Hackers for Hire: Adversaries Employ ‘Cyber Mercenaries’

A for-hire cybercriminal group is feeling the talent-drought in tech just like the rest of the sector and has resorted to recruiting so-called “cyber-mercenaries” to carry out specific illicit hacks that are part of larger criminal campaigns. Dubbed Atlas Intelligence Group A.I.G., the cybergang...

DDoS App Meant to Hit Russia Infected Android Phones of Ukrainian Activists

By Deeba Ahmed The pro-Ukraine groups thought they were fighting back against Russia with a new DDoS app, but it turns… This is a post from HackRead.com Read the original post: DDoS App Meant to Hit Russia Infected Android Phones of Ukrainian Activists...

Russia Creates Malware False-Flag App

The Russian hacking group Turla released an Android app that seems to aid Ukrainian hackers in their attacks against Russian networks. Its actually malware, and provides information back to the Russians: The hackers pretended to be a "community of free people around the world who are fighting...

Russian Hackers Tricked Ukrainians with Fake "DoS Android Apps to Target Russia" — The Hacker News

Russian threat actors capitalized on the ongoing conflict against Ukraine to distribute Android malware camouflaged as an app for pro-Ukrainian hacktivists to launch distributed denial-of-service DDoS attacks against Russian sites. Google Threat Analysis Group TAG attributed the malware to Turla,...

Tiny Mantis Botnet Can Launch More Powerful DDoS Attacks Than Mirai

By Waqas Mantis Botnet launched 3,000 DDoS attacks in one month using only 5,000 small bots after which Cloudflare dubbed… This is a post from HackRead.com Read the original post: Tiny Mantis Botnet Can Launch More Powerful DDoS Attacks Than Mirai...

Why 8kun Went Offline During the January 6 Hearings

The latest Jan. 6 committee hearing on Tuesday examined the role of conspiracy theory communities like 8kun.top and TheDonald.win in helping to organize and galvanize supporters who responded to former President Trumps invitation to "be wild" in Washington, D.C. on that chaotic day. At the same...

Mantis Botnet Behind the Largest HTTPS DDoS Attack Targeting Cloudflare Customers

The botnet behind the largest HTTPS distributed denial-of-service DDoS attack in June 2022 has been linked to a spate of attacks aimed at nearly 1,000 Cloudflare customers. Calling the powerful botnet Mantis, the web performance and security company attributed it to more than 3,000 HTTP DDoS...

Endpoint security for Mac: 3 best practices

If you’re one of the 50% of small and medium-sized businesses SMBs that use Mac .devices today, chances are your IT and security teams have a ton of Mac endpoints to monitor. Securing that many endpoints can get really complex, really fast, especially when you consider that the common wisdom that...

Valinor error messages leading to potential data exfiltration before v0.12.0

php registerConstructorMoney::class, 'fromString' -mapper; try vardump$mapper-mapFoo::class, 'a' = 'HAHA', 'b' = '100 EUR', 'c' = 'USD 100' ; catch MappingError $e $messages = new NodeTraverserfunction Node $node foreach $node-messages as $message vardump '$message', $message-path, $message-body ...

GHSA-5PGM-3J3G-2RC7 Valinor error messages leading to potential data exfiltration before v0.12.0

php registerConstructorMoney::class, 'fromString' -mapper; try vardump$mapper-mapFoo::class, 'a' = 'HAHA', 'b' = '100 EUR', 'c' = 'USD 100' ; catch MappingError $e $messages = new NodeTraverserfunction Node $node foreach $node-messages as $message vardump '$message', $message-path, $message-body ...

CVE-2014-3648

The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached...

Design/Logic Flaw

The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached...

CVE-2014-3648

The CVE-2014-3648 issue concerns the simplepush server, where notifications are pushed for each registered installation using a deviceToken supplied by the user. The vulnerability arises because a bogus application can register with bad deviceTokens or point to arbitrary HTTP endpoints. This can ...

CVE-2014-3648

The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached...

Pro-Russia Killnet Group Hit Top Lithuanian websites with Massive DDoS Attacks

By Deeba Ahmed The attack seems to be a retaliatory effort from Killnet following the diplomatic tensions between the two countries.… This is a post from HackRead.com Read the original post: Pro-Russia Killnet Group Hit Top Lithuanian websites with Massive DDoS Attacks...

‘Killnet’ Adversary Pummels Lithuania with DDoS Attacks Over Blockade

Russia-linked cyber collective Killnet has claimed responsibility for DDoS attacks Monday on the Lithuanian government and other entities in the Baltic country over closure of transit routes within the Russian exclave of Kaliningrad, according to researchers. The threat group warns that it will...

A week in security (June 20 – June 26)

Last week on Malwarebytes Labs: LinkedIn scams are a "significant threat", warns FBI DDoS-for-hire service provider jailed Internet Safety Month: 7 tips for staying safe online while on vacation Client-side Magecart attacks still around, but more covert Security vulnerabilities: 5 times that...

The Relentless Evolution of DDoS Attacks

Explore how DDoS attacks are practically unrecognizable from those of the past few years thanks to constant innovation in the threat landscape...

President Putin’s Economic Forum Speech Delayed due to DDoS Attack

By Deeba Ahmed The Russian Economic Forum was taking place in St. Petersburg when its proceedings were stalled due to a… This is a post from HackRead.com Read the original post: President Putin’s Economic Forum Speech Delayed due to DDoS Attack...

DDoS-for-hire service provider jailed

Matthew Gatrel, a 33-year-old man from St. Charles, Illinois, has been sentenced to two years in prison for running websites that provide powerful distributed denial-of-service DDoS attacks against internet users and websites. This sentencing resulted in the seizure of his websites, making the...