May 10, 2024NewsroomMalware / Cyber Espionage The North Korean threat actor tracked as Kimsuky has been observed deploying a previously undocumented Golang-based malware dubbed Durian as part of highly-targeted cyber attacks aimed at two South Korean cryptocurrency firms. "Durian boasts comprehensive backdoor functionality, enabling the execution of delivered commands, … [Read more...] about North Korean Hackers Deploy New Golang Malware ‘Durian’ Against Crypto Firms
Malware
Kremlin-Backed APT28 Targets Polish Institutions in Large-Scale Malware Campaign
May 09, 2024NewsroomMobile Security / Cyber Attack Polish government institutions have been targeted as part of a large-scale malware campaign orchestrated by a Russia-linked nation-state actor called APT28. "The campaign sent emails with content intended to arouse the recipient's interest and persuade him to click on the link," the computer emergency response team, CERT … [Read more...] about Kremlin-Backed APT28 Targets Polish Institutions in Large-Scale Malware Campaign
How to protect yourself from phishing and malware on GitHub and GitLab
One of the oldest security tips is: “Only download software from official sources”. “Official sources” are usually the main app stores on each platform, but for millions of useful and free open-source apps, the most “official” source is the developer’s repository on a dedicated site such as GitHub or GitLab. There, you can find the project’s source code, fixes and additions to … [Read more...] about How to protect yourself from phishing and malware on GitHub and GitLab
Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications
May 03, 2024NewsroomCloud Security / Threat Intelligence Threat actors have been increasingly weaponizing Microsoft Graph API for malicious purposes with the aim of evading detection. This is done to "facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud services," the Symantec Threat Hunter Team, part of Broadcom, said in a … [Read more...] about Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications
OfflRouter Malware Evades Detection in Ukraine for Almost a Decade
Apr 18, 2024NewsroomIncident Response / Cyber Espionage Select Ukrainian government networks have remained infected with a malware called OfflRouter since 2015. Cisco Talos said its findings are based on an analysis of over 100 confidential documents that were infected with the VBA macro virus and uploaded to the VirusTotal malware scanning platform. "The documents contained … [Read more...] about OfflRouter Malware Evades Detection in Ukraine for Almost a Decade
Vietnam-Based Hackers Steal Financial Data Across Asia with Malware
A suspected Vietnamese-origin threat actor has been observed targeting victims in several Asian and Southeast Asian countries with malware designed to harvest valuable data since at least May 2023. Cisco Talos is tracking the cluster under the name CoralRaider, describing it as financially motivated. Targets of the campaign include India, China, South Korea, Bangladesh, … [Read more...] about Vietnam-Based Hackers Steal Financial Data Across Asia with Malware
Hackers Target macOS Users with Malicious Ads Spreading Stealer Malware
Mar 30, 2024NewsroomMalware / Cryptocurrency Malicious ads and bogus websites are acting as a conduit to deliver two different stealer malware, including Atomic Stealer, targeting Apple macOS users. The ongoing infostealer attacks targeting macOS users may have adopted different methods to compromise victims' Macs, but operate with the end goal of stealing sensitive data, … [Read more...] about Hackers Target macOS Users with Malicious Ads Spreading Stealer Malware
Hackers Hit Indian Defense, Energy Sectors with Malware Posing as Air Force Invite
Mar 27, 2024NewsroomCyber Espionage / Data Breach Indian government entities and energy companies have been targeted by unknown threat actors with an aim to deliver a modified version of an open-source information stealer malware called HackBrowserData and exfiltrate sensitive information in some cases by using Slack as command-and-control (C2). "The information stealer was … [Read more...] about Hackers Hit Indian Defense, Energy Sectors with Malware Posing as Air Force Invite
Russian Hackers Use ‘WINELOADER’ Malware to Target German Political Parties
Mar 23, 2024NewsroomCyber Espionage / Cyber Warfare The WINELOADER backdoor used in recent cyber attacks targeting diplomatic entities with wine-tasting phishing lures has been attributed as the handiwork of a hacking group with links to Russia's Foreign Intelligence Service (SVR), which was responsible for breaching SolarWinds and Microsoft. The findings come from Mandiant, … [Read more...] about Russian Hackers Use ‘WINELOADER’ Malware to Target German Political Parties
GTPDOOR Linux Malware Targets Telecoms, Exploiting GPRS Roaming Networks
Feb 29, 2024NewsroomLinux / Network Security Threat hunters have discovered a new Linux malware called GTPDOOR that's designed to be deployed in telecom networks that are adjacent to GPRS roaming exchanges (GRX) The malware is novel in the fact that it leverages the GPRS Tunnelling Protocol (GTP) for command-and-control (C2) communications. GPRS roaming allows subscribers to … [Read more...] about GTPDOOR Linux Malware Targets Telecoms, Exploiting GPRS Roaming Networks