Masque Attack — New iOS Vulnerability Allows Hackers to Replace Apps with Malware

Android have been a long time target for cyber criminals, but now it seems that they have turned their way towards iOS devices. Apple always says that hacking their devices is too difficult for cyber crooks, but a single app has made it possible for anyone to hack an iPhone. A security flaw in...

Russian APT28 Group Linked to NATO, Political Attacks

A Russian APT group tied to ongoing attacks against military and political targets in Eastern Europe and against NATO could also have ties to the MiniDuke espionage campaign uncovered more than a year ago. Dubbed APT28 by FireEye in a report published last night, the Russian hackers have targeted...

Firms Detail Zero Days Targeting Windows Kernel

After they were patched in yesterday’s round of Patch Tuesday security bulletins, security firms have begun to peel back the layers on two zero-day vulnerabilities that are being used in limited, targeted attacks against Microsoft’s Windows Kernel. According to FireEye, one of the firms that...

Microsoft Patches 3 Zero-day Vulnerabilities actively being Exploited in the Wild

As part of monthly patch update, Microsoft released eight security bulletins on Tuesday that address dozens of vulnerabilities including a zero-day flaw reportedly being exploited by Russian hackers to target NATO computers and a pair of zero-day Windows vulnerabilities that attackers have been...

MIRcon 2014 – Day 1 Highlights

The first day of MIRcon 2014 is officially done and was packed with thought-provoking keynotes, presentations and a one-of-a-kind reception. While there's too much to fit into this blog post, I wanted to provide you with some of the highlights: FireEye's COO, Kevin Mandia kicked-off MIRcon and wa...

Chinese Groups Found Targeting Govt, Military Systems

Two Chinese cyber espionage campaigns are working in tandem in hopes of sniffing out trade secrets from surrounding nations. Researchers from FireEye outlined information about the two attack groups yesterday in advance of a more comprehensive report. One of the groups, Moafree, operates out of t...

FireEye Operating System Detection

Binary data fireeyeosversion.nbin...

FireEye Operating System Multiple Vulnerabilities (SB001)

The remote host is running a version of FireEye Operating System FEOS that is affected by multiple vulnerabilities : - An error exists in the function ssl3readbytes function that allows data to be injected into other sessions or allow denial of service attacks. Note that this issue is only...

New Variant of Havex Malware Scans for OPC Servers at SCADA Systems

At the beginning of the month, we have reported about the new surge of a Stuxnet-like malware “Havex”, which was previously targeting organizations in the energy sector, had been used to carry out industrial espionage against a number of companies in Europe and compromised over 1,000 European and...

Havex, It’s Down With OPC

FireEye recently analyzed the capabilities of a variant of Havex referred to by FireEye as “Fertger” or “PEACEPIPE”, the first publicized malware reported to actively scan OPC servers used for controlling SCADA Supervisory Control and Data Acquisition devices in critical infrastructure e.g., wate...

BrutPOS Botnet Compromises insecure RDP Servers at Point-of-Sale Systems

Cyber criminals are infecting thousands of computers around the world with malware and are utilizing those compromised machines to break into Point-of-Sale PoS terminals using brute-force techniques, and the attackers have already compromised 60 PoS terminals by brute-force attacks against...

FireEye Uncovers Android Remote Access Malware

UPDATE: A previous version of this story incorrectly stated that the malware disables any antivirus application. In reality, the malware only uninstalls a particular antivirus application,“com.ahnlab.v3mobileplus,” that is often bundled with certain banking applications. A new remote access tool...

Fake 'Placebo Apps' Booted From Google Play, Amazon

A handful of apps purporting to specialize in virus detection and malware scanning were recently removed from Google’s Play marketplace and Amazon after being deemed fake. Security researchers at FireEye discovered five apps in particular that accounted for up to 50,000 downloads and essentially...

Iranian Ajax Security Team targets US Defense Industry

The Iranian hacking group, which calls itself the “Ajax Security Team”, was quite famous from last few years for websites defacement attacks, and then suddenly they went into dark since past few months. But that doesn't mean that the group was inactive, rather defacing the websites, the group was...

Iranian Hackers Target US Defense Contractors

An Iranian hacking group has moved from politically motivated website defacements to a new specialty – cyberespionage. The group known as the Ajax Security Team has been outed as the perpetrators of a number of espionage operations against U.S.-based defense contractors in addition to targeting...

Broken IE: full version of remote code execution 0day disclosure CVE-2 0 1 4-1 7 7 6-vulnerability warning-the black bar safety net

Microsoft today released a security Bulletin 2 9 6 3 9 8 3, it not only relates to the 6/7/8/9 Edition, also affects the latest IE10/1 1 browser, both the version of the browser is detected a remote code execution vulnerability if a user visited to the particular design through the malicious...

Adobe Flash Player - Regular Expression Heap Overflow (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Adobe Flash Player Regular Expression Heap Overflow", 'Description' = %q This module exploits a vulnerability found in the ActiveX...

Malaysian flight MH370 tragedy abused by Chinese hackers for Espionage attacks

The Mysterious Malaysian Airlines flight MH370, a Boeing 777-200 aircraft that has gone missing by the time it flew from Kuala Lumpur to Beijing. The Malaysian Prime Minister had also confirmed that the Malaysia Airlines plane had crashed in a remote part of the southern Indian Ocean. Cyber...

Malaysia Airlines Flight 370 spear phishing emails spotted

Hold off on the notion that watering hole attacks may supplant phishing as the initial means of compromise in advanced attacks. A number of recent targeted campaigns have used the crash of Malaysia Airlines 370 as a lure to infect government officials in the U.S. and Asia-Pacific. FireEye today...

On the use of Adobe 0day – CVE-2 0 1 4-0 5 0 2 attack behavior analysis-vulnerability warning-the black bar safety net

The other day FireEye released a use AdobeFlash new 0day attack report, and Adobe has been based on vulnerabilities released a security update. According to FireEye report, many sites will redirect visitors to the following contain a Trojan the malicious Server: Peterson Institute for...