Data Wiper Malware Disguised As Ransomware Targets Israeli Entities

Researchers on Tuesday disclosed a new espionage campaign that resorts to destructive data-wiping attacks targeting Israeli entities at least since December 2020 that camouflage the malicious activity as ransomware extortions. Cybersecurity firm SentinelOne attributed the attacks to a nation-stat...

‘Agrius’ APT Launches Wiper Attacks Against Israelis

A new attack group called Agrius is launching damaging wiper attacks against Israeli targets, which researchers said are hiding behind ransomware to make their state-sponsored activities appear financially motivated. Sentinel Labs analysts said they have been tracking Agrius’ operations in Israel...

What’s Coming in 2020: An RSA Recap

VMWare Carbon Black recently published our Outlook 2020 Threat Report largely fueled by the work of our amazing Threat Analysis Unit. Greg Foss @Heinzarelli and Andrew Costis @0x4143 did some in-depth research on Malware samples seen in 2019. As part of RSA, Greg and I had the chance to present o...

VMware Carbon Black Threat Report: One Year Out From the 2020 U.S. Elections, Geopolitical Tension Continues to Spawn Cyberattacks

This morning, VMware Carbon Black released its latest Global Incident Response Threat Report GIRTR. Now in its fourth edition, the GIRTR is written in partnership with VMware Carbon Black's incident response IR partner ecosystem and aggregates input from top IR experts to give you, the reader, a...

RSA Conference 2019: Data-Wiping Cyberattacks Plague Financial Firms

Over a quarter of surveyed financial institutions reported that they were targeted by destructive cyberattacks over the past year, bent on completely destroying data. That’s according to a new Carbon Black report unveiled at RSA this year. The report, “Modern Bank Heists: The Bank Robbery Shifts ...

Modern Bank Heists: The Bank Robbery Shifts to Cyberspace

The financial sector has long been the target of some of the world’s greatest guilds of thieves, none perhaps more popular than the Dillinger gangs of the 1930s. In the second annual “Modern Bank Heists” report, Carbon Black collaborated with Optiv to survey CISOs at some of the world’s largest...

OVERRULED: Containing a Potentially Destructive Adversary

Introduction FireEye assesses APT33 may be behind a series of intrusions and attempted intrusions within the engineering industry. Public reporting indicates this activity may be related to recent destructive attacks. FireEye's Managed Defense has responded to and contained numerous intrusions th...

Shamoon Returns to Wipe Systems in Middle East, Europe

ARCHIVED STORY Shamoon Returns to Wipe Systems in Middle East, Europe By Alexandre Mundo · December 14, 2018 Destructive malware has been employed by adversaries for years. Usually such attacks are carefully targeted and can be motivated by ideology, politics, or even financial aims. Destructive...

Top 5 Threat Hunting Myths: “Threat Hunting Is Too Complicated”

The cybersecurity landscape is in a constant state of change and, as many organizations have learned, it’s no longer a matter of if you’ll face a cyberattack, but when. In today’s world, attackers intentionally look normal to evade automated defenses. With the rise of ransomware, fileless and...

Carbon Black Report: Destructive Cyberattacks Increase Ahead of 2018 Midterm Elections

A trade war with China. A fragile agreement with North Korea. A growing fear of Russian hackers. Ahead of the 2018 U.S. midterm congressional elections, geopolitical conflict continues to play out in cyberspace. According to the world’s top incident response IR professionals, politically motivate...

Creating a Cyber Panic Room to Fight Off Invasions

Genghis Khan was a mastermind. A terrifyingly brilliant military strategist who altered the course of world history. He used fear to paralyze his enemies. “In one apocryphal account circulated to create anxiety among the enemy, the Mongols supposedly promised to retreat from a besieged city if th...

Researchers Find BlackEnergy APT Links in ExPetr Code

Researchers have found links between the BlackEnergy APT group and threat actors behind the ExPetr malware used in last month’s global attacks. According to researchers at Kaspersky Lab, there are strong similarities between older versions of BlackEnergy’s KillDisk ransomware compared to ExPetr...

Operation Blockbuster Ties Destructive Attacks to Lazarus Group

The nation-state sponsored hacker group allegedly behind the 2014 attack against Sony Pictures Entertainment has been linked to similar intrusions against a number of companies in South Korea including the Dark Seoul and Operation Troy attacks. A coalition of security companies called Operation...

Trend Micro Virus Control System 1.8 Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6618/info An information disclosure vulnerability has been reported for TVCS. Reportedly, it is possible for an attacker to access the log files generated by TVCS. The log files contain very sensitive information about th...

Sun ONE Starter Kit 2.0 / ASTAware SearchDisc 3.1 Search Engine Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5828/info A vulnerability has been reported for the Sun ONE Starter Kit 2.0 and ASTAware SearchDisc. The Starter Kit includes a search engine facility provided for easy information retrieval. The search engine included wi...

EZ Systems HTTPBench 1.1 - Information Disclosure

EZ Systems HTTPBench 1.1 - Information Disclosure source: https://www.securityfocus.com/bid/6153/info An information disclosure vulnerability has been reported for httpbench. Reportedly, httpbench may disclose the contents of web server readable files to remote attackers. Information obtained in...