article thumbnail

North Korea-linked Lazarus APT uses a Mac variant of the Dacls RAT

Security Affairs

This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems. “Both Mac and Linux variants use the WolfSSL library for SSL communications. ” continues the report.

Libraries 318
article thumbnail

China-linked APT41 group targets Hong Kong with Spyder Loader

Security Affairs

Winnti (aka APT41 , Axiom, Barium , Blackfly) is a cyberespionage group that has been active since at least 2007. Like the sample analyzed by Cyberreason, the Spyder Loader sample analyzed by Symantec uses the CryptoPP C++ library.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Too much UPnP-enabled connected devices still vulnerable to cyber attacks

Security Affairs

UPnP-enabled devices running outdated software are exposed to a wide range of attacks exploiting known flaws in UPnP libraries. Most of the devices discovered by the expert still use old versions of UPnP libraries that are affected by years old flaws. CVE-2013-0229 , a vulnerability found MiniUPnPd before 1.4,

Libraries 268
article thumbnail

Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide

Security Affairs

This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems. “HIDDEN COBRA actors most likely deployed ISO 8583 libraries on the targeted switch application servers.

Retail 278
article thumbnail

ESET analyzes Turla APT’s usage of weaponized PowerShell

Security Affairs

Turla group has been active since at least 2007 targeting government organizations and private businesses. “To confound detection, its operators recently started using PowerShell scripts that provide direct, in- memory loading and execution of malware executables and libraries. ” reads the report published by ESET.

Libraries 279
article thumbnail

Patch Tuesday, May 2024 Edition

Krebs on Security

CVE-2024-30051 is an “elevation of privilege” bug in a core Windows library. Emerging in 2007 as a banking trojan, QakBot (a.k.a. There are also important security patches available for macOS and Adobe users, and for the Chrome Web browser, which just patched its own zero-day flaw. First, the zero-days.

Libraries 274
article thumbnail

Experts attribute WyrmSpy and DragonEgg spyware to the Chinese APT41 group

Security Affairs

The APT41 group, aka Winnti , Axiom, Barium , Blackfly, HOODOO) is a China-linked cyberespionage group that has been active since at least 2007. These commands include instructing the malware to upload log files, photos stored on the device, and acquire device location using the Baidu Location library.” government.