1213 matches found
Silent Librarian Goes Back to School with Global Research-Stealing Effort
The Silent Librarian campaign has re-emerged for the fall school session, actively targeting students and faculty at universities via spear-phishing campaigns. The threat group also known as TA407 and Cobalt Dickens, which operates out of Iran, has been on the prowl since the start of the 2019...
Silent Librarian APT right on schedule for 20/21 academic year
A threat actor known as Silent Librarian/TA407/COBALT DICKENS has been actively targeting universities via spear phishing campaigns since schools and universities went back. In mid-September, we were tipped off by one of our customers about a new active campaign from this APT group. Based off a...
PoetRAT Resurfaces in Attacks in Azerbaijan Amid Escalating Conflict
A new iteration of the PoetRAT spyware, sporting improvements to operational security, code efficiency and obfuscation, is making the rounds in Azerbaijan, targeting the public sector and other key organizations as the country’s conflict with Armenia over disputed territory intensifies. Threat...
Malware Families Turn to Legit Pastebin-Like Service
Cybercriminals are increasingly turning to a legitimate, Pastebin-like web service for downloading malware — such as AgentTesla and LimeRAT — in spear-phishing attacks. Pastebin, a code-hosting service that enables users to share plain text through public posts called “pastes,” currently has 17...
Emotet Emails Strike Thousands of DNC Volunteers
On Thursday, hundreds of U.S. organizations were targeted by an Emotet spear-phishing campaign, which sent thousands of emails purporting to be from the Democratic National Committee and recruiting potential Democratic volunteers. Emotet has historically utilized a variety of lure themes leveragi...
Spammers Smuggle LokiBot Via URL Obfuscation Tactic
Spammers have started using a tricky URL obfuscation technique that sidesteps detection – and ultimately infects victims with the LokiBot trojan. The tactic was uncovered in recent spear-phishing emails with PowerPoint attachments, which contain a malicious macro. When the PowerPoint file is...
Xamarin.Forms WebView Google Chrome Spear Phishing
The vulnerability of the Microsoft Xamarin.Forms user interface platform, including the WebView component for displaying web pages and the Google Chrome browser, is related to errors in the user interface’s information presentation. Exploiting this vulnerability can allow a remote attacker to...
Microsoft SharePoint Server Spoofing
The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Foundation, and Microsoft SharePoint Enterprise Server stems from insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to carry out spear-phishing attacks using a specially crafted...
OldGremlin Ransomware Group Bedevils Russian Orgs
A new cybercriminal group called OldGremlin has been targeting Russian companies – including banks, industrial enterprises and medical firms – with ransomware attacks. OldGremlin relies on a bevy of tools, including custom backdoors called TinyPosh and TinyNode, to gain an initial foothold in the...
Active Directory Federation Services Spoofing
The vulnerability of the Active Directory Federation Services AD FS for Windows operating systems is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to carry out spear-phishing attacks remotely...
Hackers Continue Cyberattacks Against Vatican, Catholic Orgs
A state-sponsored threat group linked to China has been engaged in a five-month long cyberattack against the Vatican and other Catholic Church-related organizations. Attacks have come in the form of spear phishing emails laced with the PlugX remote access tool RAT as the payload. Researchers with...
New Report Explains COVID-19's Impact on Cyber Security
Most cybersecurity professionals fully anticipated that cybercriminals would leverage the fear and confusion surrounding the Covid-19 pandemic in their cyberattacks. Of course, malicious emails would contain subjects relating to Covid-19, and malicious downloads would be Covid-19 related. This is...
New Report Explains COVID-19's Impact on Cyber Security
Most cybersecurity professionals fully anticipated that cybercriminals would leverage the fear and confusion surrounding the Covid-19 pandemic in their cyberattacks. Of course, malicious emails would contain subjects relating to Covid-19, and malicious downloads would be Covid-19 related. This is...
CISA: Chinese Hackers Exploiting Unpatched Devices to Target U.S. Agencies
The US Cybersecurity and Infrastructure Security Agency CISA issued a new advisory on Monday about a wave of cyberattacks carried by Chinese nation-state actors targeting US government agencies and private entities. "CISA has observed Chinese Ministry of State Security-affiliated cyber threat...
CISA: Chinese Hackers Exploiting Unpatched Devices to Target U.S. Agencies
The US Cybersecurity and Infrastructure Security Agency CISA issued a new advisory on Monday about a wave of cyberattacks carried by Chinese nation-state actors targeting US government agencies and private entities. "CISA has observed Chinese Ministry of State Security-affiliated cyber threat...
Microsoft SharePoint Server Execution Spear Phishing
The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks using a specially crafted request sent to the vulnerable SharePoint server...
Microsoft SharePoint Server Execution Spear Phishing
The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks using a specially crafted request sent to the vulnerable SharePoint server...
Social Media: Thwarting The Phishing-Data Goldmine
Phishing attacks are on the rise and are more widespread — and successful — than ever before. They’ve gone way beyond mocked-up bank emails littered with malicious links although those are still around, too. Today’s hackers now target mobile users across multiple vectors, such as text and SMS...
Evilnum hackers targeting financial firms with a new Python-based RAT
An adversary known for targeting the fintech sector at least since 2018 has switched up its tactics to include a new Python-based remote access Trojan RAT that can steal passwords, documents, browser cookies, email credentials, and other sensitive information. In an analysis published by Cybereas...
Evilnum hackers targeting financial firms with a new Python-based RAT
An adversary known for targeting the fintech sector at least since 2018 has switched up its tactics to include a new Python-based remote access Trojan RAT that can steal passwords, documents, browser cookies, email credentials, and other sensitive information. In an analysis published by Cybereas...