LastPass Password Manager with 25 Million Users Hacked
Blog LastPass, one of the world’s largest password managers, has confirmed that it has been hacked. The company revealed that threat actors stole some of the company’s source code and some proprietary LastPass technical information. It was also stated that there is no evidence yet that this incident involved any access to customer data or […]
The fake ‘Internet Download Manager’ Chrome Extension Has Been Downloaded Over 200,000 Times
Blog The adware ‘Internet Download Manager’ Google Chrome extension has been installed by more than 200,000 users. According to reviews, this extension has been on the Chrome Web Store since June 2019. The extension has been observed to exhibit undesirable behavior. For example, opening links to spammy sites, changing the default browser search engine. According […]
Chinese Threat Actors APT40 Targets Energy Sector in Australia and the South China Sea
Blog The Chinese state-owned threat actor, APT40, targets Australian government agencies, Australian media companies and manufacturers that maintain wind turbine fleets in the South China Sea. Cybersecurity firm Proofpoint, which works in collaboration with PwC, said the threat actor sent phishing emails impersonating the latest campaigns, fake Australian Morning News and Australian media outlets. The […]
Akira: Undetectable Stealer Unleashed
Blog Introduction A new Stealer named Akira has been put up for sale on Telegram. It has the following features: Password grabber Cookies grabber Bookmarks grabber Crypto wallets and 2fa extensions dump (Grabs 💸 Zcash, 🚀 Armory, 📀 Bytecoin, 💵 Jaxx, 💎 Exodus desktop/extension, 📉 Ethereum, 🔨 Electrum, 🕹 AtomicWallet, 💹 Guarda, ⚡️ Coinbase, 🦊 […]
TA558 APT Group Uses Malicious Microsoft Compiled HTML Help Files
Blog Who is TA558? TA558, a financially-motivated cybercrime group, has been targeting the hospitality, travel, and related industries located in Latin America, North America, and Western Europe since 2018. The group sends malicious emails in Portuguese, Spanish, and sometimes English, using lures related to reservations and business themes such as hotel bookings. The emails may […]
Phishing Attack Targeting Turkish Companies
Blog Phishing mail targeting Turkish companies has been detected. Mail attachment contains an RFQ file. Normally, a request for quotation (RFQ) is a company’s document to request pricing and packaging information from a potential supplier. This RFQ-looking file is actually a RAR file. It contains a malicious EXE file that is simply a Keylogger and […]
What is “Cyber Threat”?
Blog The “cyber threat” refers to actions that are deemed malicious and are carried out deliberately or inadvertently by; hackers, criminals, business rivals, spies, dissatisfied workers, organized crime groups, and hactivist societies, in order to obtain unauthorized access, interrupt infrastructure, intercept classified data, and/or share data with third parties. Phishing, 0-day attacks, APT (Advanced Persistent […]
Who is DarkSide Ransomware Group?
Blog Who is DarkSide Ransomware Group? FBI claims attack on the Colonial Pipeline has been attributed to DarkSide Ransomware, a kind of new ransomware family that emerged on the crimeware market at the beginning of November 2020. DarkSide is a Ransomware-as-a-Service with the stated goal of targeting ‘large corporations.’ They are primarily focused on recruiting […]
REvil Ransomware Malware Analysis
Blog 1. Overall Summary The REvil (also known as Sodinokibi) is a Ransomware-as-a-Service (RaaS). The first attack of REvil in the middle of April 2019, got huge attention from the Cyber Security world due to sharing many similarities with GandCrab Ransomware and the distribution techniques of ransomware they are using such as exploit kits, scan […]
PetitPotam (MS-EFSRPC) Exploit – CVE2021-36942
Blog PetitPotam (MS-EFSRPC) Exploit – Summary PetitPotam Exploit needs Active Directory Certificate Services, specifically the default settings behind the Web Enrollment service because of this Vulnerability. Adversaries can achieve full Domain Admin (DC) takeover of a target Active Directory by using PetitPotam, which takes attention among Ransomware Gangs, they are able to use this Vulnerability […]