SentinelLabs and QGroup describe attacks in Q1 2023 against Middle East telecoms, linked to the Operation Soft Cell activity and likely conducted by a Chinese cyberespionage group in the Gallium/APT41 nexus. The operation centers on mim221, a maintained creden…
Earth Preta has updated its TTPs across campaigns to bypass security solutions, introducing new tools like TONEINS, TONESHELL, PUBLOAD, and NUPAKAGE. The campaign relies on decoy documents, Google Drive links, and password-protected archives to evade detection…
Warning for Microsoft Office Outlook Privilege Escalation Vulnerability (CVE-2023-23397) – ASEC BLOG
Microsoft has disclosed a privileged escalation vulnerability in Outlook for Windows (CVE-2023-23397) used to steal NTLM credentials via a crafted Reminder alert. The issue can be exploited by a malicious email that forces authentication to a threat actor-cont…
InQuest Labs analyzed a credential phishing campaign targeting a municipal government, tracing a sequence from a compromised sender to a cloud-hosted phishing infrastructure. The attacker used Raven cloud hosting and Microsoft Azure blob storage to lure victim…
Cyber espionage threat actors continue to target technologies that do not support endpoint detection and response (EDR) solutions such as firewalls, IoT devices, hypervisors and VPN technologies (e.g. Fortinet, SonicWall, Pulse Secure, and others). Mandiant has investigated dozens of intrusions at defense industrial base (DIB), government, technology, and telecommunications organizations over…
Mandiri Sekuritas merupakan mitra investasi tepercaya yang menyediakan solusi pasar modal komprehensif dengan beragam produk dan layanan unggulan
Rapid7 observed active exploitation of Adobe ColdFusion across multiple customer environments beginning in January 2023, leveraging CVE-2023-26360 and related ColdFusion vulnerabilities for initial access. The campaign involves dropping web shells, encoding Po…
Zscaler ThreatLabz analyzes APT37 (ScarCruft/Temp.Reaper), a North Korea-based threat actor targeting South Korean organizations, with activity noted in early 2023. The investigation reveals a GitHub leak exposing a wealth of malicious payloads and multiple at…
Emotet now delivers payloads via OneNote attachments in spam emails, moving away from ZIP-based delivery and introducing a dropper that uses Windows Script File (WSF) with regsvr32 to execute the payload. The campaign downloads Emotet payloads from multiple UR…
SideCopy APT, a Pakistan-based actor active since 2019, targets South Asia with a multi-stage infection chain that leverages LNK and HTA loaders to deploy DLLs and final payloads. The campaign against India’s DRDO demonstrates DLL side-loading, anti-virus evas…
Malware authors continually tweak techniques to evade automated detection, prompting tailored sandboxing approaches like dependency emulation and VMI-based SSL/TLS traffic decryption to improve detonation and visibility. Palo Alto Networks highlights how adapt…
Trigona is a newly observed ransomware strain that security researchers first noted in Oct 2022 and was highly active in Dec 2022 with at least 15 victims across multiple industries. The operation uses HTML Application ransom notes with embedded JavaScript con…
CYFIRMA researchers identified a sample named ALC Ransomware that masquerades as ransomware but functions as scareware, since it does not encrypt files. The malware locks the screen, disables Task Manager, drops multiple files, and delivers a ransom note while…
Two sentences summarizing the content: A new Magecart skimmer family named Kritec has been discovered on Magento stores, appearing alongside a separate skimming campaign and sharing indicators of compromise with older campaigns. Kritec loads its malicious Java…
JFrog Security Research uncovered a sophisticated NuGet-based campaign targeting .NET developers, employing typosquatting and deceptive metadata to push a PowerShell-based dropper that downloads a second-stage Impala payload. The attack demonstrates how NuGet …