IT threat evolution Q1 2019

Targeted attacks and malware campaigns Go Zebrocy Zebrocy was first observed being used as a Sofacy backdoor in 2015. However, the collection of cases where this tool has been used mean that we consider it a subset of activity in its own right. On the basis of this threat actor's past behaviour, ...

Sophisticated 'TajMahal APT Framework' Remained Undetected for 5 Years

Cybersecurity researchers yesterday unveiled the existence of a highly sophisticated spyware framework that has been in operation for at least last 5 years—but remained undetected until recently. DubbedTajMahal by researchers at Kaspersky Lab, the APT framework is a high-tech modular-based malwar...

Project TajMahal – a sophisticated new APT framework

Executive summary 'TajMahal' is a previously unknown and technically sophisticated APT framework discovered by Kaspersky Lab in the autumn of 2018. This full-blown spying framework consists of two packages named 'Tokyo' and 'Yokohama'. It includes backdoors, loaders, orchestrators, C2...

Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities

Executive Summary Throughout the autumn of 2018 we analyzed a long-standing and still active at that time cyber-espionage campaign that was primarily targeting foreign diplomatic entities based in Iran. The attackers were using an improved version of Remexi in what the victimology suggests might ...

Hacking Diplomatic Cables Is Expected. Exposing Them Is Not

Spies try to access government communications all the time. But an incident this week tested the limits of what happens when those compromises get discovered...

Octopus-infested seas of Central Asia

For the last two years we have been monitoring a Russian-language cyberespionage actor that focuses on Central Asian users and diplomatic entities. We named the actor DustSquad and have provided private intelligence reports to our customers on four of their campaigns involving custom Android and...

Sanny Malware Updates Delivery Method

The group behind Sanny malware attacks has made significant changes to the way it delivers their payload. According to new research by FireEye, the attackers have upgraded their delivery techniques when it comes to planting malware on systems via document attachments sent as part of spam and...

SANNY Malware Delivery Method Updated in Recently Observed Attacks

Introduction In the third week of March 2018, through FireEye’s Dynamic Threat Intelligence, FireEye discovered malicious macro-based Microsoft Word documents distributing SANNY malware to multiple governments worldwide. Each malicious document lure was crafted in regard to relevant regional...

Newly Uncovered 'SowBug' Cyber-Espionage Group Stealing Diplomatic Secrets Since 2015

A previously unknown hacking and cyber-espionage group that has been in operation since at least 2015 have conducted a series of highly targeted attacks against a host of government organizations in South America and Southeast Asia to steal their sensitive data. Codenamed Sowbug, the hacking grou...

Data Stealing Malware TeamSpy Resurfaces in Spam Campaign

After almost a four-year respite, the data-stealing TeamSpy malware has resurfaced, or at least that’s what a spam campaign detected over the weekend suggests, researchers say. Researchers at the CrySyS Lab in Hungary originally identified the malware back in March 2013 when they traced it back t...

Websites of Indian Embassy in 7 Countries Hacked; Database Leaked Online

Indian embassy websites in seven different countries have been hacked, and attackers have leaked personal data, including full name, residential address, email address, passport number and phone number, of Indian citizens living abroad. This incident is extremely worrying because it involves...

Dropping Elephant hacker group using the old Windows vulnerability to implementation attacks-vulnerability warning-the black bar safety net

! As the old saying goes:don't judge people on. For the network of criminal organizations is the same,not only from its use of the vulnerability to determine a hacker organizations. According to foreign media reports,Kaspersky Lab's global research and analysis team has discovered a network of...

'Dropping Elephant' APT Attackers Targets Old Windows Flaws

Don’t judge an APT by its exploits alone. That’s the takeaway from a report that details a unique advanced persistent threat that leverages a kludge of unsophisticated, outdated and rudimentary attack tools to conduct cyber espionage. The target of the attacks are government and diplomatic agenci...

"Pakistan People's Party" Website Hacked — Message for Bilawal Bhutto

On Tuesday, Indian and Pakistani army forces continued to exchange fire along the Line of Control LoC in Jammu and Kashmir, which was started when Pakistan’s military fired machine guns and mortars at about 60 Indian army posts during last week. Tensions between the two countries have intensified...

Germany to step up Counter Espionage Program against United States

Sooner or later it had to Happen! After whistle-blower Edward Snowden unfolded various spying operations that were controlled by the US Intelligence agency, it gave a reason to all other countries to start their own Counter-Surveillance programs. Last year in October, it was revealed that the...

The Mask Malware: A 7-Year Cyber Espionage Campaign Unmasked

A sophisticated cyber spying operation, The Mask , that has been under the radar for about 7 years and targeted approximately 31 countries, has now been unmasked by researchers at Kaspersky Labs. Researchers believe the campaign has been active since 2007 and is a highly sophisticated nation-stat...

Edward Snowden nominated for Nobel Peace Prize 2014

Now there is really great news for all the supporters of Former National Security Agency NSA contractor Edward Snowden, as he is nominated for the 2014 Nobel Peace Prize by two Norwegian lawmakers. Snorre Valen and Baard Vegar Solhjell, parliamentarians from Norway’s Socialist Left Party said, “H...

Threat Outbreak Alert: Fake Monetary Award Email Messages on July 9, 2013

Medium Alert ID: 30019 First Published: 2013 July 10 14:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a monetary award for the recipient. The text in the email message attempts to convince the recipient to open the...

WikiLeaks founder Julian Assange will not leave Ecuadorian Embassy in London

WikiLeaks founder Julian Assange says he will not leave the Ecuadorian Embassy after Ecuador's foreign minister has said its embassy in London will continue to provide political asylum to Julian Assange. He was staying in embassy for the past year to avoid extradition to Sweden. The Australian wi...

Red October Attackers Shutting Down C&C Infrastructure

It appears that the attackers behind the Red October cyberespionage campaign are taking their ball and going home. Since the attack came to light on Monday, the attackers have begun shutting down their infrastructure and the hosting providers and registrars involved with some of the...