Hackers Planted Fake Digital Evidence on Devices of Indian Activists and Lawyers

A previously unknown hacking group has been linked to targeted attacks against human rights activists, human rights defenders, academics, and lawyers across India in an attempt to plant "incriminating digital evidence." Cybersecurity firm SentinelOne attributed the intrusions to a group it tracks...

Iranian Hackers Using New Marlin Backdoor in 'Out to Sea' Espionage Campaign

An advanced persistent threat APT group with ties to Iran has refreshed its malware toolset to include a new backdoor dubbed Marlin as part of a long-running espionage campaign that started in April 2018. Slovak cybersecurity company ESET attributed the attacks — codenamed "Out to Sea" — to a...

Russian APT Hackers Used COVID-19 Lures to Target European Diplomats

The Russia-linked threat actor known as APT29 targeted European diplomatic missions and Ministries of Foreign Affairs as part of a series of spear-phishing campaigns mounted in October and November 2021. According to ESET's T3 2021 Threat Report shared with The Hacker News, the intrusions paved t...

Vulnerability fixed in Zimbra

A vulnerability has been fixed in Zimbra. An unauthenticated malicious party could exploit the vulnerability to perform a reflected cross-site scripting attack. Such an attack can lead to the execution of arbitrary script code in the browser with which the application is visited. Within Zimbra,...

Microsoft Uncovers New Details of Russian Hacking Campaign Targeting Ukraine

Microsoft on Friday shared more of the tactics, techniques, and procedures TTPs adopted by the Russia-based Gamaredon hacking group to facilitate a barrage of cyber espionage attacks aimed at several entities in Ukraine over the past six months. The attacks are said to have singled out government...

The vulnerability of Microsoft Visual Studio software, related to errors in user interface representation, allows attackers to perform spear-phishing attacks.

The vulnerability of Microsoft Visual Studio software relates to errors in information representation at the user interface level. Exploiting this vulnerability allows a malicious actor to carry out spear-phishing attacks using specially crafted requests...

Lazarus APT Uses Windows Update to Spew Malware

Lazarus Group is using Windows Update to spray malware in a campaign powered by a GitHub command-and-control C2 server, researchers have found. On Thursday, the Malwarebytes Threat Intelligence team reported that they discovered the North Korean state advanced persistent threat APT group’s latest...

North Korean Hackers Using Windows Update Service to Infect PCs with Malware

The notorious Lazarus Group actor has been observed mounting a new campaign that makes use of the Windows Update service to execute its malicious payload, expanding the arsenal of living-off-the-land LotL techniques leveraged by the APT group to further its objectives. The Lazarus Group, also kno...

North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign

This blog was authored by Ankur Saini and Hossein Jazi Lazarus Group is one of the most sophisticated North Korean APTs that has been active since 2009. The group is responsible for many high profile attacks in the past and has gained worldwide attention. The Malwarebytes Threat Intelligence team...

Prime Minister’s Office Compromised: Details of Recent Espionage Campaign

Prime Minister’s Office Compromised: Details of Recent Espionage Campaign By Marc Elias · January 25, 2022 A special thanks to Christiaan Beek, Alexandre Mundo, Leandro Velasco and Max Kersten for malware analysis and support during this investigation. Executive Summary Our Advanced Threat Resear...

Earth Lusca Hackers Aimed at High-Value Targets in Government and Private Sectors

An elusive threat actor called Earth Lusca has been observed striking organizations across the world as part of what appears to be simultaneously an espionage campaign and an attempt to reap monetary profits. "The list of its victims includes high-value targets such as government and educational...

Hackers Use Cloud Services to Distribute Nanocore, Netwire, and AsyncRAT Malware

Threat actors are actively incorporating public cloud services from Amazon and Microsoft into their malicious campaigns to deliver commodity remote access trojans RATs such as Nanocore, Netwire, and AsyncRAT to siphon sensitive information from compromised systems. The spear-phishing attacks, whi...

The vulnerability of the Microsoft Office software package, related to errors in information presentation on the user interface, allows a hacker to carry out a spear-phishing attack.

The vulnerability of the Microsoft Office suite is related to errors in information presentation at the user interface level. Exploiting this vulnerability can allow an attacker to carry out a spear-phishing attack...

The vulnerability of the Office Online Server web server, related to errors in information representation by the user interface, allows attackers to perform spear-phishing attacks.

The vulnerability of the Office Online Server web server is related to errors in information representation by the user interface. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...

Vulnerability of Windows operating system certificates, allowing attackers to perform spoofing attacks

The vulnerability of Windows operating system certificates is related to errors in information representation by the user interface. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

The vulnerability of Google Chrome’s command-line interface allows attackers to perform spear-phishing attacks.

The vulnerability of the Google Chrome browser’s command-line interface is related to the implementation or modification of arguments. Exploiting this vulnerability can allow attackers to perform spoofing attacks...

Patchwork APT caught in its own web

Patchwork is an Indian threat actor that has been active since December 2015 and usually targets Pakistan via spear phishing attacks. In its most recent campaign from late November to early December 2021, Patchwork has used malicious RTF files to drop a variant of the BADNEWS Ragnatela Remote...

North Korean Hackers Start New Year with Attacks on Russian Foreign Ministry

A North Korean cyberespionage group named Konni has been linked to a series of targeted attacks aimed at the Russian Federation's Ministry of Foreign Affairs MID with New Year lures to compromise Windows systems with malware. "This activity cluster demonstrates the patient and persistent nature o...

The vulnerability in the implementation of the Autofill function in the Microsoft Edge browser allows attackers to carry out spear-phishing attacks.

The vulnerability of the Autofill function in Microsoft Edge browsers involves bypassing authentication through spearphishing. Exploiting this vulnerability allows attackers to carry out spearphishing attacks remotely...

Tropic Trooper Cyber Espionage Hackers Targeting Transportation Sector

The transportation industry and government agencies related to the sector are the victims of an ongoing campaign since July 2020 by a sophisticated and well-equipped cyberespionage group in what appears to be yet another uptick in malicious activities that are "just the tip of the iceberg." "The...