Tag: HUNT

### #RansomwareEvolution #BlackBasta #CyberThreatCoordination

Summary: The Russian-language ransomware landscape is evolving, with the emergence of the BlackBasta group adapting to law enforcement actions and potentially collaborating with state actors. Analysts warn of increasing sophistication in attacks, particularly through social engineering tactics.

Threat Actor: BlackBasta | BlackBasta Victim: Healthcare Sector | healthcare sector

Key Point :

BlackBasta has rapidly adapted its tactics following the takedown of major botnets like Qakbot, pivoting to new tools like Pikabot.…
Read More
Summary: In a recent analysis, the suspected Chinese cyber-espionage group DarkPeony has been linked to the use of SSL/TLS certificates associated with PlugX command and control nodes. The investigation revealed multiple suspicious certificates and domains, indicating a persistent operational pattern. This post aims to provide insights for defenders to identify and mitigate potential threats from this group.…
Read More
Summary: This article discusses a recent deployment of the XenoRAT malware, which has shifted its delivery method to Excel XLL files, utilizing the Excel-DNA framework and enhanced protection through ConfuserEx. This change indicates a broader targeting strategy aimed at enterprise networks rather than individual users. The analysis highlights the need for vigilance against evolving tactics in malware deployment.…
Read More
📡 1st Security News RSS feed

Our goal is to help make your world a safer place showcasing the latest in security news, products and services. An online global portal we offer a simple translation feature in 45 languages, informing thousands of security professionals and keeping them up to speed on the latest advances in the industry.…

Read More
📡 Acunetix | Web Security Blog RSS feed

Acunetix is a Web Vulnerability Scanner, that automates web application security testing and audits your web applications by checking for exploitable hacking vulnerabilities. Keep up with articles, tips and general news on web security.

URL: https://www.acunetix.com/blog/feed/ 📝

📡 Adam Levin RSS feed

AdamLevin.com…

Read More

Summary: In April 2024, BlackBerry reported significant advancements in the LightSpy malware campaign, attributed to APT41, which introduced a new modular surveillance framework named DeepData, enhancing its data theft capabilities. This evolution includes sophisticated plugins for extensive data collection and improved command-and-control infrastructure, targeting various communication platforms and sensitive information.…

Read More

Summary: Security researchers from Hunt.io have identified a cyber operation utilizing the Sliver command-and-control framework and Ligolo-ng tunneling tool, targeting victims by impersonating Y Combinator. The operation highlights the evolving tactics of cybercriminals leveraging trusted brands to establish credibility and evade detection.

Threat Actor: Cybercriminals | cybercriminals Victim: Y Combinator | Y Combinator

Key Point :

The attackers registered a domain mimicking Y Combinator to deflect suspicion and establish a facade of authenticity.…
Read More

Summary:

The article discusses the Sliver framework, a versatile command-and-control (C2) tool adopted by cybercriminals and nation-state actors for stealth operations. It highlights its core capabilities, adoption by threat actors, and the challenges in detecting its use. Additionally, it covers the Ligolo-ng tool, which facilitates secure internal network access, and details specific infrastructure linked to these tools, including IP addresses and a malicious file.…
Read More

Summary: This blog post discusses phishing techniques used by the threat actor 0ktapus to compromise cloud identities and outlines methods for investigating phishing campaigns. It provides a comprehensive framework for identifying phishing infrastructure and highlights the importance of ongoing vigilance in cybersecurity practices.

Threat Actor: 0ktapus | 0ktapus Victim: Various organizations | various organizations

Key Point :

0ktapus employs sophisticated phishing techniques, including smishing, vishing, and MFA fatigue, to target IT service desk workers and gain access to cloud environments.…
Read More

Summary:

Phishing remains a prevalent tactic among threat actors, particularly in targeting cloud identities. This article explores various investigative techniques for analyzing phishing campaigns, with a focus on the 0ktapus threat actor. By examining their methods and infrastructure, the post aims to provide insights into detecting and mitigating future phishing attempts.…
Read More

Summary:

Earth Estries employs sophisticated attack chains utilizing various malware, including Zingdoor and Snappybee, to exploit vulnerabilities in systems like Microsoft Exchange servers. Their tactics involve maintaining persistence, lateral movement, and data exfiltration through a combination of custom tools and established malware.

Keypoints:

Earth Estries targets government and tech sectors since at least 2020.…
Read More

Summary: GootLoader has evolved from a tool used by cybercriminals to an initial access-as-a-service platform, facilitating the deployment of information stealers and ransomware through SEO poisoning techniques. Recent investigations have uncovered a new variant of GootLoader, showcasing its sophisticated methods of delivering malicious payloads via compromised websites.…

Read More

Summary:

This article examines RunningRAT, a remote access trojan (RAT) that has recently been observed deploying crypto mining payloads. Initially recognized for its remote access and data-stealing capabilities, RunningRAT’s new use case highlights an evolution in its operational tactics. The analysis covers its infrastructure, delivery methods, and command-and-control (C2) techniques, revealing its presence in open directories and potential implications for cybersecurity.…
Read More

Summary:

GootLoader has evolved into an initial access as a service platform, primarily used by cybercriminals to deliver GootKit, a sophisticated info stealer and remote access Trojan. Utilizing SEO poisoning techniques, GootLoader entices victims to download malicious payloads disguised as legitimate files, leading to further exploitation and potential ransomware deployment.…
Read More

Summary:

The U.S. Office of Public Affairs announced the seizure of 32 websites linked to the “Doppelganger” campaign, suspected to be a Russian-sponsored cyberpropaganda effort targeting the U.S. and other nations. The seized domains were primarily used for distributing fake news and disinformation, with a significant number of them mimicking legitimate news sources.…
Read More