Collaborate Disseminate
APT StormBamboo compromised a undisclosed internet service provider (ISP) to poison DNS queries and thus deliver malware to target organizations, Volexity researchers have shared. Malware delivery via automatic software updates StormBamboo (aka Evasive… Continue reading Chinese hackers compromised an ISP to deliver malicious software updates
Kaspersky discovered a new APT CloudSorcerer targeting Russian government entities and using cloud services as C2, just like the CloudWizard actor. Continue reading CloudSorcerer – A new APT targeting Russian government entities
Elite state-backed hackers are embracing the use of ransomware to obfuscate their operations.
The post Chinese hackers are increasingly deploying ransomware, researchers say appeared first on CyberScoop.
Continue reading Chinese hackers are increasingly deploying ransomware, researchers say
The open-source Rafel RAT is being leveraged by multiple threat actors to compromise Android devices and, in some cases, to lock them, encrypt their contents, and demand money to restore the device to its original state. Check Point researchers have ob… Continue reading Open-source Rafel RAT steals info, locks Android devices, asks for ransom
In this article, we analyze XZ backdoor behavior inside OpenSSH, after it has achieved RSA-related function hook. Continue reading XZ backdoor: Hook analysis
The ongoing operation claims international organizations and the defense industry as its victims, per authorities.
The post Chinese cyber espionage campaign targets ‘dozens’ of Western governments, Dutch officials say appeared first on CyberScoop.
Sophos released its report, “Operation Crimson Palace: Threat Hunting Unveils Multiple Clusters of Chinese State-Sponsored Activity Targeting Southeast Asia,” which details a highly sophisticated, nearly two-year long espionage campaign against a high-… Continue reading Chinese attackers leverage previously unseen malware for espionage
Microsoft has named yet another state-aligned threat actor: Moonstone Sleet (formerly Storm-1789), which engages in cyberespionage and ransomware attacks to further goals of the North Korean regime. “Moonstone Sleet uses tactics, techniques, and … Continue reading Moonstone Sleet: A new North Korean threat actor
We analyze the tactics and techniques of attackers targeting organizations through trusted relationships – that is, through contractors and external IT service providers. Continue reading Trusted relationship attacks: trust, but verify
The report features the most significant developments relating to APT groups in Q1 2024, including the new malware campaigns DuneQuixote and Durian, and hacktivist activity. Continue reading APT trends report Q1 2024