Analysts from Sekoia.io and Orange Cyberdefense delve into the phenomenon of RESIP, explore the actual market landscape, which is composed of multiple shady providers, and explain how cyber threat actors abuse or even directly provide such services.

Attackers are using Docker Hub for malicious campaigns of various types, including spreading malware, phishing and scams. Read the analysis of 3 malware campaigns.

State officials from Lithuania and Estonia are among those raising the alarm about Russian interference with navigation signals.

Julius Kivimäki threatened thousands of patients he would publish details of their therapy sessions.

Kandji's threat research team has discovered a piece of malware that combines aspects of an infostealer and spyware. Here's how it works.

Les entreprises de transport investissent massivement dans la sécurité contre les cyberattaques, notamment les CFF, ciblés par des hackers russes.

The global attacker median dwell time continued trending downwards in 2023, and is now 10 days (from 16 days in the previous year).

• In late August 2023, we observed an intrusion that started with a phishing campaign using PrometheusTDS to distribute IcedID.
• IcedID dropped and executed a Cobalt Strike beacon, which was then used through-out the intrusion.
• The threat actor leveraged a bespoke PowerShell tool known as AWScollector to facilitate a range of malicious activities including discovery, lateral movement, data exfiltration, and ransomware deployment.
• Group Policy was used to distribute Cobalt Strike beacons at login to a specific privileged user group.
• The threat actor utilized a suite of tools to support their activities, deploying Rclone, Netscan, Nbtscan, AnyDesk, Seatbelt, Sharefinder, and AdFind.
• This case had a TTR (time to ransomware) of 29 days.

Since the very first iPhone, the walls of Apple’s meticulously manicured garden have grown ever higher. Now, they’re starting to crumble.

Hackers have started to target a critical severity vulnerability in the WP Automatic plugin for WordPress to create user accounts with administrative privileges and to plant backdoors for long-term access.

Okta warns of an "unprecedented" spike in credential stuffing attacks targeting its identity and access management solutions, with some customer accounts breached in the attacks.

A few months ago, I wrote about a rumor that TheFloW‘s yet-to-be-disclosed PS4/PS5 Kernel exploit was relying on an 18 year old vulnerability. What sounded like an obvious troll initially, then looked more and...

After leaking the entire database of Chivo users in early April, the hacker group CiberInteligenciaSV started releasing the wallet’s code.

We analyzed third-party keyboard apps Tencent QQ, Baidu, and iFlytek, on the Android, iOS, and Windows platforms. Along with Tencent Sogou, they comprise over 95% of the market share for third-party keyboard apps in China. This is an FAQ for the full report titled "The not-so-silent type: Vulnerabilities across keyboard apps reveal keystrokes to network eavesdroppers."

ArcaneDoor is a campaign that is the latest example of state-sponsored actors targeting perimeter network devices from multiple vendors. Coveted by these actors, perimeter network devices are the perfect intrusion point for espionage-focused campaigns.

Learn about our process for collecting telemetry data from PlugX worm-infected workstations, as well as how to disinfect them.
#2024 #EN #PlugX #Sinkhole #USB #botnet #sekoia #worm

A draft proposal, offered ahead of European elections in June, reportedly would allow the EU to impose tougher restrictions on individuals and entities involved in Russia-backed influence operations worldwide.

Sources suspect China is behind the targeted exploitation of two zero-day vulnerabilities in Cisco’s security appliances.

CRIL investigates DragonForce Ransomware and its links to a leaked LOCKBIT Builder.

The Trellix Advanced Research Center has recently observed an uptick of LockBit-related cyber activity surrounding vulnerabilities in ScreenConnect. This surge suggests that despite the Law Enforcement's (LE) "Operation Cronos" aimed at dismantling LockBit's infrastructure, the ransomware operators somehow managed to survive and stay a float. It appears that the cybercriminals group behind LockBit ransomware partially restored their infrastructure and created an impression that the LE actions did not affect their normal operation. Concurrently, alongside the resurgence of LockBit's exploitation of ScreenConnect vulnerabilities, we have seen other threat actors have either impersonated LockBit ransomware or incorporated LockBit into their own cyber attack campaigns.