Collaborate Disseminate
Researchers have exposed a new targeted email campaign aimed at French entities in the construction, real estate, and government sectors that leverages the Chocolatey Windows package manager to deliver a backdoor called Serpent on compromised systems…. Continue reading New Backdoor Targets French Entities via Open-Source Package Installer
A financially motivated threat actor has been observed deploying a previously unknown rootkit targeting Oracle Solaris systems with the goal of compromising Automatic Teller Machine (ATM) switching networks and carrying out unauthorized cash withdrawa… Continue reading Hackers Target Bank Networks with new Rootkit to Steal Money from ATM Machines
An analysis of two ransomware attacks has identified overlaps in the tactics, techniques, and procedures (TTPs) between BlackCat and BlackMatter, indicating a strong connection between the two groups.
While it’s typical of ransomware groups to rebrand… Continue reading Experts Find Some Affiliates of BlackMatter Now Spreading BlackCat Ransomware
Google’s Threat Analysis Group (TAG) took the wraps off a new initial access broker that it said is closely affiliated to a Russian cyber crime gang notorious for its Conti and Diavol ransomware operations.
Dubbed Exotic Lily, the financially motivate… Continue reading Google Uncovers ‘Initial Access Broker’ Working with Conti Ransomware Gang
ASUS routers have emerged as the target of a nascent botnet called Cyclops Blink, almost a month after it was revealed the malware abused WatchGuard firewall appliances as a stepping stone to gain remote access to breached networks.
According to a new… Continue reading New Variant of Russian Cyclops Blink Botnet Targeting ASUS Routers
In what’s an act of deliberate sabotage, the developer behind the popular “node-ipc” NPM package shipped a new tampered version to condemn Russia’s invasion of Ukraine, raising concerns about security in the open-source and the software supply chain.
… Continue reading Popular NPM Package Updated to Wipe Russia, Belarus Systems to Protest Ukraine Invasion
The malware known as DirtyMoe has gained new worm-like propagation capabilities that allow it to expand its reach without requiring any user interaction, the latest research has found.
“The worming module targets older well-known vulnerabilities, e.g…. Continue reading DirtyMoe Botnet Gains New Exploits in Wormable Module to Spread Rapidly
A newly disclosed security vulnerability in the Kubernetes container engine CRI-O called cr8escape could be exploited by an attacker to break out of containers and obtain root access to the host.
“Invocation of CVE-2022-0811 can allow an attacker to p… Continue reading New Vulnerability in CRI-O Engine Lets Attackers Escape Kubernetes Containers
Microsoft on Wednesday detailed a previously undiscovered technique put to use by the TrickBot malware that involves using compromised Internet of Things (IoT) devices as a go-between for establishing communications with the command-and-control (C2) s… Continue reading TrickBot Malware Abusing MikroTik Routers as Proxies for Command-and-Control
The Security Service of Ukraine (SBU) said it has detained a “hacker” who offered technical assistance to the invading Russian troops by providing mobile communication services inside the Ukrainian territory.
The anonymous suspect is said to have broa… Continue reading Ukraine Secret Service Arrests Hacker Helping Russian Invaders