Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

Cisco Talos has identified a new threat actor, which we are naming "YoroTrooper," that has been running several successful espionage campaigns since at least June 2022. YoroTroopers main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of...

Actors, Threats and Vulnerabilities 6 March to 12 March 2023

For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Last week, HiveForce Labs discovered three threat actors. One of them is a Russian group called TA499, which has a history of conducting different cyberattacks such as...

International Law Enforcement Takes Down Infamous NetWire Cross-Platform RAT

A coordinated international law enforcement exercise has taken down the online infrastructure associated with a cross-platform remote access trojan RAT known as NetWire. Coinciding with the seizure of the sales website www.worldwiredlabs.com, a Croatian national who is suspected to be the website...

Tracking the Malicious Email Campaigns of Russia-Aligned TA499

Threat Level Actor Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary TA499 is a group of threat actors aligned with the Russian state that engages in impersonation-based, patriotically motivated misinformation campaigns. They use email ...

Cybercriminals Targeting Law Firms with GootLoader and FakeUpdates Malware

Six different law firms were targeted in January and February 2023 as part of two disparate threat campaigns distributing GootLoader and FakeUpdates aka SocGholish malware strains. GootLoader, active since late 2020, is a first-stage downloader that's capable of delivering a wide range of seconda...

AgentTesla Trojan Returns with Phishing Campaigns Using GuLoader to Steal Secrets

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The AgentTesla Trojan continues to pose a threat as attackers use GuLoader to deliver it in new phishing campaigns targeting various industries and countries...

Malicious code in libpostmcstudy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8c84b94703d515d422e08157646511e76f3f4565a6530eec880bc3a624c3b92f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tpramtoolpong (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ae3e26b44442d54fb2306da89fdbf61bff82609d4d25f7be123ffdbfb71beb2b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfmineinfocraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 732d600cb69429b50b615de1d845866ead365b9c4ce6885d7772393efa6d6812 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in py-libmcstring (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx de2854efc2f89e720b808cb09d4d2705e53eabf65d87127d82c04dbc367e2a18 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfkillguipaypal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9afb3808042774dfc363f3d202fd1a90658b09b5d8664473b18f296e0bd14873 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in py-controltool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 862075b3c0aa0db563e21470d081592dd7e6b547a27a4087c0b872d33122f100 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tphttppipstring (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx da201a73a4d24b34d540674eeb9d1bc2c0bc464ebd8f033382c38603b6980934 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tpvmmc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 03989b74d978e7e13b67d397673e2f92e20e110c4b71c00abd4202f9ef1652ba EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tpultrainfo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 40a4127dc30f5507174a701ce526fdd092b3ee61d141a08b464d98c9616247c1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in libpullcontrol (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9388a3af2165876a3ef868587e3a3efa7a537a00f0536430295134198a2ee398 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in intver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4bbc1e7bf72c44cb311a81d9dd2c91e70a5c64c60b5d8899998d6b93bc8e41d2 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in maskcv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8cdd587e864b9c56c1bcd58122d1095209e8b9eeb607d48c9812f32fcc451c5d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in pipvirtual (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c42ec0e1cac894430929bf7f9df565ffa389272b8469898c1abdf1366dc0e4ff EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

CISA Sounds Alarm on Cybersecurity Threats Amid Russia's Invasion Anniversary

The U.S. Cybersecurity and Infrastructure Security Agency CISA is urging organizations and individuals to increase their cyber vigilance, as Russia's military invasion of Ukraine officially enters one year. "CISA assesses that the United States and European nations may experience disruptive and...