Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations

Cyber espionage actors, now designated by FireEye as APT32 OceanLotus Group, are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of...

Google’s lessons in security: bring together security engineering and incident response

Last week during Google Next conference, we have heard an interesting talk where a google security PM, Andy Chang, explained what Google has learned from preventing, detecting and responding to cyber attacks over the years. Not surprisingly, Google is paying a lot of attention to securing the...

Google’s lessons in security: bring together security engineering and incident response

Last week during Google Next conference, we have heard an interesting talk where a google security PM, Andy Chang, explained what Google has learned from preventing, detecting and responding to cyber attacks over the years. Not surprisingly, Google is paying a lot of attention to securing the...

Proofpoint Warns Of New MSIL/Crimson Tied To Cyber Espionage

Diplomats and military personnel in India have been victimized in targeted espionage attacks that use a number of means of infection including phishing and watering hole sites. Researchers at Proofpoint this week published a report on Operation Transparent Tribe, which was ongoing as of Feb. 11...

SlemBunk Part II: Prolonged Attack Chain and Better-Organized Campaign

Introduction Our follow-up investigation of a nasty Android banking malware we identified at the tail end of last year has not only revealed that the trojan is more persistent than we initially realized – thus making for a much more dangerous threat – but that it is also being used as part of an...

Apple iTunes U - Persistent POST Inject Web Vulnerability

Document Title: =============== Apple iTunes U - Persistent POST Inject Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1532 Apple ID: 624515538 Release Date: ============= 2015-08-11 Vulnerability Laboratory ID VL-ID:...

Operation DeathClick APT Malvertising Campaign

Advanced persistent threat groups are using malvertising in order to compromise the networks of their adversaries in what appears to be an example of high-level, nation-state attackers borrowing tactics from the typically less sophisticated cybercriminal arsenals. Attackers are also borrowing fro...

Study: Uyghur Remain in Crosshairs of Targeted Attacks

It’s no secret that activists groups supporting the Uyghur and other ethnic minorities living either in exile or in oppressed nations have been in the crosshairs of targeted attacks for years. Regimes use phishing emails, other social engineering tactics, and drive-by downloads to infect computer...

Terminator RAT became more sophisticated in recent APT attacks

Advanced Persistent Threat APT is a term referring to targeted attacks on enterprises and other organizations and recently referred to what appeared to be nation-state intelligence agencies using cyber assaults for both conventional espionage and industrial espionage. Advanced threats have target...

Malware More Globally Distributed, Still Made in China

In an attempt to better evade detection, cybercriminals are increasingly configuring their command and control infrastructure in such a way that initial malware callbacks communicate with a server located in the same country as the newly infected machines. This emerging trend is among the vast an...

'Magic' Espionage Malware Targets UK Computers

Thousands of U.K. business computers have been infected by espionage malware using a custom protocol to communicate with its command and control servers. Researchers at Israeli security company Seculert added that the malware is still percolating with a number of capabilities yet to be deployed...

Detecting Advanced Persistent Threat with Network Traffic Analysis

A high degree of stealthiness over a prolonged duration of operation in order to do a successful cyber attack can be defined as Advanced Persistent Threat. The attack objectives therefore typically extend beyond immediate financial gain, and compromised systems continue to be of service even afte...

Valid Adobe Certificate Used to Sign Malicious Utilities Common in Targeted Attacks

Adobe announced today it was the victim of an APT-style attack after two malicious utilities commonly used in targeted attacks for privilege escalation and pivoting within a network were discovered signed by a valid Adobe digital certificate. Adobe said it will revoke the certificate next week...

Operation Aurora - Other Zero-Day Attacks targeting finance and Energy

The infamous Aurora Trojan horse is just one of many attacks launched by the same group of malware authors over the past three years, according to researchers at Symantec. Security researchers with Symantec have issued a report outlining the techniques used by the so-called "Edgewood" hacking...

Hijacking Servers Remotely with Hikit advanced persistent threat

Security researchers have revealed the existence of an advanced persistent threat that has been making the rounds since April 2011. Backdoor.Hikit is a dangerous backdoor Trojan that will damage infected system and files. Usually, Backdoor. Hikit will open backdoor to allow remote attackers to...

IXESHE Malware Avoids Easy Detection to Remain a Persistent Threat

Trend Micro today issued a report on an advanced persistent threat that uses stealthy data-stealing malware called IXESHE “i-sushi” to infect machines. So far it’s hit East Asian governments, Taiwanese electronics manufacturers and German telecommunications firms operating across Asia. Though the...

DHS To Critical Infrastructure Owners: Hold On To Data After Cyber Attack

The Department of Homeland Security Is Offering Organizations That Use Industrial Control Systems advice or mitigating the effects of cyber attacks. Among the agency’s recommendations: hold on to data from infected systems and prevent enemies from moving within your organization. DHS’s Industrial...

E-mail Trends Show Hackers Working Weekends Less and Less

While there are an increasing number of weekends catered to hacking, even hackers need a day off – and it shouldn’t surprise many that increasingly, that day is usually Sunday. Network security company FireEye reviewed statistics on email-based attacks for 2012 that suggest that Sunday has slowed...

Advanced Threats Are Not All the APT

By B.K. DeLong We have heard variations on the argument that within the context of information security, the “advanced persistent threat” APT is not really all that advanced or new, that it is being made too big a deal of or FUD and that it is no more than marketing hype though more of an effort...

The Oak Ridge National Laboratory Hacked !

A top United States federal lab was the victim of a "silent" cyberattack earlier this month, news outlets are reporting The Oak Ridge National Laboratory in Tennessee was the victim, according to Nextgov.com. The lab is an energy department laboratory that studies nuclear fusion, supercomputing,...