Iran’s MuddyWater Group Targets Israelis with Fake Memo Spear-Phishing

By Deeba Ahmed MuddyWater aka Mango Sandstorm and Static Kitten is a cyberespionage group that's believed to be active since 2017. This is a post from HackRead.com Read the original post: Irans MuddyWater Group Targets Israelis with Fake Memo Spear-Phishing...

Iran's MuddyWater Targets Israel in New Spear-Phishing Cyber Campaign

The Iranian nation-state actor known as MuddyWater has been linked to a new spear-phishing campaign targeting two Israeli entities to ultimately deploy a legitimate remote administration tool from N-able called Advanced Monitoring Agent. Cybersecurity firm Deep Instinct, which disclosed details o...

The vulnerability of the Downloads component of the Google Chrome browser, which allows attackers to perform spear-phishing attacks

The vulnerability of the Downloads component of the Google Chrome browser is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

The vulnerability of the Downloads component of the Google Chrome browser, which allows attackers to perform spear-phishing attacks

The vulnerability of the Downloads component of the Google Chrome browser is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

The vulnerability of Firefox ESR and the Thunderbird email client, related to information representation errors in the user interface, allows attackers to perform spear-phishing attacks.

The vulnerability of Firefox ESR and the Thunderbird email client is related to information representation errors in the user interface. Exploiting this vulnerability allows a malicious actor to carry out spear-phishing attacks using a specially created link...

YoroTrooper: Researchers Warn of Kazakhstan's Stealthy Cyber Espionage Group

A relatively new threat actor known as YoroTrooper is likely made up of operators originating from Kazakhstan. The assessment, which comes from Cisco Talos, is based on their fluency in Kazakh and Russian, use of Tenge to pay for operating infrastructure, and very limited targeting of Kazakhstani...

DoNot Team's New Firebird Backdoor Hits Pakistan and Afghanistan

The threat actor known as DoNot Team has been linked to the use of a novel .NET-based backdoor called Firebird targeting a handful of victims in Pakistan and Afghanistan. Cybersecurity company Kaspersky, which disclosed the findings in its APT trends report Q3 2023, said the attack chains are als...

MATA Backdoor Targets Eastern European Industrial Companies

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MATA malware, a sophisticated backdoor framework, updated to target Eastern European industrial companies via spear-phishing, compromising financial software servers, and infiltrating networks, even...

The vulnerability of Microsoft Edge browser, related to information representation errors in the user interface, allows attackers to perform spear-phishing attacks.

The vulnerability of Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

Sophisticated MATA Framework Strikes Eastern European Oil and Gas Companies

An updated version of a sophisticated backdoor framework called MATA has been used in attacks aimed at over a dozen Eastern European companies in the oil and gas sector and defense industry as part of a cyber espionage operation that took place between August 2022 and May 2023. "The actors behind...

Kimsuky Unveils New Addition to Its Malware Arsenal

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Kimsuky, a cyber-espionage group, is known for infiltrating via spear-phishing attacks, and is recognized for its versatility in using various types of malware and tools to facilitate remote control durin...

Updated MATA attacks industrial companies in Eastern Europe

In early September 2022, we discovered several new malware samples belonging to the MATA cluster. As we were collecting and analyzing the relevant telemetry data, we realized the campaign had been launched in mid-August 2022 and targeted over a dozen corporations in Eastern Europe from the oil an...

Lazarus Group’s Targeted Attacks on Korean Sectors

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Lazarus a state-sponsored threat group, has been employing sophisticated tactics like spear phishing and supply chain attacks, and utilizing various types of malware for control. To receive real-time...

The vulnerability of the Downloads component of the Google Chrome browser, which allows a hacker to perform a spoofing attack

The vulnerability of the Downloads component of the Google Chrome browser is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

New PEAPOD Cyberattack Campaign Targeting Women Political Leaders

European Union military personnel and political leaders working on gender equality initiatives have emerged as the target of a new campaign that delivers an updated version of RomCom RAT called PEAPOD. Cybersecurity firm Trend Micro attributed the attacks to a threat actor it tracks under the nam...

The vulnerability of the Navigation component in Google Chrome allows attackers to carry out spoofing attacks.

The vulnerability of the Navigation component in Google Chrome is related to information representation errors in the user interface. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks using a specially created HTML page...

Researchers Uncover Ongoing Attacks Targeting Asian Governments and Telecom Giants

High-profile government and telecom entities in Asia have been targeted as part of an ongoing campaign since 2021 that's designed to deploy basic backdoors and loaders for delivering next-stage malware. Cybersecurity company Check Point is tracking the activity under the name Stayin' Alive. Targe...

Unveiling Operation Jacana: Targeting the Guyana Government with DinodasRAT

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A cyber espionage campaign named Operation Jacana was identified in February 2023, targeting a government entity in Guyana. This campaign began with a spear-phishing attack and resulted in the deployment...

Little Crumbs Can Lead To Giants

This week is the Virus Bulletin Conference in London. Part of the conference is the Cyber Threat Alliance summit, where CTA members like Rapid7 showcase their research into all kinds of cyber threats and techniques. Traditionally, when we investigate a campaign, the focus is mostly on the code of...

Guyana Governmental Entity Hit by DinodasRAT in Cyber Espionage Attack

A governmental entity in Guyana has been targeted as part of a cyber espionage campaign dubbed Operation Jacana. The activity, which was detected by ESET in February 2023, entailed a spear-phishing attack that led to the deployment of a hitherto undocumented implant written in C++ called...