Research reports
1,224 reports from 387 publishers45 added in the past week
62 reports, newest added first
Added Sat 18 Apr
Osiris: An Enhanced Banking Trojan
Following our recent analysis of the Kronos banking Trojan, we discovered that Kronos has also now been enhanced to hide its communication with C&C server using Tor. While the author of Kronos continues to remain an issue of controversy, the new banking…
MalwareVulnerabilities
Added Fri 17 Apr
UPSynergy: Chinese-American Spy vs. Spy Story
Earlier this year, our colleagues at Symantec uncovered an interesting story about the use of Equation group exploitation tools by an alleged Chinese group named Buckeye (a.k.a APT3, or UPS team). One of the key findings in their publication was that variants…
State-sponsoredVulnerabilities
Added Thu 16 Apr
SpeakUp: A New Undetected Backdoor Linux Trojan
Check Point Research has discovered a new campaign exploiting Linux servers to implant a new Backdoor Trojan. Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions. The attack targets worldwide servers including…
MalwareVulnerabilities
Added Wed 15 Apr
Cl0p hacker operating from Russia-Ukraine war front line – exclusive
As the Cl0p ransomware gang continues to sow anxiety worldwide, affecting prominent companies like the BBC and Deutsche Bank, at least one of the gang’s masterminds, Cybernews discovered, is still residing in Ukraine. Deutsche Bank, one of the world’s largest…
RansomwareVulnerabilities
Unraveling EternalBlue: inside the WannaCry’s enabler
WannaCry and NotPetya, probably two most damaging cyberattacks in recent history, were both only made possible because of EternalBlue. Here is how the NSA-developed cyber monster works, and how you should defend against it. What is the EternalBlue…
Vulnerabilities
Added Mon 13 Apr
Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks
* Search for indicators of compromise. * Use antivirus software. * Patch all systems. * Prioritize patching known exploited vulnerabilities. * Train users to recognize and report phishing attempts. * Use multi-factor authentication. Note: this advisory uses…
Vulnerabilities
Added Sat 11 Apr
From bad to worse: Doctor Alliance hacked again by same threat actor (2)
On November 12, DataBreaches reported that Doctor Alliance had allegedly been hacked by a threat actor who listed the data for sale on a clearnet forum. At the time, “Kazu” claimed to have 353 GB of data and had given Doctor Alliance a November 21 deadline to…
Vulnerabilities
The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day
There is a theory which states that if anyone will ever manage to steal and use nation-grade cyber tools, any network would become untrusted, and the world would become a very dangerous place to live in. There is another theory which states that this has…
State-sponsoredVulnerabilities
Added Fri 10 Apr
Mapping and Pivoting from Cobalt Strike C2 Infrastructure Attributed to CVE-2021-40444
Threat Actors Infrastructure (VT Analysis). Pivoting from 45.147.229[.]242 Pivoting from 104.194.10[.]21 Pivoting from 45.153.240[.]220 Short summary and IOC’s. Press enter or click to view image in full size Threat Actors C
Vulnerabilities
Added Thu 9 Apr
Singapore corporations making progress in preventing cyberattacks
It was a back-handed compliment of sorts: experienced hackers telling DataBreaches that it had gotten noticeably harder for them to successfully attack big corporations in Singapore. “The most difficult country to attack now, are Singapore companies,” they…
Vulnerabilities
Added Wed 8 Apr
APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit
With the emergence of the Log4j security vulnerability, we’ve already seen multiple threat actors, mostly financially motivated, immediately add it to their exploitation arsenal. It comes as no surprise that some nation-sponsored actors also saw this new…
State-sponsoredVulnerabilities
Added Tue 7 Apr
EternalBlue – Everything There Is To Know
Since the revelation of the EternalBlue exploit, allegedly developed by the NSA, and the malicious uses that followed with WannaCry, it went under thorough scrutiny by the security community. While many details were researched and published, several remained…
Vulnerabilities
Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities
Magnet Goblin is a financially motivated threat actor that quickly adopts and leverages 1-day vulnerabilities in public-facing services as an initial infection vector. At least in one case of Ivanti Connect Secure VPN (CVE-2024-21887), the exploit entered the…
Vulnerabilities
Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate (GRU)
Operation Copied and Removed Malware Known as “Cyclops Blink” from the Botnet’s Command-And-Control Devices, Disrupting the GRU’s Control Over Thousands of Infected Devices Worldwide. Victims Must Take Additional Steps to Remediate the Vulnerability and…
VulnerabilitiesBotnets and DDoS
Added Mon 6 Apr
Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server. [3] G1030 Agrius Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.[4] G0007 APT28…
State-sponsoredVulnerabilities
Detection of Exploitation of Remote Services, Detection Strategy DET0663
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0663#AN1756
Vulnerabilities
New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)
This blog series expands upon a presentation given at DEF CON 29 on August 7, 2021. Phishing attacks are starting to evolve from the old-school faking of login pages that harvest passwords to attacks that abuse widely-used identity systems such as Microsoft…
VulnerabilitiesPhishing
Added Sun 5 Apr
LockBit 2.0 Ransomware Becomes LockFile Ransomware with a Never-Before-Seen Encryption Method
Threat actors are constantly improving their attack mechanisms to gain an advantage over cybersecurity defenses. Sometimes this involves new malware; other times this means making iterative adjustments to previously successful malware to exploit new…
RansomwareMalwareVulnerabilities
Access Denied
You don't have permission to access "http://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure" on this server. Reference #18.4c85655f.1775392664.125db9d5 Source:…
Vulnerabilities
Added Wed 1 Apr
Operation Poisoned News: Hong Kong Users Targeted with Mobile Malware via Local News Links
By Elliot Cao, Joseph C. Chen, William Gamazo Sanchez, Lilang Wu, and Ecular Xu Contents 1 Attack Chain 1.1 Watering hole attack tactic 1.2 Infection chain 2 Exploits Analyses 2.1 The JavaScriptCore exploit 2.1.1 Bug triggering 2.1.2 The addrof/fakeobj…
MalwareVulnerabilitiesMobile
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.