Kaspersky Security Bulletin 2018. Threat Predictions for 2019

Cryptocurrency threat predictions for 2019 Threat predictions for industrial security in 2019 Cyberthreats to financial institutions 2019: overview and predictions There's nothing more difficult than predicting. So, instead of gazing into a crystal ball, the idea here is to make educated guesses...

A week in security (November 12 – 18)

Last week on Malwarebytes Labs, we found out that TrickBot became a top business threat, so we took a deeper look at what's new with it. With Christmas just around the corner, the Secret Sister scam returned. We also touched on the security and privacy or lack thereof in smart jewelry, air traffi...

tRat Emerges as New Pet for APT Group TA505

A new modular malware written in Delphi dubbed tRat has scurried into the spotlight, after making its debut in large spam campaigns this fall. The remote-access trojan has yet to show all of its cards to researchers, and seems to be in a testing phase, but the fact that well-known APT group TA505...

Recently-Patched Adobe ColdFusion Flaw Exploited By APT

An Adobe ColdFusion vulnerability, patched two months ago, was being exploited in the wild by a China-linked APT group, researchers found. The vulnerability, CVE-2018-15961, is a critical unrestricted file upload bug that could also lead to arbitrary code-execution, researchers at Volexity, who...

Pentagon Draws Back the Veil on APT Malware with Sudden Embrace of VirusTotal

The Pentagon has suddenly started uploading malware samples from APTs and other nation-state sources to the website VirusTotal, which is essentially a malware zoo that’s used by security pros and antivirus/malware detection engines to gain a better understanding of the threat landscape. The Cyber...

Suspected“Group 123” APT groups using the HWP software is not disclosed vulnerabilities in targeted attacks analysis-vulnerability warning-the black bar safety net

Background 2018 9 October 20, 360 Threat Intelligence Center in the Daily sample analysis and tracking process found an example for Korean word processing software Hancom Office design exploits the sample. Through a detailed analysis found that the sample suspected with the APT organization“Group...

StrongPity APT Changes Tactics to Stay Stealthy

The APT group behind the sophisticated malware known as StrongPity a.k.a. Promethium has changed its tactics, after various research groups analyzed the malware and exposed its methods of deployment. The efforts have allowed the group to return to hidden status, even after being labeled a known...

New APT Could Signal Reemergence of Notorious Comment Crew

A recently observed APT campaign, dubbed Operation Oceansalt, could herald the return of the infamous China-linked hacking group known as Comment Crew or APT1. Attacks are cunning and are defined by their their deep targeting and use of an innovative multi-wave attack methodology. Operation...

GreyEnergy Spy APT Mounts Sophisticated Effort Against Critical Infrastructure

A new APT group, dubbed GreyEnergy by researchers, has emerged as a successor to the infamous BlackEnergy APT group, which was behind the electric grid cyberattack and resulting power outage in the Ukraine in December 2015. However, GreyEnergy’s focus and targeting revolve around cyber-espionage...

Tracking Tick Through Recent Campaigns Targeting East Asia

This blog post is authored by Ashlee Benge and Jungsoo An, with contributions from Dazhuo Li. Summary Since 2016, an advanced threat group that Cisco Talos is tracking has carried out cyberattacks against South Korea and Japan. This group is known by several different names: Tick, Redbaldknight a...

GreyEnergy: New malware targeting energy sector with espionage

By Waqas After BlackEnergy, critical infrastructure around the world is among key targets of the new malware called GreyEnergy. In its recent research, ESET has revealed details of a new group of cybercriminals dubbed as GreyEnergy, which seems to be the replacement of BlackEnergy APT group. The...

NotPetya Linked to Industroyer Attack on Ukraine Energy Grid

The massive NotPetya ransomware outbreak that crippled organizations around the world last year turns out to have links to the Industroyer backdoor, which targets industrial control systems ICS and took down the Ukrainian power grid in Kiev in 2016. In fact, the same threat actor – dubbed TeleBot...

Threats in the Netherlands

Introduction On October 4, 2018, the MIVD held a press conference about an intercepted cyberattack on the OPWC in the Netherlands, allegedly by the advanced threat actor Sofacy also known as APT28 or Fancy Bear, among others. According to the MIVD, four suspects were caught red handed trying to...

FruityArmor Apt Exploits Yet Another Windows Graphics Kernel Flaw

A just-patched zero-day vulnerability in win32k.sys – the Windows graphics kernel component – is at the heart of a probable sighting of the FruityArmor APT group – an under-the-radar cyberespionage gang active in the Middle East. A recent campaign uncovered by Kaspersky Lab led researchers to the...

MuddyWater expands operations

Summary MuddyWater is a relatively new APT that surfaced in 2017. It has focused mainly on governmental targets in Iraq and Saudi Arabia, according to past telemetry. However, the group behind MuddyWater has been known to target other countries in the Middle East, Europe and the US. We recently...

Microsoft Patches Zero-Day Under Active Attack by APT

Microsoft has issued a patch for a zero-day bug being actively exploited in the wild, as part of its Patch Tuesday security bulletin. The vulnerability is an elevation-of-privilege flaw, rated important, affecting the Windows Win32k component. The zero-day CVE-2018-8453, found by Kaspersky Lab,...

Slideshow: Intel from Virus Bulletin 2018

This year’s Virus Bulletin 2018, held in Montreal Oct. 3-5, featured a keynote from Microsoft’s John Lambert and a range of threat intelligence research from BAE Systems, Check Point, Cisco Talos, Citizens Lab, Digita Security, ESET, GoSecure, Kaspersky Lab, Malwarebytes, Sophos Security and more...

Virus Bulletin 2018: Turla APT Changes Shape with New Code and Targets

MONTREAL – The Turla APT group’s extensive activities have diversified this year, representing a mix of old code, new code and fresh targets. Perhaps most interesting, this sophisticated group is branching into using scripts and open-source code in its malware development – a marked departure for...

NOKKI Malware Sports Mysterious Link to Reaper APT Group

The Reaper APT group, suspected of being affiliated with North Korea, turns out to have a link to the recently uncovered NOKKI malware family. Palo Alto’s Unit 42 recently observed NOKKI-laden attacks targeted Russian- and Cambodian-speaking individuals with political lures. NOKKI is a backdoor,...

Skype On Debian Microsoft Apt Repo Addition Vulnerability

Skype on Debian automatically installs apt configuration that adds Microsoft's apt repo to the system's package sources. That way, Microsoft or anybody holding their repo's private key can easily inject malicious packages via regular update and replace distro packages w/ their own manipulated one...