APT40: Examining a China-Nexus Espionage Actor

FireEye is highlighting a cyber espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40. The actor has conducted operations since at least 2013 in support of China’s naval modernization effort. The group has...

Cyber Security Week in Review (Feb. 22)

Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here. Top headlines this week U.S. officials charged a form...

Microsoft: Russia's Fancy Bear Working to Influence EU Elections

As the May elections for European Parliament loom, Russia-linked APT groups are amping up their efforts to target journalists, think-tanks, non-governmental organizations and other members of civil society, according to Microsoft. The tech giant said on Tuesday that it has observed a recent serie...

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

The U.S. government -- along with a number of leading security companies -- recently warned about a series of highly complex and widespread attacks that allowed suspected Iranian hackers to siphon huge volumes of email passwords and other sensitive data from multiple governments and private...

Chinese facial recognition database tracking Muslims left exposed

By Waqas China is often held responsible for conducting surveillance campaigns and espionage activities discreetly not only on its citizens but governments across continents. Now, a misconfigured facial recognition database has emerged that confirms the allegations put forth against China...

Ex-US Intelligence Agent Charged With Spying and Helping Iranian Hackers

The United States Department of Justice has announced espionage charges against a former US Air Force intelligence officer with the highest level of top-secret clearance for providing the Iranian government classified defense information after she defected to Iran in 2013. Monica Elfriede Witt, 3...

U.S. Senators Urge VPN Ban for Federal Workers Over Spying

UPDATE Two U.S. senators are taking bipartisan aim at foreign-owned virtual private networks VPNs, which they say are often headquartered “in countries that do not share American interests or values” – specifically, China and Russia. Sens. Ron Wyden D-Ore. and Marco Rubio R-Fla. have signed a joi...

Spy Campaign Spams Pro-Tibet Group With ExileRAT

A cyber-espionage campaign has been spotted targeting recipients of a mailing list run by the Central Tibetan Administration CTA. India’s CTA is an organization officially representing the Tibetan government-in-exile. The territory of Tibet is administered by the People’s Republic of China – but...

ExileRAT shares C2 with LuckyCat, targets Tibet

Warren Mercer, Paul Rascagneres and Jaeson Schultz authored this post. Executive summary Cisco Talos recently observed a malware campaign delivering a malicious Microsoft PowerPoint document using a mailing list run by the Central Tibetan Administration CTA, an organization officially representin...

Hackers used Karma tool to hack iPhones of prominent Govt officials

By Uzair Amir UAE Launched Aggressive Cyber Espionage Campaign using KARMA and Expertise of Ex-NSA Operatives. Though it seems hard to believe it is indeed true that the smartphones of several prominent political and governmental personalities worldwide have been hacked by former US intelligence...

Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities

Executive Summary Throughout the autumn of 2018 we analyzed a long-standing and still active at that time cyber-espionage campaign that was primarily targeting foreign diplomatic entities based in Iran. The attackers were using an improved version of Remexi in what the victimology suggests might ...

'Unprecedented' DNS Hijacking Attacks Linked to Iran

A wave of DNS hijacking attacks targeting victims in North America, Europe, Middle East and North Africa have been linked to Iran. The attacks, which have been ongoing over the past two years, have had “a high degree of success” harvesting targets’ credentials, according to researchers. Researche...

Marriott Revises Breach Scope to 383M Records

Marriott has revised downward its estimate on the number of guests whose passport numbers and payment card data were impacted in its recent data breach. After the hospitality giant confirmed in November that there had been unauthorized access to its Starwood guest reservations database from 2014 ...

Newsmaker Interview: Bruce Schneier on Physical Cyber Threats

Attacks on physical devices and infrastructure offer a new target for cyber crime, a new opportunity for espionage and even a few front in cyber war. Rather than exploit computers and their applications, the Internet of Things allows malicious actors to go after a whole new category of devices,...

First-Ever UEFI Rootkit Tied to Sednit APT

LEIPZIG, GERMANY – Researchers hunting cyber-espionage group Sednit an APT also known as Sofacy, Fancy Bear and APT28 say they have discovered the first-ever instance of a rootkit targeting the Windows Unified Extensible Firmware Interface UEFI in successful attacks. The discussion of Sednit was...

U.S. Indicts Chinese Duo for Massive, Years-Long Spy Campaign

The Department of Justice on Thursday charged two Chinese hackers with stealing “hundreds of gigabytes” of data from more than 45 other governmental organizations and U.S.-based companies. This has potentially significant national security ramifications: Targets included the NASA Goddard Space...

Hacking Diplomatic Cables Is Expected. Exposing Them Is Not

Spies try to access government communications all the time. But an incident this week tested the limits of what happens when those compromises get discovered...

Charming Kitten Iranian Espionage Campaign Thwarts 2FA

A range of political and civil society targets are under fire in an APT attack dubbed the Return of Charming Kitten. The campaign has been tailored to get around two-factor authentication in order to compromise email accounts and start monitoring communications. According to researchers at Certfa...

Beers with Talos EP 43: Espionage, Encryption, and CISO Square One

Beers with Talos BWT Podcast Ep. 43 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 43 show notes: Recorded Dec. 7, 2018. Several of us are under the weather, but the show must go on. We did our best, as alway...

Marriott Hack Reported as Chinese State-Sponsored

The New York Times and Reuters are reporting that China was behind the recent hack of Marriott Hotels. Note that this is still uncomfirmed, but interesting if it is true. Reuters: Private investigators looking into the breach have found hacking tools, techniques and procedures previously used in...