allowed intruders to steal company source code, siphon customer and employee login credentials, and foist malware on customer websites. But we do know the March 2020 attack was precipitated by a spear-phishing attack against a GoDaddy employee.

Hacking 293

Hacking Social Engineering Phishing Scams 293

Troy Hunt

JULY 12, 2018

— Troy Hunt (@troyhunt) July 5, 2018. For example, check out how it's used when embedded in the TXT record of a DNS entry which is then loaded into a WHOIS service which doesn't properly output encode the results. This is from CVE-2018-12529 and the sample exploit was taken from the SecurityResearch101 blog. DNS Hijacking.

DNS 275

DNS Wireless Risk Banking 275

Hacker Combat

JULY 5, 2021

Further, it also matches the two variants in how the malware executes file encryption and secures command-line disputes. Similar to FiveHands, the new malicious software utilizes a practicable packer and leverages a value key to decodes its malware payload to create a memory. It also uses the command line reversal “-key.”

Ransomware 133

Ransomware DNS Software Encryption 133

Security Affairs

JANUARY 13, 2019

Proofpoint analyzed two strains of malware tracked as ServHelper and FlawedGrace distributed through phishing campaigns by the TA505 crime gang. Security researchers at Proofpoint researchers discovered two strains of malware tracked as ServHelper and FlawedGrace distributed through phishing campaigns by the TA505 crime gang.

Malware 111

Malware Financial Services DNS Retail 111

SecureList

OCTOBER 25, 2023

Introduction It’s just another cryptocurrency miner… Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows. This malware employed a custom EternalBlue SMBv1 exploit to infiltrate its victims’ systems.

Malware 121

Malware DNS Encryption Cryptocurrency 121

Security Affairs

JULY 23, 2019

The attackers demonstrated an increasing level of sophistication across the years, they used custom-malware and various exploits in their attacks. “Second, we identified a previously undocumented malware family with strong links to the Ke3chang group – a backdoor we named Okrum. ” reads the report published by ESET.

DNS 110

DNS Malware Advertising Manufacturing 110

Security Affairs

MARCH 21, 2022

Then the backdoor contacts the command-and-control (C2) server to downloads and executes other malicious payloads, including the TunnelMole, malware that abuses the DNS protocol to establish a tunnel for malicious purposes, and RC2FM and RC2CL. The LoadEdge backdoor maintains persistence through the Windows registry.

Spyware 98

Spyware DNS Phishing Government 98

Cisco Security

AUGUST 11, 2021

We looked at REvil, also known as Sodinokibi or Sodin, earlier in the year in a Threat Trends blog on DNS Security. In it we talked about how REvil/Sodinokibi compromised far more endpoints than Ryuk, but had far less DNS communication. Figure 1-DNS activity surrounding REvil/Sodinokibi. Defense in the real world.

Ransomware 145

Ransomware DNS Encryption Backups 145

Security Affairs

JUNE 18, 2020

The group was first spotted by ESET in 2018, when the experts detected a sophisticated piece of spyware, tracked as InvisiMole, used in targeted attacks in Russia and Ukraine in the previous five years. Experts also observed attackers using a DNS downloader that was designed for long-term, covert access to the target machine.

DNS 124

DNS Advertising Spyware Software 124

Security Affairs

DECEMBER 12, 2019

” The GALLIUM threat actor is active, but its activity was more intense between 2018 and mid-2019. Experts pointed out that GALLIUM threat actors were using common versions of malware and publicly available tools with a few changes to evade detection. link] — bk (Ben K) (@bkMSFT) December 12, 2019.

Telecommunications 97

Telecommunications DNS Malware Advertising 97

Security Affairs

FEBRUARY 23, 2019

A user reported that its D-Link DNS-320 device was infected by malicious code. The D-Link DNS-320 model is no more available for sale, one of the members of the forum explained that the firmware of its NAS was never updated and its device was exposed to WAN through ports 8080, FTP port 21, and a range of ports for port forwarding.

Ransomware 111

Ransomware DNS Firmware Encryption 111

Security Affairs

MARCH 10, 2020

“The threat actors behind this campaign are posting malware embedded inside various hacking tools and cracks for those tools on several websites. “On November 25 2018, the capeturk.com domain expired and was registered by a Vietnamese individual. ” reads the report published Cybereason. ” continues the report.”That

Hacking 145

Hacking Malware Advertising DNS 145

Security Affairs

MAY 2, 2019

Indeed we might observe a File-based command and control (a quite unusual solution) structure, a VBS launcher, a PowerShell Payload and a covert channel over DNS engine. According to Duo, “ OilRig delivered Trojans that use DNS tunneling for command and control in attacks since at least May 2016. It is not a TXT request.

DNS 111

DNS Computers and Electronics Penetration Testing Government 111

Security Affairs

FEBRUARY 8, 2022

Roaming Mantis surfaced in March 2018 when hacked routers in Japan redirecting users to compromised websites. Roaming Mantis is a credential theft and malware campaign that leverages smishing to distribute malicious Android apps in the format of APK files. ” concludes Kaspersky.

Phishing 98

Phishing Malware DNS Hacking 98

Krebs on Security

AUGUST 30, 2019

-based United Rentals [ NYSE:URI ] is the world’s largest equipment rental company, with some 18,000 employees and earnings of approximately $4 billion in 2018. On August 21, multiple United Rental customers reported receiving invoice emails with booby-trapped links that led to a malware download for anyone who clicked.

Phishing 217

Phishing Marketing Accountability DNS 217

Security Affairs

OCTOBER 29, 2020

In early 2019, researchers spotted a new TrickBot backdoor framework dubbed Anchor that was using the anchor_dns tool for abusing the DNS protocol for C2 communications. Ryuk first appeared in the threat landscape in August 2018 as a derivative of the Hermes 2.1

Healthcare 145

Healthcare Ransomware Cybercrime Advertising 145