Category Archives: Web Shell

Hackers with Chinese links breach defense, energy targets, including one in US

Posted on by

Suspected spies using similar tools and tactics to a Chinese government-connected hacking group compromised nine organizations in the defense, education, energy and health care industries across the globe beginning in September, according to new research. The hackers were “indiscriminate” in targeting that included parts of the U.S. Defense Department, according to Palo Alto Networks, which published its findings on Sunday with an assist from the National Security Agency’s Cybersecurity Collaboration Center. That center primarily works with defense contractors to collect and share threat information. At least one of the victims was a U.S. organization, Palo Alto Networks said, but didn’t name the nine compromised entities. The company “believes that the actor’s primary goal involved gaining persistent access to the network and the gathering and exfiltration of sensitive documents from the compromised organization.” The research comes on the heels of a Sept. 16 warning from the Department of Homeland Security’s Cybersecurity […]

The post Hackers with Chinese links breach defense, energy targets, including one in US appeared first on CyberScoop.

Continue reading Hackers with Chinese links breach defense, energy targets, including one in US→

Coinminers, web shells and ransomware made up 56% of malware targeting Linux systems in H1 2021

Posted on by

Trend Micro released a research on the state of Linux security in the first half of 2021. The report gives valuable insight into how Linux operating systems are being targeted as organizations increase their digital footprint in the cloud and the perva… Continue reading Coinminers, web shells and ransomware made up 56% of malware targeting Linux systems in H1 2021→

ProxyShell vulnerabilities actively exploited to deliver web shells and ransomware

Posted on by

Three so-called “ProxyShell” vulnerabilities are being actively exploited by various attackers to compromise Microsoft Exchange servers around the world, the Cybersecurity and Infrastructure Security Agency (CISA) warned over the weekend. T… Continue reading ProxyShell vulnerabilities actively exploited to deliver web shells and ransomware→

Cyber intrusion activity volume jumped 125% in H1 2021

Posted on by

The volume of cyber intrusion activity globally jumped 125% in the first half of 2021 compared with the same period last year, according to the Cyber Investigations, Forensics & Response (CIFR) mid-year update from Accenture. Cyber intrusion activ… Continue reading Cyber intrusion activity volume jumped 125% in H1 2021→

FBI removes web shells from hacked Microsoft Exchange servers

Posted on by

Authorities have executed a court-authorized operation to copy and remove malicious web shells from hundreds of vulnerable on-premises versions of Microsoft Exchange Server software in the United States. Through January and February 2021, certain hacki… Continue reading FBI removes web shells from hacked Microsoft Exchange servers→

With court order, FBI removes hundreds of Exchange Server web shells from US organizations

Posted on by

The FBI has used a court order to remove malicious code from hundreds of U.S. computers running the Microsoft Exchange Server email program, Justice Department officials announced Tuesday. The court-ordered removal of the web shells, or scripts used by hackers for persistent access, is one of the most aggressive actions taken yet by U.S. government officials or corporate executives to combat the Exchange Server vulnerabilities since Microsoft announced on March 2 that suspected Chinese spies were exploiting them. The alleged Chinese hackers used the flaws to steal emails from targeted organizations, according to private-sector analysts, but an array of scammers have since exploited the bugs for their own purposes. In the days after Microsoft revealed the vulnerabilities, incident responders estimated that tens of thousands of U.S. organizations running Exchange Server could be exposed to potential hacking. Many of those organizations have removed the web shells, but Justice Department officials said […]

The post With court order, FBI removes hundreds of Exchange Server web shells from US organizations appeared first on CyberScoop.

Continue reading With court order, FBI removes hundreds of Exchange Server web shells from US organizations→

Web shell malware continues to evade many security tools

Posted on by

Cyber attackers are increasingly leveraging web shell malware to get persistent access to compromised networks, the US National Security Agency and the Australian Signals Directorate warn. What are web shells? Web shells are malicious scripts that are … Continue reading Web shell malware continues to evade many security tools→

How the suspected Equifax hackers covered their tracks

Posted on by

Even for U.S. law enforcement, the Equifax hack was different. Unlike in previous examples of apparent Chinese government-backed cyber-operations, the hackers behind the Equifax breach stymied police for months. After the Office of Personnel Management hack in 2015, and the Marriott breach which was disclosed in 2018, investigators were confident enough that China was involved to tell the Wall Street Journal and New York Times about their suspicions soon afterward. With Equifax, the search for who was responsible was remarkably harder. Data stolen from the credit monitoring firm hadn’t appeared for sale on criminal forums, a possible indication of a nation-state’s involvement. And while the trove of financial information would certainly be useful to foreign intelligence agencies, using forensic data to validate that theory would prove to be a tall order. The charges announced Monday outline a conspiracy to not only steal a massive trove of information on 145 million Americans […]

The post How the suspected Equifax hackers covered their tracks appeared first on CyberScoop.

Continue reading How the suspected Equifax hackers covered their tracks→

2nd Breach at Verticalscope Impacts Millions

Posted on by

For the second time in as many years, hackers have compromised Verticalscope.com, a Canadian company that manages hundreds of popular Web discussion forums totaling more than 45 million user accounts. Evidence of the breach was discovered just before someone began using that illicit access as a commercial for a new paid search service that indexes consumer information exposed in corporate data breaches. Continue reading 2nd Breach at Verticalscope Impacts Millions→