Hackers deface Saudi ‘Davos in the Desert’ site against Khashoggi’s death

By Waqas The official website of Saudi Arabia's Future Investment Initiative ‘Davos in the Desert’ was hit by a cyber attack in which hackers defaced its homepage to protest the brutal murder of The Washington Post's journalist Jamal Khashoggi in Turkey and killings of innocent civilians in Yemen...

MuddyWater expands operations

Summary MuddyWater is a relatively new APT that surfaced in 2017. It has focused mainly on governmental targets in Iraq and Saudi Arabia, according to past telemetry. However, the group behind MuddyWater has been known to target other countries in the Middle East, Europe and the US. We recently...

Virus Bulletin 2018: Saudi Dissident Spyware Attack Belies Bigger Threat

MONTREAL – This week, news broke that a well-known Saudi dissident has been targeted by the notorious Pegasus spyware – after he gained permanent citizen status in Canada. While this fits into pattern of ongoing attacks on “civil society” members i.e., journalists, social justice activists,...

Amnesty International Targeted by Nation-State Spyware

Human rights stalwart Amnesty International says that it has been targeted in a nation-state led cyberespionage attack. The group said that a staff member in June received a malicious WhatsApp message in Arabic, purporting to contain a link to information about an alleged protest outside the Saud...

NSO Spyware Targets Saudi Human Rights Activists and Researchers

Amnesty International, one of the most prominent non-profit human rights organizations in the world, claims one of its staff members has been targeted by a sophisticated surveillance tool made by Israel's NSO Group. The NSO Group is an Israeli firm that's mostly known for selling high-tech spywar...

Smaller Nation State Attacks: A Growing Cyber Menace

Last year, a Qatari state media website was compromised and defaced with false reports of the Emir of that country praising Iran and Hamas. The fake content was blasted on social media and amplified through bots, eventually provoking a regional boycott that persists today. Andrea Little Limbago...

jobs.maps-streetview.com XSS vulnerability

Open Bug Bounty ID: OBB-483797 Description| Value ---|--- Affected Website:| jobs.maps-streetview.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated...

landrover-saudi.com XSS vulnerability

Open Bug Bounty ID: OBB-444382 Description| Value ---|--- Affected Website:| landrover-saudi.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

Elaborate scripting-fu used in espionage attack against Saudi Arabia Government entity

This post was co-authored by David Sánchez and Jérôme Segura We recently came across a campaign targeting a Saudi Arabia Government entity via a malicious Word document which at first reminded us of an attack we had previously described on this blog. In our previous research, we detailed how an...

Iranian APT33 Targets U.S. Firms with Destructive Malware

The Iranian group known as APT33 is believed to be behind a cyberespionage campaign targeting aerospace, petrochemical and energy sector firms located in the United States, Saudi Arabia and South Korea. The group’s latest attack leverages a dropper called DropShot that is tied to the StoneDrill...

Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware

When discussing suspected Middle Eastern hacker groups with destructive capabilities, many automatically think of the suspected Iranian group that previously used SHAMOON – aka Disttrack – to target organizations in the Persian Gulf. However, over the past few years, we have been tracking a...

Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware

When discussing suspected Middle Eastern hacker groups with destructive capabilities, many automatically think of the suspected Iranian group that previously used SHAMOON – aka Disttrack – to target organizations in the Persian Gulf. However, over the past few years, we have been tracking a...

globalknowledge.com.sa XSS vulnerability

Vulnerable URL: https://www.globalknowledge.com.sa/search/?SearchTerm=%22autofocus%2Fonfocus%3D%22prompt%28%27XSSPOSED%27%29 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 637913 VIP website status:| No...

Social media accounts of HBO, Game of Thrones and others hacked

By Carolina OurMine, a Saudi Arabia based hacking group hacked the official This is a post from HackRead.com Read the original post: Social media accounts of HBO, Game of Thrones and others hacked...

Game of Thrones and HBO — Twitter, Facebook Accounts Hacked

The Game of Thrones hacking saga continues, but this time it's the HBO's and GOT's official Twitter and Facebook accounts got compromised, rather than upcoming episodes. As if the leak of episodes by hackers and the accidental airing of an upcoming episode of Game of Thrones by HBO itself were no...

Mamba Ransomware Returns, APT Trends, And More

Mike Mimoso and Chris Brook discuss the news of the week including the return of the Mamba ransomware, Kaspersky Lab’s Q2 APT report, Bugcrowd’s 250K mystery bounty, and a high schooler’s $10K bug bounty from Google. Download: ThreatpostNewsWrapAugust112017.mp3 Music by Chris Gonsalves Show notes...

Nasty Mamba ransomware that encrypts entire hard drive resurfaces

By Waqas Mamba Ransomware Resurfaces in Brazil and Saudi Arabia With Nefarious This is a post from HackRead.com Read the original post: Nasty Mamba ransomware that encrypts entire hard drive resurfaces...

The return of Mamba ransomware

At the end of 2016, there was a major attack against San Francisco's Municipal Transportation Agency. The attack was done using Mamba ransomware. This ransomware uses a legitimate utility called DiskCryptor for full disk encryption. This month, we noted that the group behind this ransomware has...

Mamba Ransomware Resurfaces in Brazil, Saudi Arabia

Mamba was among the first samples of ransomware that encrypted hard drives rather than files that was detected in public attacks, primarily against organizations in Brazil and in a high-profile incursion against the San Francisco Municipal Transportation Agency last November. Researchers at...

Paragon Initiative Enterprises: [Critical] billion dollars issue

Hey, My name is El-Sisi also i have famous name is بلحه Balaha and i have found documents that confirm you the github inc belong to you. if you need this documents give me reward and i will give u that documents. why i'm doing this because my mother tell me if you see some things like that you mu...