Security Affairs

SEPTEMBER 5, 2024

DFS immediately reported the attack to national security authorities. The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , BlueDelta, and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide.

Military 338

Military Cybersecurity Government Security 338

Security Affairs

APRIL 22, 2024

Microsoft has observed APT28 using GooseEgg in post-compromise activities against various targets, including government, non-governmental, education, and transportation sector organizations in Ukraine, Western Europe, and North America. This tool modifies a JavaScript constraints file and executes it with SYSTEM-level permissions.

Military 358

Military File names Education Phishing 358

Security Affairs

FEBRUARY 20, 2020

Britain and the United governments blame Russia for being behind a destructive cyber attack that hit Georgia during 2019. The governments of Britain and the US declared that Russia’s military intelligence service GRU is behind the massive cyber attack that hit Georgia during 2019. ” said the Foreign Secretary Dominic Raab.

Military 346

Military IT Government Encryption 346

Security Affairs

OCTOBER 27, 2021

The Evil Corp cybercrime group (aka the Dridex gang Indrik Spider , the Dridex gang, and TA505 ) has been active in cybercrime activities since 2007. The US Government announced sanctions for ransomware negotiation firms that will support victims of the Evil Corp group in the ransom payments. Pierluigi Paganini.

Ransomware 350

Ransomware Government IT Security 350

Security Affairs

NOVEMBER 28, 2021

Nexa Technologies offers a range of solutions for homeland security, including surveillance solutions. The cybersurveillance equipment was used by the Egyptian government to track down opponents. A weapon of choice for authoritarian governments.” “In short, Cerebro can suck up any data that is not encrypted.

Sales 342

Sales Government Encryption Communications 342

Security Affairs

FEBRUARY 26, 2024

Recently the leak of a collection of files apparently stolen from the Chinese government hacking contractor, I-Soon, exposed Chinese hacking capabilities. i-SOON is a prominent contractor for various agencies of the Chinese government, including Ministry of Public Security, Ministry of State Security, and the People’s Liberation Army.

Government 336

Government Marketing IoT Data breaches 336

Security Affairs

JUNE 3, 2024

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , BlueDelta, and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Insikt Group speculates the operation is aimed at influencing regional and military dynamics.

Military 354

Military Phishing Government Authentication 354

Security Affairs

APRIL 8, 2022

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. The post Microsoft disrupted APT28 attacks on Ukraine through a court order appeared first on Security Affairs.

Military 342

Military Government Phishing Security 342

Security Affairs

AUGUST 13, 2020

The FBI and NSA have published a joint security alert containing technical details about a new piece of Linux malware, tracked as Drovorub , allegedly employed by Russia-linked the APT28 group. The government agencies recommend that US organizations update any Linux system to a version running kernel version 3.7 Pierluigi Paganini.

Military 360

Military IoT Phishing Government 360

Security Affairs

OCTOBER 21, 2021

The Evil Corp cybercrime group (aka the Dridex gang Indrik Spider , the Dridex gang, and TA505 ) has been active in cybercrime activities since 2007. The US Government announced sanctions for ransomware negotiation firms that will support victims of the Evil Corp group in the ransom payments. Pierluigi Paganini.

Ransomware 356

Ransomware File names Encryption Government 356

Security Affairs

OCTOBER 27, 2023

France National Agency for the Security of Information Systems warns that the Russia-linked APT28 group has breached several critical networks. The Government experts pointed out that in some cases the group did not deployed any backdoor in the compromised systems. ” The script was hosted on “mocky[.]io,”

Military 349

Military Phishing Government Security 349

Security Affairs

OCTOBER 29, 2020

Experts from the US Cyber Command’s Cyber National Mission Force (CNMF) unit and the Cybersecurity and Infrastructure Security Agency (CISA) uploaded the samples on the Virus Total online virus scan platform. The post US Cyber Command details implants used in attacks on parliaments and embassies appeared first on Security Affairs.

Cybersecurity 352

Cybersecurity Government Security IT 352

Security Affairs

AUGUST 29, 2020

According to a joint advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury, the Federal Bureau of Investigation (FBI), and U.S. Government refers to this team as BeagleBoyz, who represent a subset of HIDDEN COBRA activity.” ” reads the alert. Pierluigi Paganini.

Access 359

Access Government Ransomware Cybersecurity 359

Security Affairs

OCTOBER 8, 2021

Shane Huntley, the head of the Threat Analysis Group (TAG), wrote on Twitter that his group had sent an above-average batch of government-backed security warnings. . TAG sent a above average batch of government-backed security warnings yesterday. So why do we do these government warnings then? Pierluigi Paganini.

Phishing 274

Phishing Military Government Security 274

Security Affairs

JANUARY 18, 2022

A sophisticated threat actor, tracked as Earth Lusca, is targeting government and private organizations worldwide as for financial purposes. The Winnti group was first spotted by Kaspersky in 2013, but according to the researchers the gang has been active since 2007. ” Follow me on Twitter: @securityaffairs and Facebook.

Healthcare 343

Healthcare Phishing Archiving Education 343

Security Affairs

DECEMBER 7, 2023

Over the past 20 months, the group targeted at least 30 organizations within 14 nations that are probably of strategic intelligence significance to the Russian government and its military. The Government experts pointed out that in some cases the group did not deployed any backdoor in the compromised systems.

Military 336

Military Government Phishing Authentication 336

Security Affairs

OCTOBER 10, 2020

Orange Belgium is using Huawei equipment since 2007 for its mobile network in Belgium and Luxembourg, while the collaboration between Proximus and the Shenzhen-based company started in 2009 for the progressive upgrading of its network. The post Belgium telecom operators Proximus and Orange drop Huawei appeared first on Security Affairs.

Manufacturing 338

Manufacturing Risk Communications Security 338

Security Affairs

JUNE 10, 2021

The intrusion was uncovered by the Dutch intelligence service AIVD, the government experts discovered that a Dutch police IP address was connecting to servers operated by Russia-linked APT. The group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide.

Military 314

Military Government Ransomware Security 314

Security Affairs

MARCH 13, 2020

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. Pierluigi Paganini.

Archiving 363

Archiving Government Communications IT 363

Security Affairs

DECEMBER 1, 2020

Learn how the group tried to stay under the radar using threats perceived to be less alarming: [link] — Microsoft Security Intelligence (@MsftSecIntel) November 30, 2020. The hackers targeted organizations across multiple industries and have also hit foreign governments, dissidents, and journalists. ” Microsoft said.

Mining 342

Mining Manufacturing Government Phishing 342

Security Affairs

DECEMBER 5, 2023

In recent attacks spotted by Microsoft’s Threat Intelligence, the nation-state actors primarily targeted government, energy, transportation, and non-governmental organizations in the US, Europe, and the Middle East. The Government experts pointed out that in some cases the group did not deployed any backdoor in the compromised systems.

Military 324

Military Government Access Phishing 324

Security Affairs

MARCH 20, 2020

According to security researchers from Trend Micro, the Russia-linked APT28 cyberespionage group has been scanning vulnerable email servers for more than a year. The cyberespionage group continues to target members of defense companies, embassies, governments, and the military. ” reads the report published by Trend Micro.

Phishing 363

Phishing Military Government Passwords 363

Security Affairs

JUNE 28, 2022

For this reason, the behavior of each actor in the cyber arena is becoming a national security concern for every government. Looking back at 2007, Estonia fell victim to a powerful cyber-attack that shut down government services, telecommunications, and banks in the country. Pierluigi Paganini.

Paper 318

Paper Military Government Security 318

Security Affairs

DECEMBER 10, 2020

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Zebrocy is mainly used against governments and commercial organizations engaged in foreign affairs.

Phishing 308

Phishing Healthcare Military Data collection 308

Security Affairs

FEBRUARY 15, 2020

Despite all the intensive security measures, there is no 100-percent protection against cyberattacks.”. The highest possible data security at the Foreign Ministry is guaranteed and no damage to the IT equipment could be detected.”. The attack took place on the evening of Saturday 4 January evening and it was quickly detected.

Government 358

Government IT Security Access 358

Security Affairs

OCTOBER 7, 2018

The APT28 group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. According to experts from Symantec, the group is now actively conducting cyber espionage campaigns against government and military organizations in Europe and South America. .”

Military 278

Military Government Phishing Security 278

Security Affairs

JUNE 19, 2020

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. of the driver. Pierluigi Paganini.

Security 361

Security Government IT Information Security 361

Security Affairs

NOVEMBER 29, 2020

The Bandook was spotted last time in 2015 and 2017 campaigns, dubbed “ Operation Manul ” and “ Dark Caracal “, respectively attributed to Kazakh and the Lebanese governments. The post Operators behind Dark Caracal are still alive and operational appeared first on Security Affairs. ” reads the report published by Check Point.

Energy and Utilities 345

Energy and Utilities Government Archiving Education 345

Krebs on Security

SEPTEMBER 17, 2020

The government alleges the men used malware-laced phishing emails and “supply chain” attacks to steal data from companies and their customers. Security firm FireEye dubbed that hacking blitz “one of the broadest campaigns by a Chinese cyber espionage actor we have observed in recent years.”

Government 363

Government Mining Big data Phishing 363

Security Affairs

JANUARY 11, 2021

Security experts from Kaspersky have identified multiple similarities between the Sunburst malware used in the SolarWinds supply chain attack and the Kazuar backdoor that has been employed in cyber espionage campaigns conducted by Russia-linked APT group Turla. Pierluigi Paganini. SecurityAffairs – hacking, Turla).

Security 342

Security Government IT Information Security 342

Security Affairs

SEPTEMBER 23, 2020

Russia-linked cyberespionage group APT28 uses fake NATO training documents as bait in attacks aimed at government bodies. The Russia-linked cyberespionage group APT28 is behind a string of attacks that targeting government bodies with Zebrocy Delphi malware. ” reads the report published QuoIntelligence. Pierluigi Paganini.

Military 296

Military Government Encryption Communications 296

Security Affairs

JULY 16, 2019

Hackers have exfiltrated data from a Bulgarian government system, likely the National Revenue Agency (NRA), and have shared it with the local media. “Your government is slow to develop, your state of cybersecurity is parodyous ,” wrote the hackers. “Your government is stupid. Your is a parody.”

Government 265

Government Insurance Archiving Personal data 265

Security Affairs

FEBRUARY 20, 2019

The APT28 group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. According to a report published by Symantec in October, the group was actively conducting cyber espionage campaigns against government and military organizations in Europe and South America.

Military 275

Military Phishing Government Security 275

Security Affairs

DECEMBER 2, 2020

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. ” Pierluigi Paganini.

Archiving 363

Archiving Communications Government Access 363

Security Affairs

APRIL 30, 2023

CERT-UA warns of a spear-phishing campaign conducted by APT28 group targeting Ukrainian government bodies with fake ‘Windows Update’ guides. Russia-linked APT28 group is targeting Ukrainian government bodies with fake ‘Windows Update’ guides, Computer Emergency Response Team of Ukraine (CERT-UA) warns.

Systems administration 246

Systems administration Military Phishing Government 246

Security Affairs

DECEMBER 3, 2018

The Sofacy APT group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. In September 2018, security experts from ESET spotted the first UEFI rootkit of ever, the code tracked as LoJax was used in attacks in the wild. . Pierluigi Paganini.

Military 273

Military Government Security IT 273

Security Affairs

OCTOBER 18, 2022

Winnti (aka APT41 , Axiom, Barium , Blackfly) is a cyberespionage group that has been active since at least 2007. Symantec pointed out that the attacks against government organizations in Hong Kong remained undetected for a year in some cases. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

File names 327

File names Encryption Manufacturing Libraries 327