Bulk Surveillance of Money Transfers

Just another obscure warrantless surveillance program. US law enforcement can access details of money transfers without a warrant through an obscure surveillance program the Arizona attorney generals office created in 2014. A database stored at a nonprofit, the Transaction Record Analysis Center...

Wiz integrates with Amazon Security Lake to improve cloud security through cloud security data sharing

New integration enables customers to consolidate security logs, run investigations and analyze security metrics in their customer-owned data lake...

Malicious code in @nexthink/investigations-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fb466910cbd8f11eb9f83c1157f4f40e12cf74ff131ebec73f92b3ae0f962ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nexthink/investigations-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96c7504109a0c5da8a958e741bf417d560564dc1a8270fb730254ff31f5f79bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nexthink/investigations-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3baf88ee77a0ebf1861662b0d04227b4f9822c410f2ea95af73ae34283e0c442 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-468 Malicious code in @nexthink/investigations-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fb466910cbd8f11eb9f83c1157f4f40e12cf74ff131ebec73f92b3ae0f962ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-467 Malicious code in @nexthink/investigations-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96c7504109a0c5da8a958e741bf417d560564dc1a8270fb730254ff31f5f79bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Defenders beware: A case for post-ransomware investigations

Ransomware is one of the most pervasive threats that Microsoft Detection and Response Team DART responds to today. The groups behind these attacks continue to add sophistication to their tactics, techniques, and procedures TTPs as most network security postures increase. In this blog, we detail a...

Disrupting SEABORGIUM’s ongoing phishing operations

The Microsoft Threat Intelligence Center MSTIC has observed and taken actions to disrupt campaigns launched by SEABORGIUM, an actor Microsoft has tracked since 2017. SEABORGIUM is a threat actor that originates from Russia, with objectives and victimology that align closely with Russian state...

Have we lost the fight for data privacy? Lock and Code S03E16

At the end of 2021, Lock and Code invited the folks behind our news-driven cybersecurity and online privacy blog, Malwarebytes Labs, to discuss what upset them most about cybersecurity in the year prior. Today, we're bringing those same guests back to discuss the other, biggest topic in this spac...

Police seize and dismantle massive phishing operation

Europol has coordinated a joint operation to arrest members of a cybercrime gang and effectively dismantle their campaigns that netted million in Euros. This operation also led the Belgian Police Police Fédérale/Federale Politie and the Dutch Police Politie to nine arrests, 24 house searches, and...

Malicious code in teamcity-investigations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f120609e46c606732ac469f2d950a5ae4f0e5221531aedcabdebf95e22d02831 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6437 Malicious code in teamcity-investigations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f120609e46c606732ac469f2d950a5ae4f0e5221531aedcabdebf95e22d02831 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Get to Know Steve Povolny

Meet Steve Povolny Head of Advanced Threat Research for Trellix Threat Labs By Michael Alicea · May 17, 2022 At Trellix, we celebrate and champion our people. This week, I sat down with Steve Povolny, Head of Advanced Threat Research for Trellix Threat Labs. As he is one of the leading...

Get To Know John Fokker

Meet John Fokker Head of Cyber Investigations for Trellix Threat Labs By Trellix · April 28, 2022 This blog was written by Michael Alicea At Trellix, we celebrate and champion our people. This week, I sat down with John Fokker, Head of Cyber Investigations for Trellix Threat Labs and one of the...

Get To Know John Fokker

Meet John Fokker Head of Cyber Investigations for Trellix Threat Labs By Michael Alicea · April 28, 2022 At Trellix, we celebrate and champion our people. This week, I sat down with John Fokker, Head of Cyber Investigations for Trellix Threat Labs and one of the leading cybersecurity experts in t...

Authorities Fully Behead Hydra Dark Marketplace

German authorities have taken down the Hydra marketplace – a popular destination on the Dark Web for trading in illicit goods and services, including cyberattack tools and stolen data. This week, they were able to commandeer and take offline underpinning infrastructure such as servers, plus insta...

Conti Leaks: Examining the Panama Papers of Ransomware | Trellix

Conti Leaks: Examining the Panama Papers of Ransomware By John Fokker, Jambul Tologonov · March 31, 2022 Introduction It isn’t often the whole world gets an inside look of the business operations of a top tier cybercriminal group. Very early on in the Russian-Ukrainian Crisis the predominantly...

Signal CEO Resigns, WhatsApp Co-Founder Takes Over as Interim CEO

Moxie Marlinspike, the founder of the popular encrypted instant messaging service Signal, has announced that he is stepping down as the chief executive of the non-profit in a move that has been underway over the last few months. "In other words, after a decade or more, it's difficult to overstate...

ScarCruft surveilling North Korean defectors and human rights activists

The ScarCruft group also known as APT37 or Temp.Reaper is a nation-state sponsored APT actor we first reported in 2016. ScarCruft is known to target North Korean defectors, journalists who cover North Korea-related news and government organizations related to the Korean Peninsula, between others...