An analysis of 100,000+ Windows malware samples has revealed the most prevalent techniques used by malware developers to successfully evade defenses, escalate privileges, execute the malware, and assure its persistence. Malware tactics and techniques The analyzed malware samples were most often deli…
A new denial-of-service attack dubbed ‘Loop DoS’ targeting application layer protocols can pair network services into an indefinite communication loop that creates large volumes of traffic. Devised by researchers at the CISPA Helmholtz-Center for Information Security, the attack uses…
Atlassian addressed multiple vulnerabilities in its Bamboo, Bitbucket, Confluence, and Jira products. The most severe vulnerability, tracked as CVE-2024-1597 (CVSS score of 10), is a SQL injection flaw that impacts the org.postgresql:postgresql third-party dependency of Bamboo Data Center…
New and sophisticated tax phishing scams are targeting taxpayers, warns Microsoft. These scams impersonate trusted sources and use urgency tactics to steal personal and financial data. Taxpayers beware! Phishing scams are on the rise again as tax season heats up. Microsoft Threat Intelligence has is…
Threat actors are attempting to compromise Social Security numbers with a tax phishing attack targeting small business owners and self-employed filers.Worryingly, the social engineering scammers are likely operating with little more than a cheap email list of self-employed US residents, according to…
Security researchers have warned of a slew of fake obituaries designed to make money for their creators by redirecting visitors to adult entertainment sites and initiating antivirus (AV) popups.Secureworks claimed in a new blog post that the scammers monitor Google search trends to identify interest…
In a sweeping international law enforcement operation, Nemesis Market, a notorious darknet marketplace, was seized by authorities. The Frankfurt am Main Public Prosecutor’s Office, alongside the Federal Criminal Police Office, orchestrated the takedown, securing server infrastructure in Germany and…
A threat actor is purportedly a significant selling in the realm of Managed Service Providers (MSPs), as a vast encompassing more than 3,300 computers across over 40 American companies. The offering comprises two panels from a single MSP. The first panel boasts 1,581 computers, while the second pane…
What happened
Proofpoint researchers recently observed new activity by the Iran-aligned threat actor TA450 (also known as MuddyWater, Mango Sandstorm, and Static Kitten), in which the group used a pay-related social engineering lure to target Israeli employees at large multinational organizations. TA450 is known for targeting Israeli entities particularly since at least…
Iran-linked APT Curious Serpens is using a new backdoor, FalseFont, to target the aerospace and defense industries through fake job recruitment.
The post Curious Serpens’ FalseFont Backdoor: Technical Analysis, Detection and Prevention appeared first on Unit 42….
During the course of an intrusion investigation in late October 2023, Mandiant observed novel N-day exploitation of CVE-2023-46747 affecting F5 BIG-IP Traffic Management User Interface. Additionally, in February 2024, we observed exploitation of Connectwise ScreenConnect CVE-2024-1709 by the same actor. This mix of custom tooling and the SUPERSHELL framework leveraged in these…
SentinelLabs has discovered a novel malware variant of AcidRain that could be targeting telecoms networks in Ukraine.
Summary Trigona ransomware is a sophisticated and evolving threat that leverages vulnerabilities, legitimate tools, and double extortion tactics to target organizations, particularly in the technology and healthcare sectors. Collaboration with other threat actors like ALPHV enhances its capabilities…
ESET Research has recorded a considerable increase in AceCryptor attacks, with detections tripling between the first and second halves of 2023. In recent months, researchers registered a significant change in how AceCryptor is used, namely that the attackers spreading Rescoms (also known as Remcos)…
Hackers hijacked the official contact email for the Belgian Grand Prix event and used it to lure fans to a fake website promising a €50 gift voucher. The Spa Gran Prix is a Formula 1 World Championship race held at the Circuit de Spa-Francorchamps in Stavelot, Belgium. This year, the race…