1141 matches found
North Korean Hackers Target Energy and Aerospace Industries with New MISTPEN Malware
A North Korea-linked cyber-espionage group has been observed leveraging job-themed phishing lures to target prospective victims in energy and aerospace verticals and infect them with a previously undocumented backdoor dubbed MISTPEN. The activity cluster is being tracked by Google-owned Mandiant...
Python Developers Targeted with Malware During Fake Job Interviews
Interesting social engineering attack: luring potential job applicants with fake recruiting pitches, trying to convince them to download malware. From a news article These particular attacks from North Korean state-funded hacking team Lazarus Group are new, but the overall malware campaign agains...
North Korean Hackers Target Cryptocurrency Users on LinkedIn with RustDoor Malware
Cybersecurity researchers are continuing to warn about North Korean threat actors' attempts to target prospective victims on LinkedIn to deliver malware called RustDoor. The latest advisory comes from Jamf Threat Labs, which said it spotted an attack attempt in which a user was contacted on the...
VulnCheck KEV: CVE-2023-45727
North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity XXE reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack...
Developers Beware: Lazarus Group Uses Fake Coding Tests to Spread Malware
Cybersecurity researchers have uncovered a new set of malicious Python packages that target software developers under the guise of coding assessments. "The new samples were tracked to GitHub projects that have been linked to previous, targeted attacks in which developers are lured using fake job...
Man Faces 20 Years in Prison for First-Ever AI Music Streaming Scam
A North Carolina man has been arrested in the first criminal case involving AI-generated music streaming fraud. Accused…...
New Chrome Zero-Day
According to Microsoft researchers, North Korean hackers have been using a Chrome zero-day exploit to steal cryptocurrency...
Lazarus Group Targets Blockchain Pros with Fake Video Conferencing, Job Scam
A new Group-IB report highlights an ongoing campaign by the North Korean Lazarus Group, known as the “Eager…...
Malicious code in ethersscan-api (npm)
The package contains the BeaverTail infostealer malware associated with DPRK threat actors. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bdf32a4e45ba09760610d3f87cf8cfdae4d386a4ee4df99f1973ab577373620 Any computer that has this package installed or running shoul...
Malicious code in eslint-module-conf (npm)
The package contains the BeaverTail infostealer malware associate with DPRK threat actors. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57ba9b08d4ba893169691f9b674d05dc209e43e0932a266fbac6479a5e1dc398 Any computer that has this package installed or running should...
Malicious code in eslint-scope-util (npm)
The package contains the BeaverTail infostealer malware associated with DPRK threat actors. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c97eb42ab9ab02fd3a0e93acf449bb0fc75b1af462f6221cfca5d3b14588a0fb Any computer that has this package installed or running shoul...
North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Scams
Threat actors affiliated with North Korea have been observed leveraging LinkedIn as a way to target developers as part of a fake job recruiting operation. These attacks employ coding tests as a common initial infection vector, Google-owned Mandiant said in a new report about threats faced by the...
MAL-2024-8842 Malicious code in call-blockflow (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
MAL-2024-8843 Malicious code in harthat-api (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
Malicious code in call-blockflow (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
Malicious code in harthat-api (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
MAL-2024-8844 Malicious code in harthat-hash (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
North Korean Hackers Targets Job Seekers with Fake FreeConference App
North Korean threat actors have leveraged a fake Windows video conferencing application impersonating FreeConference.com to backdoor developer systems as part of an ongoing financially-driven campaign dubbed Contagious Interview. The new attack wave, spotted by Singaporean company Group-IB in...
INE Security Announces 5 Practical Steps to Elevate Cyber Defense Strategies
Cary, North Carolina, 4th September 2024, CyberNewsWire...
North Korean Hackers Deploy FudModule Rootkit via Chrome Zero-Day Exploit
A recently patched security flaw in Google Chrome and other Chromium web browsers was exploited as a zero-day by North Korean actors in a campaign designed to deliver the FudModule rootkit. The development is indicative of the persistent efforts made by the nation-state adversary, which has made ...