Security Affairs

AUGUST 13, 2021

The news was first reported by TheRecord website, the master decryption keys work for victims that were infected between July 2017 and early 2021. The SynAck group has been active since 2017 and at the end of July 2021, the group launched El_Cometa ransomware-as-a-service (RaaS). The gang has now rebranded as the new El_Cometa group.

Ransomware 359

Ransomware Authentication Security IT 359

Security Affairs

OCTOBER 16, 2024

CrowdStrike’s investigation reveals that USDoD’s leader, Luan BG, has been a hacktivist active since at least 2017. More precise information was not revealed to TecMundo so as not to completely expose the attacker’s identity.” However, the Brazilian national turned into more complex cybercriminal activities by 2022.

Data breaches 312

Data breaches Cybersecurity Risk IT 312

Data Breach Today

JANUARY 5, 2024

and several insurers that were appealing a 2023 court decision saying the insurance companies could not invoke "hostile warlike action" exclusions in refusing to pay drugmakers' claims filed after the 2017 NotPetya cyberattack. A proposed settlement has been reached between Merck & Co.

Insurance 345

Insurance 345

Security Affairs

DECEMBER 21, 2023

Threat actors are exploiting an old Microsoft Office vulnerability, tracked as CVE-2017-11882, to spread the Agent Tesla malware. Threat actors are exploiting an old Microsoft Office vulnerability, tracked as CVE-2017-11882 (CVSS score: 7.8), as part of phishing campaigns to spread the Agent Tesla malware.

Phishing 328

Phishing Communications Cybersecurity IT 328

Security Affairs

DECEMBER 2, 2020

The latter, also known as WhiteBear, was a second-stage backdoor used by Turla in 2016-2017.” Experts believe that Turla attackers used Crutch as a second stage backdoor, while first-stage implants used by the APT group includes Skipper (2017) and the open-source PowerShell Empire post-exploitation framework (from 2017).

Archiving 363

Archiving Communications Government Access 363

Security Affairs

JUNE 20, 2022

The attack took place in April 2017 and the man is accused of conducting the attack for the Russian military intelligence service GRU. Kozachek hacked the computed of the NATO think tank in 2017 and installed a keylogger to spy on the organization. ” reported the Tagesschau website.

Military 361

Military Access Security Cybersecurity 361

Security Affairs

AUGUST 16, 2024

Many Google Pixel devices shipped since September 2017 have included a vulnerable app that could be exploited for malicious purposes. Many Google Pixel devices shipped since September 2017 have included dormant software that could be exploited by attackers to compromise them. ” reads the report. ” reads the report.

Retail 357

Retail Data breaches Sales Passwords 357

Security Affairs

MARCH 30, 2021

In January 2018, White hackers from Google Project Zero disclosed vulnerabilities , affecting all modern Intel CPUs, dubbed Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753 and CVE-2017-5715). The issue could be exploited by attackers to steal sensitive data processed by the CPU.

Access 358

Access Security IT Information Security 358

Security Affairs

OCTOBER 30, 2023

Further analysis revealed that the malware has been used since at least 2017. Kaspersky discovered that the detections between 2017 and 2022 had previously misclassified as a cryptocurrency miner. Kaspersky researchers discovered that over one million updates have been downloaded from the C2 infrastructure since 2017.

Ransomware 343

Ransomware Mining Communications IT 343

Data Breach Today

AUGUST 12, 2021

Darknet Market Only Accepts Monero, Promotes Malware and Botnets, Bans Ransomware The notorious AlphaBay darknet marketplace appears to be getting rebooted by "DeSnake," who claims to have been the security administrator for the previous iteration, which law enforcement officials took down in 2017.

Marketing 312

Marketing Ransomware Security IT 312

Security Affairs

FEBRUARY 15, 2021

The first attack spotted by ANSSI experts dates back to the end of 2017 and the campaign continued until 2020. “The first compromises identified by ANSSI date from the end of 2017 and continued until 2020. Threat actors mainly targeted IT service providers, particularly web hosting. ” reads the alert issued by the ANSSI.

Ransomware 333

Ransomware Security IT Information Security 333

Security Affairs

APRIL 28, 2024

The researchers pointed out that the use of the “script:” prefix demonstrates the exploitation of the vulnerability CVE-2017-8570 , a bypass for CVE-2017-0199. The PPSX file contains a remote link to an external OLE object. The remote script, named “widget_iframe.617766616773726468746672726a6834.html,”

Military 337

Military Mining Libraries Security 337

Krebs on Security

JULY 1, 2021

Equifax’s 2017 megabreach that exposed the personal and financial details of 145.5 million Americans may have shocked the public, but it did little to stop more than a million employers from continuing to sell Equifax their employee payroll data, Bloomberg found in late 2017. Intuit’s FAQ on the changes is here.

Financial Services 358

Financial Services Government Authentication IT 358

Data Breach Today

JULY 2, 2024

Department of Health and Human Services has hit a Pennsylvania-based healthcare system with a $950,000 settlement for potential HIPAA violations found during an investigation into a 2017 ransomware attack. It's HHS' third HIPAA enforcement action in a ransomware case so far.

Ransomware 269

Ransomware IT 269

Security Affairs

FEBRUARY 24, 2022

The first MuddyWater campaign was observed in late 2017 when targeted entities in the Middle East.

Government 363

Government Cybersecurity Security IT 363

Security Affairs

AUGUST 11, 2023

A variant of the Gafgyt botnet is actively attempting to exploit a vulnerability, tracked as CVE-2017-18368 (CVSS v3: 9.8), impacting the end-of-life Zyxel P660HN-T1A router. Zyxel addressed the vulnerability in 2017 with the release of new firmware, however, the vendor warned that a Gafgyt variant was exploiting the flaw in 2019.

Access 246

Access IT Security Information Security 246

Security Affairs

JUNE 26, 2021

Data belongs to individuals that provided their information to Mercedez-Benz and dealer websites between 2014 and 2017. “It is our understanding the information was entered by customers and interested buyers on dealer and Mercedes-Benz websites between January 1, 2014 and June 19, 2017. The incident exposed approximately 1.6

Data breaches 359

Data breaches Cloud Security Government 359

Security Affairs

AUGUST 9, 2022

The emails used weaponized Microsoft Word documents exploiting the CVE-2017-11882 vulnerability. The CVE-2017-11882 flaw is a memory-corruption issue that affects all versions of Microsoft Office released between 2000 and 2017. The vulnerability affects the MS Office component EQNEDT32.EXE

Encryption 309

Encryption Military Archiving Phishing 309

Security Affairs

MAY 6, 2024

Alexander Vinnik , a Russian national, pleaded guilty to conspiracy to commit money laundering for his involvement in operating the cryptocurrency exchange BTC-e from 2011 to 2017. In July 2017 law enforcement shut down the virtual currency exchange.

Computer and Electronics 323

Computer and Electronics Ransomware Marketing IT 323

Security Affairs

JANUARY 2, 2022

Year Total Money Lost ($) Year Increase In Money Lost (%) 2021 4,250,000,000 2020 – 2021 185% 2020 1,490,000,000 2019 – 2020 -57% 2019 3,500,156,000 2018 – 2019 259% 2018 974,000,000 2017 – 2018 51% 2017 645,901,000 2016 – 2017 341% 2016 146,509,000 2015 – 2016 -64%. The top 5 breaches in history are: 1. Gox, $615M.

Security 291

Security Marketing IT Information Security 291

Security Affairs

FEBRUARY 6, 2024

“According to the indictment, between 2011 and July 2017, Aliaksandr Klimenka, 42, allegedly controlled BTC-e, a digital currency exchange, with Alexander Vinnik and others.” ” reads the press release published by DoJ.

IT 318

IT Information Security Security 318

Security Affairs

SEPTEMBER 10, 2024

CVE-2017-1000253 flaw was discovered by researchers with Qualys Research Labs and affects all Linux distributions that have not fixed their kernels after a commit released on April 14, 2015. ” Attackers can exploit the flaw to take over websites running the widely used image-enhancing app.

IT 309

IT Cybersecurity Access Risk 309

Security Affairs

JUNE 3, 2024

The issue, tracked as CVE-2017-3506 (CVSS score 7.4), is an OS command injection. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle WebLogic Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability resides in the Oracle WebLogic Server component of Oracle Fusion Middleware.

IT 331

IT Access Cybersecurity Risk 331

Security Affairs

FEBRUARY 2, 2024

” In July 2022, Schulte was found guilty in a New York federal court of stealing the agency’s hacking tools and leaking them to WikiLeaks in 2017. Schulte was arrested for possession of child pornography, he was charged with three counts of receipt, possession and transportation of child pornography in August 2017.

Computer and Electronics 318

Computer and Electronics Data breaches IoT Archiving 318

Security Affairs

MARCH 14, 2021

” In January 2018, the expert devised two attacks dubbed Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753 and CVE-2017-5715) , which could be conducted to steal sensitive data processed by the CPU. The Spectre proof of concept itself, leaking memory of your browser’s renderer process.”

Metadata 362

Metadata Encryption Authentication Security 362

Security Affairs

NOVEMBER 30, 2021

The attackers are targeting Edgewater Networks’ devices by exploiting the CVE-2017-6079 vulnerability with a relatively unique mount file system command. ” reads the analysis published by Qihoo 360.

Communications 363

Communications Encryption Cloud Security 363

Security Affairs

NOVEMBER 11, 2021

CVE-2017-6077 NETGEAR DGN2200 devices with firmware through 10.0.0.50 Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2 CVE-2017-18368 ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 Ax with firmware 1.04b12 and earlier CVE-2016-1555 Netgear WN604 before 3.3.3

IoT 348

IoT Communications IT Security 348

Security Affairs

JULY 30, 2024

Upon opening the decoy file, it relies on a remote template injection technique ( CVE-2017-0199 ) to gain initial access to the target’s system. Despite the flaw was addressed by Microsoft in April 2017, attackers are exploiting the vulnerability by targeting large organizations with outdated, fragmented, or antiquated infrastructures.

Phishing 300

Phishing Military Access IT 300

Security Affairs

MARCH 25, 2024

The first MuddyWater campaign was observed in late 2017, when the APT group targeted entities in the Middle East. .” The report includes Indicators of compromise (IOCs) for this campaign.

Phishing 342

Phishing Archiving Government IT 342

Security Affairs

JANUARY 7, 2024

The researchers believe that the Turkey-linked APT Sea Turtle has been active since at least 2017. Between 2017 and 2019, the APT group mainly used DNS hijacking in its campaigns. The Sea Turtle APT group focuses primarily on targeting organizations in Europe and the Middle East.

IT 346

IT Passwords Government Archiving 346

Security Affairs

APRIL 18, 2024

The group is also the author of the NotPetya ransomware that hit hundreds of companies worldwide in June 2017. It is written in C++ and compiled with Visual Studio 2017 (15.9). “Kapeka contains a dropper that will drop and launch a backdoor on a victim’s machine and then remove itself.

Communications 328

Communications Ransomware IT Access 328

Security Affairs

JUNE 15, 2021

Paradise Ransomware has been active since September 2017, its operators offer the malware with a Ransomware-as-a-Service (RaaS) model. The analysis of the source code revealed the presence of comments in the Russian language that gives us an idea of the origin of the ransomware gang behind it.

Ransomware 357

Ransomware Encryption Security IT 357

Security Affairs

MAY 30, 2022

CVE Number Affected devices CVE-2021-44228, CVE-2021-45046 Log4J RCE CVE-2022-1388 F5 BIG IP RCE No CVE (vulnerability published on 2022-02) Adobe ColdFusion 11 RCE CVE-2020-7961 Liferay Portal – Java Unmarshalling via JSONWS RCE No CVE (vulnerability published on 2022-04) PHP Scriptcase 9.7 LFI CVE-2018-16763 Fuel CMS 1.4.1

CMS 363

CMS IoT Security Passwords 363

Security Affairs

NOVEMBER 3, 2023

” The first MuddyWater campaign was observed in late 2017, when the APT group targeted entities in the Middle East. These include a new public hosting service, employing a LNK file to initiate the infection, and utilizing intermediate malware that mimics the opening of a directory while executing a new remote administration tool.”

Archiving 326

Archiving Phishing Government IT 326

Security Affairs

NOVEMBER 23, 2024

Microsoft has tracked Nady, linked to phishing services since 2017. The PhaaS was created by “MRxC0DER,” previously associated with the “ Caffeine Phishing Kit.” The researchers were among the first to discover the real identity of identity of MRxC0DER.

Phishing 178

Phishing Financial Services Risk Access 178