Security Affairs

DECEMBER 24, 2022

The Raspberry Robin worm attacks aimed at telecommunications and government office systems across Latin America, Australia, and Europe. Researchers from Trend Micro have uncovered a Raspberry Robin worm campaign targeting telecommunications and government office systems across Latin America, Australia, and Europe. Pierluigi Paganini.

Government 246

Government Communications Ransomware Manufacturing 246

Security Affairs

APRIL 21, 2024

Threat actors target government entities in the Middle East with a new backdoor dubbed CR4T as part of an operation tracked as DuneQuixote. The threat actors behind the DuneQuixote campaign took steps to prevent collection and analysis the implants through the implementation of practical and well-designed evasion methods.

Libraries 334

Libraries Communications IT Government 334

Security Affairs

SEPTEMBER 3, 2024

These flaws could allow attackers to inject malicious libraries into Microsoft’s apps and steal permissions. Despite these risks, Microsoft considers the issues low-risk and declined to fix them, stating that some apps need to allow unsigned libraries for plugin support. ” continues the report.

Libraries 327

Libraries Risk Access Security 327

Security Affairs

SEPTEMBER 6, 2023

Microsoft revealed that the Chinese group Storm-0558 stole a signing key used to breach government email accounts from a Windows crash dump. Storm-0558 threat actors focus on government agencies in Western Europe and were observed conducting cyberespionage, data theft, and credential access attacks.

Authentication 338

Authentication Libraries Access Government 338

Security Affairs

APRIL 14, 2020

PaloAlto Networks experts warn of malicious Coronavirus themed phishing campaigns targeting government and medical organizations. Recently organizations in healthcare, research, and government facilities have been hit by Coronavirus-themed attacks that deployed multiple malware families, including ransomware and information stealers (i.e.

Ransomware 361

Ransomware Phishing Government File names 361

Security Affairs

NOVEMBER 16, 2022

“CISA obtained four malicious files for analysis during an on-site incident response engagement at a Federal Civilian Executive Branch (FCEB) organization compromised by Iranian government sponsored advanced persistent threat (APT) actors.” ” reads the Malware Analysis Report (AR22-320A) published by CISA.

Government 330

Government Mining Cybersecurity Libraries 330

Security Affairs

SEPTEMBER 8, 2024

This issue arises because the GeoTools library API, which GeoServer uses, evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library, allowing arbitrary code execution. government entities in Belgium, and telecommunications companies in Thailand and Brazil.

Libraries 336

Libraries Encryption Cybersecurity Access 336

Security Affairs

OCTOBER 6, 2020

The CISA agency is warning of a surge in Emotet attacks targeting multiple state and local governments in the US since August. The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert to warn of a surge of Emotet attacks that have targeted multiple state and local governments in the U.S. since August.

Government 357

Government Libraries Cybersecurity Phishing 357

Security Affairs

DECEMBER 20, 2021

federal government commission associated with international rights. federal government commission associated with international rights. ” According to security firm Avast who discovered the attack, the backdoor was likely used as the initial vector in a multi-stage attack to penetrate the government network.

Government 298

Government Libraries Access Security 298

Security Affairs

MARCH 16, 2023

Multiple threat actors exploited a critical flaw in Progress Telerik to breach an unnamed US federal agency, said the US government. “Actors were then able to upload malicious dynamic-link library (DLL) files (some masqueraded as portable network graphics [PNG] files) to the C:WindowsTemp directory.” ” reads the MAR.

Libraries 246

Libraries Government Ransomware Cybersecurity 246

Security Affairs

MAY 12, 2020

The Zeus Sphinx malware was first observed on August 2015, a few days after a new variant of the popular Zeus banking trojan was offered for sale on hacker forums, At the end of March, experts from IBM X-Force uncovered a hacking campaign employing the Zeus Sphinx malware that focused on government relief payment.

Libraries 341

Libraries Sales Government IT 341

Security Affairs

JANUARY 17, 2022

” reads the analysis published by Rising.AFR-6fyvilv #Sfile #Ransomware New Sample: 6E029B9B0A600CDC1E75A4F7228B332B pic.twitter.com/tB27dM8tjd — dnwls0719 (@fbgwls245) January 9, 2022. “The SFile ransomware uses the Mbed TLS library, RSA-2048 and AES-256 algorithms for file encryption. as the suffix name.

Ransomware 364

Ransomware Encryption Libraries Communications 364

Security Affairs

OCTOBER 5, 2023

“The document said the exploit worked for Android versions 9 to 11, which was released in 2020, and that it took advantage of a flaw in the “image rendering library.” The three flaws were discovered by Bill Marczak of The Citizen Lab at The University of Toronto’s Munk School and Maddie Stone of Google’s Threat Analysis Group.

Marketing 351

Marketing Libraries Sales Government 351

Security Affairs

SEPTEMBER 5, 2024

The group focuses on government departments that are involved in foreign affairs, technology, and telecommunications. The malware supports advanced encryption and obfuscation techniques to complicate malware analysis and hide its operations.

IT 298

IT Communications Encryption Libraries 298

Security Affairs

APRIL 3, 2019

The hackers targeting organizations across multiple industries and have also targeted foreign governments, dissidents, and journalists. The two loaders discovered by Cylance and used by the APT group use side-loaded DLLs and an AES128 implementation from Crypto++ library for payload decryption.

Libraries 266

Libraries Encryption Communications Manufacturing 266

Security Affairs

OCTOBER 18, 2022

Symantec pointed out that the attacks against government organizations in Hong Kong remained undetected for a year in some cases. ” reads the analysis published by Symantec. Like the sample analyzed by Cyberreason, the Spyder Loader sample analyzed by Symantec uses the CryptoPP C++ library.

File names 325

File names Encryption Manufacturing Libraries 325

The Last Watchdog

MARCH 24, 2025

We recommend using Dr. Michele Moscas theorem of quantum risk against an optimistic vs. pessimistic probability analysis. In general, this means avoiding hardcoding particular algorithms and favoring libraries and systems that simplify migrating between algorithms. This is where the concern of harvest now, decrypt later attacks apply.

Encryption 130

Encryption Financial Services Risk Libraries 130

Security Affairs

MARCH 15, 2023

Russia-linked APT29 group abused the legitimate information exchange systems used by European countries to target government entities. Russia-linked APT29 (aka SVR group , Cozy Bear , Nobelium , and The Dukes ) was spotted abusing the legitimate information exchange systems used by European countries in attacks aimed at governments.

Metadata 246

Metadata Government Libraries Phishing 246

Security Affairs

MAY 27, 2019

The APT10 group has added two new malware loaders to its arsenal and used in attacks aimed at government and private organizations in Southeast Asia. In April 2019, China-linked cyber-espionage group tracked as APT10 has added two new loaders to its arsenal and used it against government and private organizations in Southeast Asia.

Libraries 272

Libraries Government Phishing Cloud 272

Security Affairs

OCTOBER 2, 2020

The APT group, recently discovered by ESET, targeted government and private companies in Belarus, Moldova, Russia, Serbia, and Ukraine, including militaries and Ministries of Foreign Affairs. The malware samples analyzed by the researchers are slightly obfuscated using string obfuscation and dynamic Windows API library loading.

Military 359

Military Phishing Passwords Government 359

Security Affairs

APRIL 26, 2023

In recent years, the researchers observed the group expanding its operations to include financial institutions and government entities. ” reads the analysis published by Unit 42. Analysis of the C2 for a second Sword2033 sample revealed that the domain *.saspecialforces.co[.]za org over port 8443 for C2. .

Communications 246

Communications Military Government Libraries 246

Security Affairs

JUNE 2, 2019

Turla group has been active since at least 2007 targeting government organizations and private businesses. “To confound detection, its operators recently started using PowerShell scripts that provide direct, in- memory loading and execution of malware executables and libraries. ” reads the report published by ESET.

Libraries 279

Libraries Security Cloud Cybersecurity 279

Security Affairs

JUNE 26, 2023

In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure.

Cleanup 246

Cleanup Libraries Access Manufacturing 246

Security Affairs

JULY 14, 2021

LuminousMoth: Kaspersky uncovered an ongoing and large-scale APT campaign that targeted government entities in Southeast Asia, including Myanmar and the Philippines. “The archive contains two malicious DLL libraries as well as two legitimate executables that sideload the DLL files.

Archiving 246

Archiving File names Government Libraries 246

Security Affairs

OCTOBER 10, 2018

A previously unknown cyber espionage group, tracked as Gallmaker, has been targeting entities in the government, military and defense sectors since at least 2017. Gallmaker is a politically motivated APT group that focused its surgical operations on the government, military or defense sectors. ” continues Symantec.

Military 270

Military File names Government Libraries 270

Security Affairs

JANUARY 13, 2020

The cyber-espionage group tracked as APT40 (aka TEMP.Periscope , TEMP.Jumper , and Leviathan ), apparently linked to the Chinese government, is focused on targeting countries important to the country’s Belt and Road Initiative (i.e. Hainan Xiandun even appears to operate from the Hainan University Library!”

Libraries 251

Libraries Information Security Military Government 251

Security Affairs

JULY 13, 2019

Croatia government agencies targeted with news SilentTrinity malware. Backdoor mechanism found in Ruby strong_password library. Cyberattack shuts down La Porte County government systems. Spotting RATs: Delphi wrapper makes the analysis harder. Prototype Pollution flaw discovered in all versions of Lodash Library.

Security 194

Security Libraries Data breaches Ransomware 194

Security Affairs

AUGUST 3, 2023

Rapid7 conducted an analysis on three distinct infusion pump models: the Alaris PC 8015, the Baxter Sigma Spectrum model 35700BAX2 along with its associated Wireless Battery Module (WBM), and the Hospira Abbott PLUM A+ with MedNet. ” reads the analysis published by Rapid7. . ” reads the analysis published by Rapid7.

Marketing 246

Marketing Authentication Communications Manufacturing 246

Security Affairs

SEPTEMBER 13, 2022

A cyber espionage group targets governments and state-owned organizations in multiple Asian countries since early 2021. Threat actors are targeting government and state-owned organizations in multiple Asian countries as parts of a cyber espionage campaign that remained under the radar since early 2021.

Government 246

Government Access Libraries Education 246

Security Affairs

MAY 23, 2024

A previously unknown China-linked threat actor dubbed ‘Unfading Sea Haze’ has been targeting military and government entities since 2018. Bitdefender researchers discovered a previously unknown China-linked threat actor dubbed ‘Unfading Sea Haze’ that has been targeting military and government entities since 2018.

Archiving 332

Archiving Military Communications Phishing 332

Security Affairs

DECEMBER 24, 2022

The Raspberry Robin worm attacks aimed at telecommunications and government office systems across Latin America, Australia, and Europe. Researchers from Trend Micro have uncovered a Raspberry Robin worm campaign targeting telecommunications and government office systems across Latin America, Australia, and Europe. Pierluigi Paganini.

Government 130

Government Communications Ransomware Manufacturing 130

Security Affairs

MAY 25, 2023

Then the library is executed via the Windows IIS web server process. ” reads the analysis published by ASEC. ” reads the analysis published by ASEC. Once discovered a vulnerable ISS server, the attackers leverage the DLL side-loading ( T1574.002 ) technique to execute a malicious DLL (msvcr100.dll) The msvcr100.dll

Libraries 246

Libraries Security Cybersecurity Government 246

Security Affairs

MAY 8, 2022

Russia-linked APT29 targets diplomatic and government organizations Synology and QNAP warn of critical Netatalk flaws in some of their products Hackers stole +80M from DeFi platforms Rari Capital and Fei Protocol Apr 24 – Apr 30 Ukraine – Russia the silent cyber conflict.

Security 246

Security IoT Ransomware Libraries 246

Security Affairs

SEPTEMBER 5, 2018

GOBLIN PANDA was focused on Vietnam, most of the targets were in the defense, energy, and government sectors. ” reads the analysis published by CrowdStrike. The analysis of command and control servers suggests that GOBLIN PANDA hackers are also targeting entities in Laos. ” concludes the report.

Metadata 177

Metadata File names Libraries Government 177

Collibra

JUNE 27, 2024

Healthcare executives are doubting whether their returns on AI investments will materialize, highlighting the importance of risk assessment and impact analysis. UCLA Health is at the forefront of AI innovation in healthcare and has partnered with Collibra to bring clear, accessible AI governance to all levels of its organization.

Government 105

Government Artificial Intelligence Access Libraries 105

Security Affairs

JUNE 6, 2019

Today I want to share a quick analysis on a new leaked APT34 Tool in order to track similarities between APT34 public available toolsets. Additional technical details, including Yara Rules and IoCs, are reported in the original analysis published by Marco Ramilli on his blog: [link]. Michael Lortz.

Computer and Electronics 271

Computer and Electronics Passwords Security Cybersecurity 271

Security Affairs

JULY 1, 2019

The hackers targeted organizations across multiple industries and have also hit foreign governments, dissidents, and journalists. ” reads the analysis published by Cylance. ” continues the analysis. of the wolfSSL library , formerly known as CyaSSL.

Manufacturing 216

Manufacturing Libraries Security Communications 216