Oct 18, 2024Ravie LakshmananInsider Threat / Cyber Espionage North Korean information technology (IT) workers who obtain employment under false identities in Western companies are not only stealing intellectual property, but are also stepping up by demanding ransoms in order to not leak it, marking a new twist to their financially motivated attacks. "In some instances, … [Read more...] about North Korean IT Workers in Western Firms Now Demanding Ransom for Stolen Data
cyber attacks
Russian RomCom Attacks Target Ukrainian Government with New SingleCamper RAT Variant
Oct 17, 2024Ravie LakshmananThreat Intelligence / Malware The Russian threat actor known as RomCom has been linked to a new wave of cyber attacks aimed at Ukrainian government agencies and unknown Polish entities since at least late 2023. The intrusions are characterized by the use of a variant of the RomCom RAT dubbed SingleCamper (aka SnipBot or RomCom 5.0), said Cisco … [Read more...] about Russian RomCom Attacks Target Ukrainian Government with New SingleCamper RAT Variant
Hackers Abuse EDRSilencer Tool to Bypass Security and Hide Malicious Activity
Oct 16, 2024Ravie LakshmananEndpoint Security / Malware Threat actors are attempting to abuse the open-source EDRSilencer tool as part of efforts to tamper endpoint detection and response (EDR) solutions and hide malicious activity. Trend Micro said it detected "threat actors attempting to integrate EDRSilencer in their attacks, repurposing it as a means of evading … [Read more...] about Hackers Abuse EDRSilencer Tool to Bypass Security and Hide Malicious Activity
TrickMo Banking Trojan Can Now Capture Android PINs and Unlock Patterns
Oct 15, 2024Ravie LakshmananMobile Security / Financial Fraud New variants of an Android banking trojan called TrickMo have been found to harbor previously undocumented features to steal a device's unlock pattern or PIN. "This new addition enables the threat actor to operate on the device even while it is locked," Zimperium security researcher Aazim Yaswant said in an … [Read more...] about TrickMo Banking Trojan Can Now Capture Android PINs and Unlock Patterns
Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration
Oct 14, 2024Ravie LakshmananNetwork Security / Vulnerability A suspected nation-state adversary has been observed weaponizing three security flaws in Ivanti Cloud Service Appliance (CSA) a zero-day to perform a series of malicious actions. That's according to findings from Fortinet FortiGuard Labs, which said the vulnerabilities were abused to gain unauthenticated access to … [Read more...] about Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration
OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf
Oct 13, 2024Ravie Lakshmanan The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of a cyber espionage campaign targeting the U.A.E. and the broader Gulf region. "The group utilizes sophisticated tactics that include deploying a backdoor that leverages Microsoft Exchange servers for … [Read more...] about OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf
FBI Creates Fake Cryptocurrency to Expose Widespread Crypto Market Manipulation
Oct 12, 2024Ravie LakshmananCryptocurrency / Cybercrime The U.S. Department of Justice (DoJ) has announced arrests and charges against several individuals and entities in connection with allegedly manipulating digital asset markets as part of a widespread fraud operation. The law enforcement action – codenamed Operation Token Mirrors – is the result of the U.S. Federal Bureau … [Read more...] about FBI Creates Fake Cryptocurrency to Expose Widespread Crypto Market Manipulation
GitHub, Telegram Bots, and QR Codes Abused in New Wave of Phishing Attacks
A new tax-themed malware campaign targeting insurance and finance sectors has been observed leveraging GitHub links in phishing email messages as a way to bypass security measures and deliver Remcos RAT, indicating that the method is gaining traction among threat actors. "In this campaign, legitimate repositories such as the open-source tax filing software, UsTaxes, HMRC, and … [Read more...] about GitHub, Telegram Bots, and QR Codes Abused in New Wave of Phishing Attacks
OpenAI Blocks 20 Global Malicious Campaigns Using AI for Cybercrime and Disinformation
Oct 10, 2024Ravie LakshmananCybercrime / Disinformation OpenAI on Wednesday said it has disrupted more than 20 operations and deceptive networks across the world that attempted to use its platform for malicious purposes since the start of the year. This activity encompassed debugging malware, writing articles for websites, generating biographies for social media accounts, and … [Read more...] about OpenAI Blocks 20 Global Malicious Campaigns Using AI for Cybercrime and Disinformation
Google Joins Forces with GASA and DNS RF to Tackle Online Scams at Scale
Oct 09, 2024Ravie LakshmananCybercrime / Threat Detection Google on Wednesday announced a new partnership with the Global Anti-Scam Alliance (GASA) and DNS Research Federation (DNS RF) to combat online scams. The initiative, which has been codenamed the Global Signal Exchange (GSE), is designed to create real-time insights into scams, fraud, and other forms of cybercrime … [Read more...] about Google Joins Forces with GASA and DNS RF to Tackle Online Scams at Scale