Security Affairs

JUNE 3, 2022

Threat actors were observed abusing OneDrive, for this reason, the IT giant has suspended more than 20 malicious OneDrive applications created by POLONIUM actors, notified affected organizations, and deployed a series of security intelligence updates that will quarantine malicious tools developed by the attackers.

Security Intelligence 107

Security Intelligence Hacking Antivirus Authentication 107

Security Affairs

JANUARY 19, 2022

We reported our discovery to SolarWinds, and security updates have been released. More info: [link] — Microsoft Security Intelligence (@MsftSecIntel) January 19, 2022. In the past, other threat actors exploited Serv-U vulnerabilities to carry out malicious activities.

Authentication 141

Authentication Hacking Ransomware Security Intelligence 141

Security Affairs

NOVEMBER 22, 2023

The researchers discovered the botnet in October 2023, but they believe it has been active since at least 2022. In October, Akamai’s Security Intelligence Response Team (SIRT) noticed an anomalous activity to the company’s honeypots targeting a rarely used TCP port.

DDOS 136

DDOS Wireless Security Intelligence Malware 136

Security Affairs

MAY 20, 2023

Researchers at Microsoft Security Intelligence team published a series of tweets to warn of a new wave of attacks aimed at distributing the Clop ransomware and linked it to the financially motivated cybercriminal group Sangria Tempest (ELBRUS, FIN7 ). ” reads one of the tweets published by the experts. We are in the final!

Cybercrime 98

Cybercrime Ransomware Security Intelligence Hacking 98

Security Affairs

AUGUST 7, 2023

In October 2022, the Finnish Security Intelligence Service ( Suojelupoliisi or SUPO ) warned of a highly likely intensification of cyberespionage activities conducted by Russia-linked threat actors over the winter. reads the unclassified National Security Overview 2022 published last week by the Finnish agency.

Ransomware 98

Ransomware Government Cyber threats Security Intelligence 98

Security Affairs

NOVEMBER 11, 2022

Get TTPs and protection info: [link] — Microsoft Security Intelligence (@MsftSecIntel) October 14, 2022. From August 2022, Recorded Future researchers observed a rise in command and control (C2) infrastructure used by Sandworm (tracked by Ukraine’s CERT-UA as UAC-0113).

Ransomware 98

Ransomware Telecommunications DNS Hacking 98

Security Affairs

JANUARY 26, 2023

Throughout 2022, both groups targeted sectors included academia, defence, governmental organisations, NGOs, think-tanks, as well as politicians, journalists and activists. SEABORGIUM’s campaigns begin with a reconnaissance activity of target individuals, with a focus on identifying their contacts on social networks or the sphere of influence.

Phishing 98

Phishing Media Hacking Education 98

Security Affairs

AUGUST 28, 2023

The Akamai Security Intelligence Response Team (SIRT) discovered a new version of the KmsdBot botnet that employed an updated Kmsdx binary targeting Internet of Things (IoT) devices. Researchers spotted an updated version of the KmsdBot botnet that is now targeting Internet of Things (IoT) devices.

IoT 98

IoT DDOS Architecture Internet 98

Security Affairs

JANUARY 26, 2022

link] — Kevin Beaumont (@GossiTheDog) January 20, 2022. link] — Microsoft Security Intelligence (@MsftSecIntel) January 11, 2022. to add a shell.

Internet 98

Internet Internet Ransomware Hacking 98

Security Affairs

SEPTEMBER 20, 2022

pic.twitter.com/v6sexKgDSg — Microsoft Security Intelligence (@MsftSecIntel) September 16, 2022. Microsoft researchers are tracking an ongoing wide-ranging click fraud campaign where attackers monetize clicks generated by a browser node-webkit or malicious browser extension secretly installed on devices.

Malware 98

Malware Adware Ransomware Security Intelligence 98

Security Affairs

JULY 28, 2022

Researchers from threat intelligence firm RiskIQ, using passive DNS data related to Knotweed attacks, linked the C2 infrastructure used by the malware since February 2020 to DSIRF. One of the zero-day exploits used in Knotweed attacks was triggering the recently patched CVE-2022-22047 issue. or later to detect the related indicators.

Surveillance 100

Surveillance Malware Authentication Accountability 100

Security Affairs

OCTOBER 16, 2022

Get TTPs and protection info: [link] — Microsoft Security Intelligence (@MsftSecIntel) October 14, 2022. Several notable features differentiate this ransomware from other campaigns and payloads tracked by MSTIC.

Ransomware 105

Ransomware Encryption Backups Security Intelligence 105

Security Affairs

AUGUST 15, 2022

More details + TTPs in this MSTIC blog: [link] — Microsoft Security Intelligence (@MsftSecIntel) August 15, 2022. Microsoft has disrupted activity by SEABORGIUM, a Russia-based actor launching persistent phishing, credential and data theft, intrusions, and hack-and-leak campaigns tied to espionage.

Phishing 102

Phishing Accountability Hacking Surveillance 102