2434 matches found
Cobalt Strike Usage Explodes Among Cybercrooks
The use of Cobalt Strike – the legitimate, commercially available tool used by network penetration testers – by cybercrooks has shot through the roof, according to Proofpoint researchers, who say that the tool has now “gone fully mainstream in the crimeware world.” The researchers have tracked a...
Behind the scenes with the head of Kaspersky’s GReAT
Costin Raiu has been with Kaspersky since 2000, initially as the Chief Security Expert overseeing research efforts in the EEMEA region. In 2010, he became Director of our Global Research and Analysis Team GReAT. During his tenure at Kaspersky, he has spearheaded the companys research on some of t...
Unauthorized Access Vulnerability in Mingguo APT Attack (Cyber Warfare) Warning Platform
Hangzhou ACE Information Technology Co., Ltd. is a company that has been focusing on the research, development, production and sales of products in the field of network information security, such as Fortress, Remote Monitoring, Cloud Saas Service, Cloud WAF, Industrial Control, Online Remote Offi...
Unauthorized Access Vulnerability in Mingguo APT Attack (Cyber Warfare) Warning Platform (CNVD-2021-47701)
Hangzhou ACE Information Technology Co., Ltd. is a company that has been focusing on the research, development, production and sales of products in the field of network information security, such as Fortress, Remote Monitoring, Cloud Saas Service, Cloud WAF, Industrial Control, Online Remote Offi...
Unauthorized Access Vulnerability in Mingguo APT Attack (Cyber Warfare) Warning Platform (CNVD-2021-47700)
Hangzhou ACE Information Technology Co., Ltd. is a company that has been focusing on the research, development, production and sales of products in the field of network information security, such as Fortress, Remote Monitoring, Cloud Saas Service, Cloud WAF, Industrial Control, Online Remote Offi...
Logic Flaw Vulnerability in Mingguo APT Attack (Cyber Warfare) Warning Platform
Hangzhou ACE Information Technology Co., Ltd. is a company that has been focusing on the research, development, production and sales of products in the field of network information security, such as Fortress, Remote Monitoring, Cloud Saas Service, Cloud WAF, Industrial Control, Online Remote Offi...
Security Bulletin: NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, Jetson TX1, Jetson TX2 Series (including Jetson TX2 NX), and Jetson Nano (including Jetson Nano 2GB) - June 2021
NVIDIA has released a software update for NVIDIA® Jetson AGX Xavier™ series, Jetson Xavier™ NX, Jetson™ TX1, Jetson TX2 series including Jetson TX2 NX, and Jetson Nano™ devices including Jetson Nano 2GB in the NVIDIA JetPack™ SDK. This update addresses security issues that may lead to escalation ...
A New Spyware is Targeting Telegram and Psiphon VPN Users in Iran
Threat actors with suspected ties to Iran have been found to leverage instant messaging and VPN apps like Telegram and Psiphon to install a Windows remote access trojan RAT capable of stealing sensitive information from targets' devices since at least 2015. Russian cybersecurity firm Kaspersky,...
NoxPlayer Supply-Chain Attack is Likely the Work of Gelsemium Hackers
A new cyber espionage group named Gelsemium has been linked to a supply chain attack targeting the NoxPlayer Android emulator that was disclosed earlier this year. The findings come from a systematic analysis of multiple campaigns undertaken by the APT crew, with evidence of the earliest attack...
CVE-2021-32556
It was discovered that the getmodifiedconffiles function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg1 call...
Design/Logic Flaw
It was discovered that the getmodifiedconffiles function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg1 call...
CVE-2021-32556
It was discovered that the getmodifiedconffiles function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg1 call...
CVE-2021-32556 apport get_modified_conffiles() function command injection
It was discovered that the getmodifiedconffiles function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg1 call...
CVE-2021-32556: Improper Neutralization of Special Elements used in an OS Command
It was discovered that the getmodifiedconffiles function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg1 call...
Novel ‘Victory’ Backdoor Spotted in Chinese APT Campaign
An ongoing surveillance operation has been uncovered that targets a Southeast Asian government, researchers said – using a previously unknown espionage malware. According to Check Point Research, the attack involves spear-phishing emails with malicious Word documents to gain initial access, along...
A week in security (May 31 – June 6)
Last week on Malwarebytes Labs, we looked at an interesting trend in facial recognition technology—hint: its a slow fade, the latest ransomware attacks on JBS and Steamship Authority, Cobalt Strike, a Coronavirus phishing campaign, WhatsApp’s decision to not limit app functionalities for...
Experts Uncover Yet Another Chinese Spying Campaign Aimed at Southeast Asia
An ongoing cyber-espionage operation with suspected ties to China has been found targeting a Southeast Asian government to deploy spyware on Windows systems while staying under the radar for more than three years. "In this campaign, the attackers utilized the set of Microsoft Office exploits and...
Researchers Uncover Hacking Operations Targeting Government Entities in South Korea
A North Korean threat actor active since 2012 has been behind a new espionage campaign targeting high-profile government officials associated with its southern counterpart to install an Android and Windows backdoor for collecting sensitive information. Cybersecurity firm Malwarebytes attributed t...
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
This blog post was authored by Hossein Jazi. The Kimsuky APT—also known as Thallium, Black Banshee, and Velvet Chollima—is a North Korean threat actor that has been active since 2012. The group conducts cyber espionage operations to target government entities mainly in South Korea. On December...
IT threat evolution Q1 2021
Targeted attacks Putting the A into APT In December, SolarWinds, a well-known IT managed services provider, fell victim to a sophisticated supply-chain attack. The companys Orion IT, a solution for monitoring and managing customers IT infrastructure, was compromised by threat actors. This resulte...