K7Labs analysed a Python-based ransomware called Evil Ant that is packed with PyInstaller, hides its UI, escalates privileges, disables Windows Defender, and sends system details to a Telegram bot before encrypting files with a Fernet key. The sample contains …
Darktrace investigated multiple Pikabot loader campaigns in 2023 that used malspam, cURL/PowerShell downloads, and rapid C2 communications to enable multi-stage intrusions leading to Cobalt Strike and Black Basta activity. Fast network detection (DETECT) and S…
Established in 1995, Indonesia Power, formerly known as PT Pembangkitan Jawa Bali I, operates through its 127 power plants, with a total capacity of 8.888 MW. Indonesia Power is headquartered in South Jakarta and is the largest electricity Power Generating Company
Web browsers are some of the programs most commonly and frequently used by PC users. Users generally use browsers to look up information, send and receive emails, and use web services such as shopping. This is the case for both individual users and employees conducting business in companies. To use these…
North Korea-linked threat group Kimsuky has adopted a longer, eight-stage attack chain that abuses legitimate cloud services and employs evasive malware to conduct cyber espionage and financial crimes against South Korean entities.In a campaign dubbed “DEEP#GOSU,” which is attributed to the group, t…
Insikt Group uncovers ties between I-SOON and multiple Chinese state-sponsored cyber groups like RedAlpha and RedHotel.
The 2008 Russo-Georgian War marked a turning point: the first time cyberattacks were used alongside traditional warfare. But what happens when the attackers aren’t soldiers, but ordinary citizens? This episode delves into the ethical and legal implications of civilian participation in cyberwarfare, examining real-world examples from Ukraine and beyond….
A threat actor is purportedly selling unauthorized Remote Desktop Protocol (RDP) access to a prominent American law firm. With an annual revenue estimated between $400 to $500 million, the law firm presents an enticing target for cybercriminals. The threat actor asserts access to critical servers, i…
Research shows that legacy web2 components (APIs, containers, cloud services) integrated into web3 systems create exploitable attack surfaces, demonstrated by multiple vulnerabilities in the Dappnode node management framework that allowed remote takeover and V…
AhnLab SEcurity intelligence Center (ASEC) recently discovered the Andariel group’s continuous attacks on Korean companies. It is notable that installations of MeshAgent were found in some cases. Threat actors often exploit MeshAgent along with other similar remote management tools because it offers diverse remote control features. The Andariel group exploited Korean…
In the past two decades, at least 41 advanced persistent threat (APT) groups have launched attacks on entities and organizations based in North America.
Hundreds of websites misconfigured Google Firebase, leaking more than 125 million user records, including plaintext passwords, security researchers warn. It all started with the hacking of Chattr, a US-based AI hiring system.
Overview SonicWall Capture Labs threat research team has observed a new variant of WhiteSnake Stealer. This stealer poses significant risks to users and organizations as it can steal critical sensitive data from compromised systems, including […]
This investment round, led by Riverwood Capital with contributions from Silver Lake Waterman and Advent, bolsters BigID’s efforts in data hygiene and securing sensitive data access.
In filings with regulators in Maine and California, the company said it discovered a cybersecurity incident on December 30 that prompted an investigation. Law enforcement and other governmental agencies were notified of the cyberattack.