Security Affairs

APRIL 22, 2024

Microsoft has observed APT28 using GooseEgg in post-compromise activities against various targets, including government, non-governmental, education, and transportation sector organizations in Ukraine, Western Europe, and North America. This tool modifies a JavaScript constraints file and executes it with SYSTEM-level permissions.

Military 355

Military File names Education Phishing 355

Security Affairs

OCTOBER 27, 2021

The Evil Corp cybercrime group (aka the Dridex gang Indrik Spider , the Dridex gang, and TA505 ) has been active in cybercrime activities since 2007. The US Government announced sanctions for ransomware negotiation firms that will support victims of the Evil Corp group in the ransom payments.

Ransomware 346

Ransomware Government IT Security 346

Security Affairs

FEBRUARY 20, 2020

Britain and the United governments blame Russia for being behind a destructive cyber attack that hit Georgia during 2019. The governments of Britain and the US declared that Russia’s military intelligence service GRU is behind the massive cyber attack that hit Georgia during 2019. ” said the Foreign Secretary Dominic Raab.

Military 346

Military IT Government Encryption 346

Security Affairs

JUNE 3, 2024

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , BlueDelta, and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Insikt Group speculates the operation is aimed at influencing regional and military dynamics.

Military 351

Military Phishing Government Authentication 351

Security Affairs

NOVEMBER 28, 2021

The cybersurveillance equipment was used by the Egyptian government to track down opponents. A weapon of choice for authoritarian governments.” The software allowed the government to identify and arrest more than 40,000 political opponents. “In short, Cerebro can suck up any data that is not encrypted.

Sales 337

Sales Government Encryption Communications 337

Security Affairs

FEBRUARY 26, 2024

Recently the leak of a collection of files apparently stolen from the Chinese government hacking contractor, I-Soon, exposed Chinese hacking capabilities. i-SOON is a prominent contractor for various agencies of the Chinese government, including Ministry of Public Security, Ministry of State Security, and the People’s Liberation Army.

Government 331

Government IoT Marketing Data breaches 331

Security Affairs

OCTOBER 21, 2021

The Evil Corp cybercrime group (aka the Dridex gang Indrik Spider , the Dridex gang, and TA505 ) has been active in cybercrime activities since 2007. The US Government announced sanctions for ransomware negotiation firms that will support victims of the Evil Corp group in the ransom payments.

Ransomware 353

Ransomware File names Encryption Government 353

Security Affairs

APRIL 8, 2022

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. The group was involved also in the string of attacks that targeted 2016 Presidential election.

Military 337

Military Government Phishing Security 337

Security Affairs

AUGUST 13, 2020

” The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. , which translates to “to fell”, or “to chop.”

Military 358

Military IoT Phishing Government 358

Security Affairs

AUGUST 29, 2020

This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems. Government refers to this team as BeagleBoyz, who represent a subset of HIDDEN COBRA activity.” ” reads the alert.

Access 357

Access Government Ransomware Cybersecurity 357

Security Affairs

DECEMBER 7, 2023

Over the past 20 months, the group targeted at least 30 organizations within 14 nations that are probably of strategic intelligence significance to the Russian government and its military. The Government experts pointed out that in some cases the group did not deployed any backdoor in the compromised systems.

Military 331

Military Government Phishing Authentication 331

Security Affairs

OCTOBER 29, 2020

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations.

Cybersecurity 348

Cybersecurity Government Security IT 348

Security Affairs

JUNE 10, 2021

The intrusion was uncovered by the Dutch intelligence service AIVD, the government experts discovered that a Dutch police IP address was connecting to servers operated by Russia-linked APT. The group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide.

Military 309

Military Government Ransomware Security 309

Security Affairs

OCTOBER 8, 2021

Shane Huntley, the head of the Threat Analysis Group (TAG), wrote on Twitter that his group had sent an above-average batch of government-backed security warnings. . TAG sent a above average batch of government-backed security warnings yesterday. So why do we do these government warnings then? ” Huntley added. “At

Phishing 271

Phishing Military Government Security 271

Security Affairs

DECEMBER 5, 2023

In recent attacks spotted by Microsoft’s Threat Intelligence, the nation-state actors primarily targeted government, energy, transportation, and non-governmental organizations in the US, Europe, and the Middle East. The group was involved also in the string of attacks that targeted 2016 Presidential election.

Military 318

Military Government Access Phishing 318

Security Affairs

MARCH 13, 2020

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. ” reads the analysis published by ESET.

Archiving 363

Archiving Government Communications IT 363

Security Affairs

JANUARY 18, 2022

A sophisticated threat actor, tracked as Earth Lusca, is targeting government and private organizations worldwide as for financial purposes. The Winnti group was first spotted by Kaspersky in 2013, but according to the researchers the gang has been active since 2007.

Healthcare 339

Healthcare Phishing Archiving Education 339

Security Affairs

JUNE 28, 2022

For this reason, the behavior of each actor in the cyber arena is becoming a national security concern for every government. Looking back at 2007, Estonia fell victim to a powerful cyber-attack that shut down government services, telecommunications, and banks in the country.

Paper 312

Paper Military Government Security 312

Security Affairs

DECEMBER 10, 2020

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Zebrocy is mainly used against governments and commercial organizations engaged in foreign affairs.

Phishing 302

Phishing Healthcare Military Data collection 302

Security Affairs

OCTOBER 27, 2023

The French National Agency for the Security of Information Systems ANSSI (Agence Nationale de la sécurité des systèmes d’information) warns that the Russia-linked APT28 group has been targeting multiple French organizations, including government entities, businesses, universities, and research institutes and think tanks.

Military 345

Military Phishing Government Security 345

Security Affairs

OCTOBER 7, 2018

The APT28 group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. According to experts from Symantec, the group is now actively conducting cyber espionage campaigns against government and military organizations in Europe and South America. .”

Military 278

Military Government Phishing Security 278

Security Affairs

NOVEMBER 29, 2020

The Bandook was spotted last time in 2015 and 2017 campaigns, dubbed “ Operation Manul ” and “ Dark Caracal “, respectively attributed to Kazakh and the Lebanese governments. This circumstance suggests that the implant was developed by a third-party actor and used by multiple APT groups. ” reads the report published by Check Point.

Energy and Utilities 340

Energy and Utilities Government Archiving Education 340

Security Affairs

MARCH 20, 2020

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. The cyberespionage group continues to target members of defense companies, embassies, governments, and the military.

Phishing 363

Phishing Military Government Passwords 363

Security Affairs

DECEMBER 1, 2020

The hackers targeted organizations across multiple industries and have also hit foreign governments, dissidents, and journalists. “But in campaigns from July to August 2020, the group deployed Monero coin miners in attacks that targeted both the private sector and government institutions in France and Vietnam.”

Mining 340

Mining Manufacturing Government Phishing 340

Security Affairs

SEPTEMBER 23, 2020

Russia-linked cyberespionage group APT28 uses fake NATO training documents as bait in attacks aimed at government bodies. The Russia-linked cyberespionage group APT28 is behind a string of attacks that targeting government bodies with Zebrocy Delphi malware. ” reads the report published QuoIntelligence.

Military 291

Military Government Encryption Communications 291

Security Affairs

FEBRUARY 15, 2020

” The authorities are still investigating the attack, the government experts have no doubt about the fact that it was a targeted cyber-espionage attack against the Foreign Ministry. However, due to the dimension and the high complexity, it cannot yet be said beyond doubt who is behind the attack.”

Government 358

Government IT Security Access 358

Krebs on Security

SEPTEMBER 17, 2020

The government alleges the men used malware-laced phishing emails and “supply chain” attacks to steal data from companies and their customers. backed media outlet that ran stories examining the Chinese government’s treatment of Uyghur people living in its Xinjian region.

Government 363

Government Mining Big data Phishing 363

Security Affairs

OCTOBER 10, 2020

Orange Belgium is using Huawei equipment since 2007 for its mobile network in Belgium and Luxembourg, while the collaboration between Proximus and the Shenzhen-based company started in 2009 for the progressive upgrading of its network.

Manufacturing 333

Manufacturing Risk Communications Security 333

Security Affairs

FEBRUARY 20, 2019

The APT28 group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. According to a report published by Symantec in October, the group was actively conducting cyber espionage campaigns against government and military organizations in Europe and South America.

Military 275

Military Phishing Government Security 275

Security Affairs

JUNE 21, 2019

Turla (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ), has been active since at least 2007 targeting government organizations and private businesses. The three recent Turla campaigns targeted governments and international organizations worldwide.

Communications 268

Communications Government Data collection Education 268

The Last Watchdog

APRIL 1, 2020

Related: What we’ve learned from the massive breach of Capitol At RSA 2020 , I learned about how one of the routine daily chores all large organizations perform — data governance — has started to emerge as something of a cybersecurity multiplier. A robust data archiving strategy puts data into tiers, Lahiri says.

Government 149

Government Cybersecurity Archiving Access 149

Security Affairs

JULY 16, 2019

Hackers have exfiltrated data from a Bulgarian government system, likely the National Revenue Agency (NRA), and have shared it with the local media. “Your government is slow to develop, your state of cybersecurity is parodyous ,” wrote the hackers. “Your government is stupid. Your is a parody.”

Government 262

Government Insurance Archiving Personal data 262

Krebs on Security

AUGUST 29, 2023

government today announced a coordinated crackdown against QakBot , a complex malware family used by multiple cybercrime groups to lay the groundwork for ransomware infections. Emerging in 2007 as a banking trojan, QakBot (a.k.a. government has used court orders to remotely disinfect systems compromised with malware.

Ransomware 316

Ransomware Government Military Access 316

Security Affairs

DECEMBER 2, 2020

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations.

Archiving 363

Archiving Communications Government Access 363

Security Affairs

JUNE 19, 2020

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations.

Security 360

Security Government IT Information Security 360

Security Affairs

OCTOBER 18, 2022

Winnti (aka APT41 , Axiom, Barium , Blackfly) is a cyberespionage group that has been active since at least 2007. Symantec pointed out that the attacks against government organizations in Hong Kong remained undetected for a year in some cases.

File names 321

File names Encryption Manufacturing Libraries 321

Security Affairs

APRIL 30, 2023

CERT-UA warns of a spear-phishing campaign conducted by APT28 group targeting Ukrainian government bodies with fake ‘Windows Update’ guides. Russia-linked APT28 group is targeting Ukrainian government bodies with fake ‘Windows Update’ guides, Computer Emergency Response Team of Ukraine (CERT-UA) warns.

Systems administration 246

Systems administration Military Phishing Government 246