Research reports

DataBreaches.net · Web page · Published 31 Aug

One month later, Ranhill still hasn't fully recovered from cyberattack

On July 26, DataBreaches reported that DESORDEN had attacked Ranhill Utilities Berhad, a provider of water and power supply in Malaysia. At the time, DESORDEN claimed, in part: The initial data breach was initiated on Nov 2021. For over 18 months, DESORDEN…

DataBreaches.net · Web page · Published 1 Oct

Another Malaysia carrier allegedly hacked and data exfiltrated -- Skynet

Desorden Group, who recently claimed to have successfully breached ABX Express, has contacted DataBreaches.net to report yet another logistics firm breach. This time, the claimed victim is Skynet.com.my. Skynet is a carrier company in Malaysia that provides…

DataBreaches.net · Web page · Published 13 Sep

Singapore corporations making progress in preventing cyberattacks

It was a back-handed compliment of sorts: experienced hackers telling DataBreaches that it had gotten noticeably harder for them to successfully attack big corporations in Singapore. “The most difficult country to attack now, are Singapore companies,” they…

DataBreaches.net · Web page · Published 25 Aug

Major Indonesia tollroad operator hacked by DESORDEN (Updated)

On August 23, DESORDEN alerted DataBreaches to another one of their attacks. This one involved the PT JASAMARGA TOLLROAD OPERATOR, Indonesia’s largest major tollway and highway operator. According to DESORDEN’s statement: This data breach involved 252 GB of…

DataBreaches.net · Web page · Published 10 Mar

Bits 'n Pieces (Trozos y Piezas)

DataBreaches recently reported a malware attack on Chile’s National Health Fund (FONASA). There is an update to report: In a chat on Tox, BlackCat confirmed to DataBreaches that they are responsible for the attack and they say that they will announce it soon…

Check Point · Web page · Published 15 Jul

MuddyWater Threat Group Deploys New BugSleep Backdoor

Check Point Research (CPR) warns that Iranian threat group MuddyWater has significantly increased its activities against Israel and is deploying a new, previously undocumented backdoor campaign. Key Findings MuddyWater, an Iranian threat group affiliated with…

Check Point · Web page · Published 26 Nov

Bandook: Signed & Delivered

Check Point Research recently observed a new wave of campaigns against various targets worldwide that utilizes a strain of a 13-year old backdoor Trojan named Bandook. Bandook, which had almost disappeared from the threat landscape, was featured in 2015 and…

Check Point · Web page · Published 12 Jun

Deep Dive into UPAS Kit vs. Kronos

In this post we will be analyzing the UPAS Kit and the Kronos banking Trojan, two malwares that have come under the spotlight recently due to the back story behind them. Background In May 2017, WannaCry wreaked havoc in over 150 countries and brought down…

Check Point · Web page · Published 11 Jan

APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit

With the emergence of the Log4j security vulnerability, we’ve already seen multiple threat actors, mostly financially motivated, immediately add it to their exploitation arsenal. It comes as no surprise that some nation-sponsored actors also saw this new…

Check Point · Web page · Published 4 Sep

Hacktivists Call for Release of Telegram Founder with #FreeDurov DDoS Campaign

In recent weeks, a new hacktivist campaign has emerged to demand the release of Telegram CEO Pavel Durov, after his arrest by French authorities. In this report, Check Point Research explores the most prominent and dominant hacking groups involved in the…

Check Point · Web page · Published 31 Oct

From Albania to the Middle East: The Scarred Manticore is Listening

Check Point Research (CPR) is monitoring an ongoing Iranian espionage campaign by Scarred Manticore, an actor affiliated with the Ministry of Intelligence and Security (MOIS). The attacks rely on LIONTAIL, an advanced passive malware framework installed on…

Check Point · Web page · Published 29 Sep

EternalBlue – Everything There Is To Know

Since the revelation of the EternalBlue exploit, allegedly developed by the NSA, and the malicious uses that followed with WannaCry, it went under thorough scrutiny by the security community. While many details were researched and published, several remained…

Check Point · Web page · Published 31 Mar

State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage

Geopolitical tensions often make headlines and present a golden opportunity for threat actors to exploit the situation, especially those targeting high-profile victims. In the past month while the Russian invasion of Ukraine was unfolding, Check Point…

Check Point · Web page · Published 15 Nov

Uncovering MosesStaff techniques: Ideology over Money

In September 2021, the hacker group MosesStaff began targeting Israeli organizations, joining a wave of attacks which was started about a year ago by the Pay2Key and BlackShadow attack groups. Those actors operated mainly for political reasons in attempt to…

Check Point · Web page · Published 5 Jan

BlindEagle Targeting Ecuador With Sharpened Tools

APT-C-36, also known as Blind Eagle, is a financially motivated threat group that has been launching indiscriminate attacks against citizens of various countries in South America since at least 2018. In a recent campaign targeting Ecuador based organizations,…

csirt-cti.net · Web page · Added 7 Apr

Access Denied

endurant.io · Web page · Added 7 Apr

detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon

Check Point · Web page · Published 25 Apr

Educated Manticore – Iran Aligned Threat Actor Targeting Israel via Improved Arsenal of Tools

In this report we reveal new findings related to Educated Manticore, an activity cluster with strong overlap with Phosphorus, an Iranian-aligned threat actor operating in the Middle East and North America. Like many other actors, Educated Manticore has…

Microsoft · Web page · Added 7 Apr

404 ~ Not found

1. MSRC 2. Customer Guidance 3. Security Update Guide 4. Not found The page you were looking for was either not found or not available! Source: https://portal.msrc.microsoft.com/security-guidance/advisory/ADV170021

Check Point · Web page · Published 8 Mar

Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities

Magnet Goblin is a financially motivated threat actor that quickly adopts and leverages 1-day vulnerabilities in public-facing services as an initial infection vector. At least in one case of Ivanti Connect Secure VPN (CVE-2024-21887), the exploit entered the…