DORA Compliance Cybersecurity Guide for Finance

DORA Compliance Cybersecurity: A Practical Guide for Financial Services Teams DORA compliance cybersecurity is now a board-level priority for banks, insurers, investment firms, payment providers, and the ICT providers that support them. The Digital Operational Resilience Act shifts the conversati...

A Scenario: Protecting a Financial Institution from External Threats With EASM

Background Carman Bank, a mid-sized financial institution, has experienced rapid growth over the past five years. As part of its expansion, the bank has significantly increased its digital presence by launching new online banking services, mobile applications, and integrating various third-party...

Polyfill.io Supply Chain Attack: Widespread Compromise Affects Over 100,000 Websites

...

ChamelGang’s Double Play: Strategy Beyond Encryption

...

Noodle RAT: Understanding the Full Scope of this Cross-Platform Malware

...

FortiClient EMS Vulnerability Exploited in Connect:fun Campaign

...

Attacks, Vulnerabilities and Actors 8 to 14 April 2024

...

The Exposure Management Acronym Dictionary

In this video, Anand Choudha, CEO at Hive Pro, and Jeelan Poola, CPO at Hive Pro, introduce the HivePro Uni5 Threat Exposure Management Platform. HivePro Uni...

TA577 Targeting Windows NTLM Hashes in Global Campaigns

Summary: TA577, a significant cyber threat group, has shifted tactics to steal NTLM authentication data, utilizing thread hijacking and customized HTML attachments. Organizations should block outbound SMB to thwart exploitation and remain vigilant against evolving attack methods. Threat Level - R...

North-Korean Cyber-Espionage Operations Grapples Defense Sector

Summary: There is an ongoing cyber-espionage campaign purportedly led by the North Korean threat actors, specifically targeting the global defense industry. The primary objective of these attacks is to acquire data pertaining to advanced military technology, with the intention of assisting North...

Novel Smishing Kit Leverages Cloud Platform

Summary: SNS Sender, a malicious Python script that leverages AWS SNS for mass SMS spamming, presents a novel approach to cloud-based attack tools, particularly in the area of smishing. The ARDUINODAS threat actor is linked to the operation that uses this cloud capability to send out a lot of...

Kasseika Ransomware Employs BYOVD Tactic to Impair Defenses

Summary: The ransomware operation Kasseika has recently been identified using the Bring Your Own Vulnerable Driver BYOVD tactic. This involves exploiting vulnerabilities in a loaded driver to disable antivirus software before initiating the file encryption process. Through this strategy, the...

Attacks, Vulnerabilities and Actors 4 December to 10 December 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, a total of eleven attacks were executed, eleven vulnerabilities were uncovered, and four active adversaries...

SugarGh0st RAT A Customized Gh0st Variant in Cyber Espionage

Summary: A malicious campaign deploying the customized SugarGh0st RAT, likely orchestrated by a Chinese-speaking threat actor targeting the Uzbekistan Ministry of Foreign Affairs and South Korean users. SugarGh0st, a variant of Gh0st RAT, exhibits advanced features for remote control, keylogging,...

Summary of Vulnerabilities, Actors & Attacks: October 2023

...

Quasar RAT Utilizes DLL Side-Loading to Evade Detection

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Quasar RAT is an open-source remote access trojan that has been used by cybercriminals and threat actors for various malicious purposes. The use of DLL side-loading is a sophisticated technique that allo...

In-Depth Analysis of AvosLocker Ransomware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary AvosLocker also known as Avos, is a ransomware-as-a-service that targets critical infrastructure organizations, primarily in the US, and has expanded to target both Windows and Linux systems. Its...

Grayling APT Emerges as a Silent Threat Targeting Taiwan

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The Grayling APT group orchestrated a meticulously planned targeting campaign with a primary emphasis on espionage. Grayling set its sights on a government entity in the Asia-Pacific region, along with...

Earth Lusca’s Sneaky Moves Unleashes New Linux Backdoor

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Earth Lusca, a highly sophisticated Chinese threat actor, is believed to have resumed its operations in the first half of 2023. This cyber espionage group utilizes the SprySOCKS backdoor, primarily...

Lazarus Group Uses ManageEngine Exploit to Unlock Path for QuiteRAT

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Lazarus Group, a threat actor associated with North Korea, has been detected utilizing a recently patched critical security vulnerability in Zoho ManageEngine ServiceDesk Plus. This vulnerability was...

DroxiDat Targets Southern African Power Utility

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In a targeted operation, an unidentified actor strategically deployed the advanced DroxiDat proxy-capable backdoor alongside Cobalt Strike beacons. The operation was aimed at a critical power utility...

Reptile Rootkit Targets Linux Systems in South Korea

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Reptile, an open-source Linux rootkit, goes beyond concealment, offering attackers a reverse shell and utilizing Port Knocking for control; observed in attacks including Chinese groups exploiting...

Stealth Soldier Strikes North Africa with Espionage Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Stealth Soldier is a backdoor malware that conducts surveillance and espionage attacks. It targeted North Africa by mimicking Libyan websites to distribute malware. To receive real-time threat advisories...

New AndoryuBot Malware Exploits Ruckus Wireless Flaw for DDoS Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary AndoryuBot targets critical Ruckus Wireless Admin panel vulnerability to infect Wi-Fi access points for use in DDoS attacks, malware supports 12 DDoS attack modes and is marketed through YouTube videos. ...

New Version of ViperSoftX Malware Targets Password Managers and Cryptocurrency Wallets

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ViperSoftX is an information-stealing malware primarily targeting cryptocurrencies, using sophisticated encryption techniques and monthly changes in command-and-control servers to evade detection. To...

New macOS malware RustBucket attributed to North Korean group BlueNoroff

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary RustBucket, attributed to BlueNoroff, is split into two stages, with the second stage application appearing as a legitimate PDF viewer but becoming malicious when a specific PDF is loaded. To receive...

North Korean-Backed Group’s Sparks X_Trader Supply Chain Attack

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The XTrader software supply chain attack affected at least a number of critical infrastructure entities in the United States and Europe. To receive real-time threat advisories, please follow HiveForce La...

UNC4466 Attack Campaign Targets Veritas Backup Exec and Deploys ALPHV Ransomware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary UNC4466 conducted an attack campaign in late 2022, gaining initial access to an internet-exposed Windows server running Veritas Backup Exec and deploying the ALPHV ransomware, with over 8,500 potentially...

CISA Known Exploited Vulnerability Catalog March 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary For a detailed CISAs KEV Catalog, download the pdf file here The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included ...

Microsoft fixed 83 vulnerabilities including two zero-day vulnerabilities

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Microsoft has released its March 2023 Patch Tuesday update, addressing a total of 83 vulnerabilities, including 9 critical, 70 important, 1 moderate, and 3 other vulnerabilities...

Actors, Threats and Vulnerabilities 6 March to 12 March 2023

For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Last week, HiveForce Labs discovered three threat actors. One of them is a Russian group called TA499, which has a history of conducting different cyberattacks such as...

New GoBruteforcer Malware Targeting Web Servers Running Popular Services

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The GoBruteforcer malware targets web servers and uses Golang programming language. It employs CIDR block scanning to access servers through brute force and deploy an...

Tracking the Malicious Email Campaigns of Russia-Aligned TA499

Threat Level Actor Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary TA499 is a group of threat actors aligned with the Russian state that engages in impersonation-based, patriotically motivated misinformation campaigns. They use email ...

Mylobot: A Sophisticated Botnet Malware Targeting Computers Worldwide

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Mylobot is a Windows-targeting malware and was first discovered in 2017. It has not received much attention since then, but it is noteworthy for its ability to transform the infected system into a proxy...

A New Info-Stealing Malware Named “Stealc” Targeting Cryptocurrency Wallets

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new information-stealing malware called Stealc was discovered in January 2023. This malware is designed to steal sensitive information from various sources including web browsers, desktop cryptocurrenc...

Actors, Threats and Vulnerabilities 30 January to 5 February 2023

For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Hive Pro discovered four actors that have been active in the past week. The first, Sandworm Team, is a well-known Russian threat actor known for Sabotage and destruction. The...

Uncovering the Threat of BlueBravo with GraphicalNeutrino and BEATDROP

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary GraphicalNeutrino and BEATDROP are malicious software used by the Russian-linked threat group BlueBravo in targeted cyber attacks, using legitimate Western services for command-and-control communications...

Control Web Panel OS Command Injection Exploitation Increases After POC Release

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary On January 3, 2023, a security researcher published a proof-of-concept exploit for a vulnerability in Control Web Panel CWP that allows unauthenticated remote code execution. By January 6, the...

After four months of idleness, Emotet reappears and deploys loaders

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Emotet banking Trojan was initially found in 2014 as one of the most expensive and damaging malware. The phishing efforts that spread Emotet used the same email thread hijacking approach to deceive...

New Exploit Method that Bypasses ProxyNotShell Mitigations

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new exploit method has been found in the mitigations of the Microsoft Exchange vulnerability ProxyNotShell URL rewrite that allows for remote code execution RCE on compromised servers through Outlook W...

Actors, Threats and Vulnerabilities 28 November – 4 December 2022

...

Multiple Ransomware groups targets open RDP Ports

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Many ransomware attacks are being launched against exposed Remote Desktop services by Threat Actors. At present, five ransomware families are attacking open RDP ports...

Rise in new Royal Ransomware attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Royal Ransomware is a new form of ransomware used as a service in early 2022, with the objective of gaining access to a victims environment, encrypting all their files, and extorting a ransom in orde...

Chinese APT Earth Preta runs spearphishing campaigns

Threat Level Actors Report For a detailed threat advisory, download the pdf file here Summary Earth Preta, an APT gang, staged a large-scale cyber espionage campaign in which the malware was transmitted via spear-phishing emails. The actors use various strategies to avoid detection and analysis,...

LDR4 is a new Ursnif variant

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In June 2022, a new aspect of the URSNIF malware was identified. Unlike prior URSNIF iterations, this new variation, code named LDR4, is a backdoor designed to facilitate operations such as ransomware an...

Summary of Vulnerabilities & Threats: July 2022

...

Vulnerabilities & Threats that Matter 01 – 07th Aug

Published Vulnerabilities Interesting Vulnerabilities Active Threat Groups Targeted Countries Targeted Industries ATT&CK TTPs 461 12 1 60 30 26 For a detailed threat digest, download the pdf file here Summary The first week of August 2022 witnessed the discovery of 461 vulnerabilities out of whic...

ToddyCat exploits unknown vulnerability in Microsoft Exchange servers to targets entities in Europe and Asia

Threat Level Actor Report For a detailed advisory, download the pdf file here Summary ToddyCat, an APT group is deploying web shells by exploiting an unknown vulnerability in the Microsoft Exchange Servers. They are initiating a multi-stage infection that aims at governmental bodies in Europe and...

DriftingCloud exploits zero-day in Sophos firewall

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary The Chinese APT actor DriftingCloud exploits the RCE vulnerability in Sophos firewall to take over the entire network...

GALLIUM targets Telecommunications sector using new PingPull tool

Threat Level Actor Report For a detailed advisory, download the pdf file here Summary A new, difficult-to-detect remote access trojan known as PingPull has been discovered and is used by GALLIUM also known as Softcell, an APT group. They have expanded by targeting telecommunications, finance and...