Amadey Bot Spotted Deploying LockBit 3.0 Ransomware on Hacked Machines

The Amadey malware is being used to deploy LockBit 3.0 ransomware on compromised systems, researchers have warned. "Amadey bot, the malware that is used to install LockBit, is being distributed through two methods: one using a malicious Word document file, and the other using an executable that...

Medibank Distressed As Ransomware Group Threatens to Post Stolen Data

By Habiba Rashid While some believe the ransomware group threatening Medibank to be a REvil relaunch, others suspect it is BlogXX, a new operation linked to REvil. This is a post from HackRead.com Read the original post: Medibank Distressed As Ransomware Group Threatens to Post Stolen Data...

Ransomware Black Basta uses tools related to FIN7

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Black Basta is deploying a ransomware payload by exploiting Microsoft flaws and using an Endpoint Detection and ResponseEDR defense evasion tool created by FIN7. Black Basta is a relatively new ransomwar...

Medibank Refuses to Pay Ransom After 9.7 Million Customers Exposed in Ransomware Hack

Australian health insurer Medibank today confirmed that personal data belonging to around 9.7 million of its current and former customers were accessed following a ransomware incident. The attack, according to the company, was detected in its IT network on October 12 in a manner that it said was...

TikTok Admits Staff in China Can Access Europeans’ Data

Plus: Liz Truss’ phone-hacking trouble, Cash App’s sex-trafficking problem, and the rising cost of ransomware...

Threat Roundup for October 28 to November 4

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Oct. 28 and Nov. 4. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Your OT Is No Longer Isolated: Act Fast to Protect It

Not too long ago, there was a clear separation between the operational technology OT that drives the physical functions of a company – on the factory floor, for example – and the information technology IT that manages a company's data to enable management and planning. As IT assets became...

Threat Source newsletter (Nov. 3, 2022): Mastodon, evolution, and LiveJournal oh my!

Welcome to this weeks edition of the Threat Source newsletter. Im fascinated by how things live and die on the internet. Things that are ubiquitous to our daily lives are simply gone the next. LiveJournal and Myspace we hardly knew you. Elon Musks purchase of Twitter and the subsequent exodus led...

Researchers Find Links b/w Black Basta Ransomware and FIN7 Hackers

A new analysis of tools put to use by the Black Basta ransomware operation has identified ties between the threat actor and the FIN7 aka Carbanak group. This link "could suggest either that Black Basta and FIN7 maintain a special relationship or that one or more individuals belong to both groups,...

Stopping C2 communications in human-operated ransomware through network protection

Command-and-control C2 servers are an essential part of ransomware, commodity, and nation-state attacks. They are used to control infected devices and perform malicious activities like downloading and launching payloads, controlling botnets, or commanding post-exploitation penetration frameworks ...

Stopping C2 communications in human-operated ransomware through network protection

Command-and-control C2 servers are an essential part of ransomware, commodity, and nation-state attacks. They are used to control infected devices and perform malicious activities like downloading and launching payloads, controlling botnets, or commanding post-exploitation penetration frameworks ...

Hackers Using Rogue Versions of KeePass and SolarWinds Software to Distribute RomCom RAT

The operators of RomCom RAT malware are continuing to evolve their campaigns by distributing rogue versions of software such as SolarWinds Network Performance Monitor, KeePass password manager, and PDF Reader Pro via fake copycat websites. Targets of the operation consist of victims in Ukraine an...

Australian Defence Force Communications Service Hit by Ransomware Attack

By Deeba Ahmed According to Matt Thistlethwaite, assistant minister for defense, there is no evidence to believe that data belonging to serving and retired military personnel have been compromised. This is a post from HackRead.com Read the original post: Australian Defence Force Communications...

APT trends report Q3 2022

For more than five years, the Global Research and Analysis Team GReAT at Kaspersky has been publishing quarterly summaries of advanced persistent threat APT activity. These summaries are based on our threat intelligence research; and they provide a representative snapshot of what we have publishe...

Raspberry Robin worm used as ransomware prelude

Raspberry Robin aka Worm.RaspberyRobin started out as an annoying, yet relatively low-profile threat that was often installed via USB drive. First spotted in September 2021, it was typically introduced into a network through infected removable drives, often USB devices. Now the worm has been foun...

Researcher Spotlight: How Azim Khodjibaev went from hunting real-world threats to threats on the dark web

A case study in why cybersecurity experience is not a prerequisite to work in security Azim Khodjibaev knows all sides of the "security" industry. That doesnt just cover cybersecurity, either -- he spent the first part of his career ensuring the physical safety of civilians and military personnel...

Unofficial Patch Released for New Actively Exploited Windows MotW Vulnerability

An unofficial patch has been made available for an actively exploited security flaw in Microsoft Windows that makes it possible for files signed with malformed signatures to sneak past Mark-of-the-Web MotW protections. The fix, released by 0patch, arrives weeks after HP Wolf Security disclosed a...

A week in security (October 24 - 30)

Last week on Malwarebytes Labs: Lock and Code: A gym heist in London goes cyber Healthcare site leaks personal health information via Google and Meta tracking pixels An odd kind of cybercrime: Gift vouchers, medical records, and...food Cisco warns of ISE vulnerability with no fixed release or...

LV Ransomware Exploited ProxyShell to target Jordan

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary LV ransomware as a service has been active since late 2020 The most recent infiltration entailed the compromise of the corporate environment of a Jordan based entity, leveraging the double extortion...

Threat Roundup for October 21 to October 28

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Oct. 21 and Oct. 28. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...