Kaspersky: NSA worker’s computer was packed with malware

As Kaspersky Lab faces accusations that its software allowed spying on classified U.S. documents, the Russian cybersecurity firm published the results of an internal investigation Thursday claiming an NSA worker who took classified documents home had a personal computer overwhelmed with malware. Other than a trove of NSA hacking tools, the unidentified NSA worker’s computer had 121 malicious files, including at least one backdoor created by a Russian criminal hacker, the firm concluded. Kaspersky said its antivirus software must have been disabled on the machine in order to allow the backdoor, known as Mokes, to run. The individual NSA worker has not been named publicly but is currently going through legal processes, according to U.S. officials. Kaspersky has been the focus of multiple congressional hearings. It was recently banned from civilian and military federal networks by a Department of  Homeland Security directive. The possibility of legal action by the Moscow-based company looms over the ongoing […]

The post Kaspersky: NSA worker’s computer was packed with malware appeared first on Cyberscoop.

Continue reading Kaspersky: NSA worker’s computer was packed with malware

Kaspersky Says Its Hand Was in the Cookie Jar, But …

Kaspersky Lab has been bombarded with an unending stream of claims that its Russian roots equate to being part of the Russian national team when it comes to national security interests. We previously discussed the rationale behind the ban of Kaspersky Lab security products in any U.S. government device, and how the company is believed..

The post Kaspersky Says Its Hand Was in the Cookie Jar, But … appeared first on Security Boulevard.

Continue reading Kaspersky Says Its Hand Was in the Cookie Jar, But …

Updates to Sofacy, Turla Highlight 2017 Q2 APT Activity

Attackers behind APT campaigns have kept busy in Q2 2017, adding new ways to bypass detection, crafting new payloads to drop, and identifying new zero days and backdoors to help them infect users and maintain persistence on machines.

Continue reading Updates to Sofacy, Turla Highlight 2017 Q2 APT Activity

Shadow Brokers return to taunt U.S. government after ransomware spread

A mysterious group known for publishing highly classified computer code developed by the National Security Agency returned to the limelight Tuesday with a cryptic message concerning the future release of other government hacking tools and secretive information, including “network data from Russian, Chinese, Iranian, and North Korean nuclear missile programs.” “TheShadowBrokers is having many more where coming from?” a lengthy message posted Tuesday morning by the peculiar group reads, claiming they own “75% of U.S. cyber arsenal.” The message also cites the Equation Group, which has been observed operating in the wild by cybersecurity firm Kaspersky Lab and is believed to associated with an elite hacking unit within the NSA. “This is theshadowbrokers way of telling theequationgroup ‘all your bases are belong to us.’ TheShadowBrokers is not being interested in stealing grandmothers’ retirement money. This is always being about theshadowbrokers vs theequationgroup.” Since the Shadow Brokers posted their first message to […]

The post Shadow Brokers return to taunt U.S. government after ransomware spread appeared first on Cyberscoop.

Continue reading Shadow Brokers return to taunt U.S. government after ransomware spread

ShadowBrokers Planning Monthly Exploit, Data Dump Service

The latest rant from the ShadowBrokers ends with news of a subscription service starting in June that will leak exploits and stolen data to paying customers. Continue reading ShadowBrokers Planning Monthly Exploit, Data Dump Service

Ransomware, Cyberespionage Dominate Verizon DBIR

Verizon’s Data Breach Investigations Report for 2017 shows big growth in the reported number of ransomware attacks and incidents involving cyberespionage. Continue reading Ransomware, Cyberespionage Dominate Verizon DBIR

NSA’s DoublePulsar Kernel Exploit In Use Internet-Wide

Scans show tens of thousands of Windows servers infected with the DoublePulsar kernel exploit leaked by the ShadowBrokers two weeks ago. Continue reading NSA’s DoublePulsar Kernel Exploit In Use Internet-Wide