China APT Gang Targets Hong Kong Media via Dropbox

An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries, has now pointed its focus inward at China’s autonomous territory Hong Kong. An August attack against several media companies in Hong Kong was carried out shortly after a...

China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets

FireEye Threat Intelligence analysts identified a spear phishing campaign carried out in August 2015 targeting Hong Kong-based media organizations. A China-based cyber threat group, which FireEye tracks as an uncategorized advanced persistent threat APT group and other researchers refer to as...

Debian Security Advisory DSA 3398-1 (strongswan - security update)

Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be tricked into successfully concluding the authentication without...

Distributed Password Cracking: CrackLord

Over the past several years the world of password cracking has exploded with new tools and techniques. These new techniques have made it easier than ever to reverse captured password hashes. With the addition of powerful techniques, from GPGPU cracking to rainbow tables, it is easier than ever to...

A new sore point: the APT organization PawnStorm 0Day how to bypass the Java click to play protection-vulnerability warning-the black bar safety net

A few months ago, Trend Micro found out the APT organizations Pawn Storm using before without the disclosure of a Java Vulnerability, CVE-2 0 1 5-2 5 9 0 for attack. After that, we noticed a is used for dyeing and Java click to play click-to-play protection of a separate vulnerability. The second...

Juan Andres Guerrero-Saade on the Dangers of APT Security Research

Juan Andres Guerrero-Saade from Kaspersky Lab’s Global Research & Analysis Team GReAT joins Ryan Naraine on the podcast to discuss the “identity crisis” in the anti-malware industry and the ethics and perils of investigating state-sponsored or geopolitically significant threats. READ The Ethics a...

Emergency Adobe Flash Zero Day Patch Arrives Ahead of Schedule

Adobe has decided to patch the zero day vulnerability that was disclosed in Flash Player earlier this week today — instead of next week as originally scheduled. According to a security bulletin Adobe posted this morning the update actually fixes three vulnerabilities in the software, but the most...

Emergency Adobe Flash Player Security Update

The latest version of Adobe Flash Player, which was made available on Tuesday, will have a short shelf life. Adobe will release an emergency Flash update next week after public attacks were carried out against a zero day vulnerability in the latest version of the software, 19.0.0.207, for Windows...

Outlook Web Access Targeted Attack

Attackers aiming for lateral movement inside an enterprise network have done well in the past to target domain controller credentials. Researchers at Cybereason, however, have uncovered a targeted attack in which hackers were able to burrow onto the corporate network and steal thousands of...

China PLA Unit 78020 Cyberespionage Naikon APT

Chinese president Xi Jinping is supposed to have dinner this evening with U.S. president Barack Obama. Wonder if the name Ge Xing will come up? Ge Xing is the subject of a joint report published this morning by ThreatConnect and Defense Group Inc., computer and national security service providers...

D-Link Private Code-Signing Keys Leaked

A simple mistake by networking gear manufacturer D-Link could have opened the door for costly damage. Private keys used to sign software published by D-Link were found in the company’s open source firmware packages. While it’s unknown whether the keys were used by malicious third parties, the...

Russian Hackers Hijack Satellite To Steal Data from Thousands of Hacked Computers

A group of Russian hackers, most notably the Turla APT Advanced Persistent Threat is hijacking commercial satellites to hide command-and-control operations, a security firm said today. Turla APT group, which was named after its notorious software Epic Turla, is abusing satellite-based Internet...

Turla APT Group Abusing Satellite Internet Links

Poorly secured satellite-based Internet links are being abused by nation-state hackers, most notably by the Turla APT group, to hide command-and-control operations, researchers at Kaspersky Lab said today. Active for close to a decade, Turla’s activities were exposed last year; the Russian-speaki...

Debian Security Advisory DSA 3354-1 (spice - security update)

Frediano Ziglio of Red Hat discovered a race condition flaw in spice OpenVAS Vulnerability Test $Id: deb3354.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3354-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone...

New Versions of Carbanak Banking Malware Seen Hitting Targets in U.S. and Europe

New variants of the notorious Carbanak Trojan have surfaced in Europe and the United States, and researchers say that the malware now has its own proprietary communications protocol and the samples seen so far have been digitally signed. Carbanak has been in use for several years, and researchers...

FBI’s Cyber Task Force Identifies Stealthy FF-RATs used in Cyber Attack

In both April and June this year, a series of cyber attacks was conducted against the United States Office of Personnel Management OPM. These attacks resulted in 21 million current and former Federal government employees’ information being stolen. After months of investigation, the FBI’s Cyber Ta...

Fake EFF Site Used in Spear Phishing Campaign

Attackers, possibly associated with the Russian government, registered a phony Electronic Frontier Foundation domain earlier this month in an attempt to dupe users into thinking correspondence from the site was coming from the well-known privacy watchdog. The scheme, largely carried out via spear...

Darkhotel APT Latest to Use Hacking Team Zero Day

The fallout from the HackingTeam data dump shows no signs of abating. Since the controversial surveillance software maker was hacked and 400 Gb of its data posted online in early July, a handful of zero-day vulnerabilities and exploits were publicly leaked and continue to find their way into the...

Emissary Panda APT Group Gets Selective About Data it Steals

LAS VEGAS – The Emissary Panda APT group has a long history of invading Western organizations—be they enterprises, government or political outfits—hungry for reams of intellectual property. Lately the group, however, has become a little more selective about what it steals. Researchers at Dell...

Researchers Uncover Chinese VPN Service Used by APT Crews for Cover

Building a business can be expensive and time-consuming, and owners will look for ways to save money wherever they can. Researchers from RSA Security have found a VPN provider in China that is taking this to an unusual extreme: hacking Windows servers around the world for use as VPN nodes on a...