Krebs on Security

AUGUST 19, 2024

Following last week’s story on the breadth of the NPD breach , a reader alerted KrebsOnSecurity that a sister NPD property — the background search service recordscheck.net — was hosting an archive that included the usernames and password for the site’s administrator. NPD acknowledged the intrusion on Aug.

Passwords 357

Passwords IT Archiving Data breaches 357

Security Affairs

JANUARY 10, 2025

VXunderground archived the leak and published it on GitHub. Check Point researchers discovered a new version of the Banshee macOS infostealer which is distributed through phishing websites and fake GitHub repositories, often masqueraded as popular software. ” reads the report published by Check Point.

Archiving 297

Archiving Phishing Encryption Passwords 297

Collaboration 2.0

OCTOBER 21, 2024

Following last month's devastating cyberattacks, there's good news and bad news about Internet Archive and its popular Wayback Machine.

Archiving 190

Archiving IT 190

Collaboration 2.0

OCTOBER 29, 2024

Though the Internet Archive may appear on the surface as just one service, it actually provides a variety of resources.

Archiving 240

Archiving IT 240

Security Affairs

JANUARY 16, 2025

The zip archive contains an obfuscated JavaScript file, which creates and executes a PowerShell script that connects to the C2 (62.133.60[.]137), In late November, the experts spotted a malspam campaign impersonating DHL which used emails about freight invoices, attaching zip files named “Invoice###.zip”

File names 345

File names Authentication Access Archiving 345

Security Affairs

MAY 30, 2023

“file archiver in the browser” is a new phishing technique that can be exploited by phishers when victims visit a.ZIP domain. A new phishing technique called “file archiver in the browser” can be used by phishers to “emulate” a file archiver software in a web browser when a victim visits a.ZIP domain.

Archiving 246

Archiving Phishing Security IT 246

Security Affairs

MARCH 24, 2025

Initially, the group published screenshots of stolen data as proof of the attack, now the whole archive can be downloaded from the leak page. The ransomware group Cloak has claimed responsibility for a February cyberattack on the Virginia Attorney General Office. Chief Deputy AG Steven Popps called it a sophisticated attack.

Ransomware 244

Ransomware Manufacturing Paper Archiving 244

Security Affairs

OCTOBER 22, 2024

The malware is distributed through phishing messages using a malicious attachment or a link to the malicious archive containing Bumblebee. Experts warn of a new wave of attacks involving the Bumblebee malware, months after Europol’s ‘ Operation Endgame ‘ that disrupted its operations in May.

File names 306

File names Phishing Ransomware Archiving 306

Security Affairs

JULY 20, 2024

The attackers attempted to trick the company’s customers into opening a ZIP archive file named “ crowdstrike-hotfix.zip.” ” The archive includes a loader named Hijack Loader used to execute the Remcos RAT. The ZIP archive contains a HijackLoader payload that, when executed, loads RemCos.

File names 361

File names Archiving Cybersecurity Communications 361

Security Affairs

MAY 16, 2021

Experts observed the hackers using resume documents and archives, such as ZIPs and RARs, with alluring themes distributing CrimsonRAT. Alleged Pakistan-Linked cyber espionage group, tracked as Transparent Tribe, targets Indian entities with a new Windows malware. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

Military 351

Military IT Phishing Archiving 351

Security Affairs

JANUARY 7, 2024

Hunt & Hackett also observed the threat actor collecting at least one e-mail archive, of one of the multiple victim organizations. Sea Turtle cyber espionage group targeted telco, media, ISPs, IT service providers, and Kurdish websites in the Netherlands. Between 2017 and 2019, the APT group mainly used DNS hijacking in its campaigns.

IT 346

IT Passwords Government Archiving 346

Security Affairs

DECEMBER 23, 2021

In the initial attacks observed by the researchers, the malicious code downloads a Microsoft Cabinet (CAB) archive containing a malicious executable. When Microsoft’s patch closed that loophole, attackers discovered they could use a different attack chain altogether by enclosing the maldoc in a specially-crafted RAR archive.”reads

Archiving 363

Archiving File names Security Ransomware 363

Security Affairs

SEPTEMBER 19, 2021

“Some Numando variants store these images in an encrypted ZIP archive inside their.rsrc sections, while others utilize a separate Delphi DLL just for this storage. The installer contains a CAB archive with a legitimate application, an injector, and an encrypted Numando banking trojan DLL. ” continues the report.

Archiving 348

Archiving Encryption IT Security 348

Security Affairs

JUNE 21, 2021

The group published the link to 13 password-protected archives, allegedly containing sensitive data stolen from the chipmaker. Attention Password for the Archives: XXXXXXXXXXX#1JLDiw8″ reads the post published by the group on its leak site. !! The gang also published some screenshots as proof of data possession.

Ransomware 360

Ransomware Archiving Passwords Authentication 360

Security Affairs

APRIL 22, 2024

The disclosure of data in the archive poses a threat to the individuals whose data it contains. The disclosure of data in the archive poses a threat to the individuals whose data it contains. A financially motivated group named GhostR claims the theft of a sensitive database from World-Check and threatens to publish it.

Risk 343

Risk Archiving Access Privacy 343

Security Affairs

MARCH 12, 2021

zipx file is a ZIP archive compressed using the most recent compression methods of the WinZip archiver to provide optimal results. 7Zip initially tries to open the files as a ZIP archive and fails, but afterward, 7Zip recognizes the.zipx files as Rar5 archives and can get their contents unpacked. The emails use a.

Archiving 358

Archiving Access Security IT 358

Krebs on Security

FEBRUARY 4, 2025

Those archived webpages show both RDP services were owned by an entity called 1337 Services Gmbh. A review of those messages archived by Intel 471 showed that dozens of early forum members referred privately to Finndev as the owner of shoppy[.]gg “Finndev.” ” Image: Ke-la.com. 30, the U.S. io , and rdp[.]sh.

Archiving 205

Archiving Passwords Government IT 205

Security Affairs

OCTOBER 13, 2023

The threat actors leverage spear-phishing emails to deliver archive files utilizing DLL side-loading schemes. All the tools connect to the same infrastructure, which is associated with China-linked APT ToddyCat. ” reads the analysis published by Checkpoint. report – CurKeep collects information about the infected machine.

Government 324

Government IT Encryption Libraries 324

Security Affairs

MARCH 7, 2024

export=download&id=1uRaMFq3jVR3yhcdRbBvuGdq-jLBLKtTH drops /kholapqua.com/Document.zip [link] pic.twitter.com/Y9CpY8xyLU — idclickthat (@idclickthat) August 17, 2023 Threat actors sent Facebook messenger direct messages to the victims attempting to trick them into downloading archive files such as RAR or ZIP files.

Archiving 349

Archiving Cybersecurity IT Information Security 349

Security Affairs

AUGUST 17, 2024

Researchers from VX-underground reviewed the archive (277.1GB uncompressed) and confirmed the that data is real and accurate. The archive also contains data on deceased individuals. “Many of these files are archives themselves, with many of those then containing yet more archives.

Data breaches 353

Data breaches Archiving Sales Personal data 353

Security Affairs

SEPTEMBER 20, 2021

The expert discovered the unsecured database on August 22, 2021, and immediately notified the Thai authorities, he noticed that some of the data stored in the archive date back ten years. While the IP address of the database is still public, the database was taken offline and has been replaced with a honeypot.

Honeypots 362

Honeypots Archiving Personal data Cybersecurity 362

Security Affairs

FEBRUARY 29, 2024

The PDF included a link to a fake questionnaire that redirects users to a mailcious ZIP archive hosted on a compromised site. The ZIP archive contains an HTA file named wine.hta that contains obfuscated JavaScript code. The ZIP archive contains an HTA file named wine.hta that contains obfuscated JavaScript code.

Archiving 326

Archiving File names IT Information Security 326

Security Affairs

AUGUST 4, 2024

” Researchers from VX-underground reviewed the archive (277.1GB uncompressed) and confirmed the that data is real and accurate. .” ” Researchers from VX-underground reviewed the archive (277.1GB uncompressed) and confirmed the that data is real and accurate. The archive also contains data on deceased individuals.

Data breaches 363

Data breaches Personal data Sales Archiving 363

Security Affairs

AUGUST 5, 2021

Now one of its affiliates leaked the IP addresses for Cobalt Strike C2 servers and an archive of 113 MB that includes training material and tools shared by the Conti operators with its network to conduct ransomware attacks. The Conti Ransomware operators offer their services to their affiliates and maintain 20-30% of each ransom payment.

Ransomware 339

Ransomware Archiving IT Security 339

Security Affairs

DECEMBER 20, 2021

The DarkWatchman has been distributed through phishing emails that use malicious ZIP archives (named ‘????????? ?12-6317-3621.zip’ The executable is a self-installing WinRAR archive that will install the RAT and keylogger. “This executable is a WinRAR SFX self installing archive that contains two files: ‘134121811.js’

Archiving 352

Archiving Communications Ransomware Phishing 352

Security Affairs

JANUARY 17, 2024

The log file is stored in a sysdiagnose (sysdiag) archive. . “When a user initiates a reboot, the operating system attempts to gracefully terminate running processes before rebooting. If a “client” process is still running when the reboot activity begins, it is logged with its process identifier (PID) and corresponding filesystem path.”

Archiving 347

Archiving Cybersecurity IT Access 347

Data Breach Today

MAY 30, 2024

Also: Okta Alert on Credential Stuffing; Data Breaches in Spain This week, Google AI search provided wrong answers, Internet Archive suffered DDos attack, Okta warned of credential stuffing, Canada shut down two tech firms, attackers delivered malware with Stack Overflow, Telefónica is probing breach, Iberdrola was breached and RansomHub said it hit (..)

Data breaches 304

Data breaches Archiving IT 304

Security Affairs

OCTOBER 9, 2024

The implant was distributed through malicious URLs in phishing emails, while the attackers used methods like self-extracting archives and Golang droppers in previous campaigns. The Awaken Likho group is now using a 7-Zip self-extracting archive that displays a decoy document while covertly installing the MeshAgent tool.

Government 299

Government Archiving Phishing Access 299

Security Affairs

APRIL 22, 2024

The expert exploiting this known issue discovered the following vulnerabilities: CVE-2023-36396 Windows Compressed Folder Remote Code Execution Vulnerability – The RCE issue resides in Windows’s new extraction logic for all newly supported archive types. ” wrote Or Yair. CVE-2023-42757 was reserved for this vulnerability by MITRE.

Archiving 343

Archiving Access Security Risk 343

Security Affairs

NOVEMBER 5, 2023

The attackers attempted to trick victims into downloading and decompress a ZIP archive (Cross-Platform Bridges.zip) containing the malicious Python code masqueraded by an arbitrage bot. log – SUGARLOADER Stage 3 (Loader)- Discord (fake) – HLOADER Stage 4 (Payload) – KANDYKORN Decompressing the archive, it reveals a Main.py

Blockchain 318

Blockchain Archiving Military Encryption 318

Security Affairs

JANUARY 2, 2024

The content of the messages attempted to trick the recipients into opening a password-protected RAR archive. Once the archive is opened, the infection chain starts leading to the deployment of the JinxLoader payload. The attack spotted by the researchers used phishing messages posing as Abu Dhabi National Oil Company (ADNOC).

Archiving 347

Archiving Passwords Phishing IT 347

Security Affairs

APRIL 5, 2022

Upon opening the file, a RAR-archive named “Viyskovi_zlochinci_RU.rar” is created. . The archive contains a link file named “War criminals destroying Ukraine (home addresses, photos, phone numbers, pages on social networks).lnk,” The phishing messages have been sent from “vadim_melnik88@i[.]ua,”

Military 343

Military Phishing Archiving File names 343

Security Affairs

NOVEMBER 20, 2023

The economically motivated APT group used specially crafted archives in phishing attacks against forum users through online trading forum posts. NSFOCUS Research Labs observed DarkCasino implementing two attack processes using specially crafted weaponized archives. ” reads the report published by NSFOCUS.

Phishing 362

Phishing Archiving Financial Services Cybersecurity 362

Security Affairs

JANUARY 6, 2022

zip” (“congratulation” in Russian) instead of weaponized office documents, The archive containsand executable that acts as the first stage malware. The Windows x32 executable in the archive, named “????????????.scr,” .” reads the report published by Cluster25. The spoofed messages used a *@mid.ru

Phishing 363

Phishing Archiving IT Security 363

Security Affairs

JULY 20, 2024

The attackers attempted to trick the company’s customers into opening a ZIP archive file named “ crowdstrike-hotfix.zip.” ” The archive includes a loader named Hijack Loader used to execute the Remcos RAT. The ZIP archive contains a HijackLoader payload that, when executed, loads RemCos.

File names 250

File names Archiving Cybersecurity Communications 250

Security Affairs

MAY 25, 2024

com : Distributes a ZIP archive file (“setup-win-x86-x64.exe.zip”) pro : Distributes a RAR archive file (“MBSetup.rar”) that was used to deploy the StealC information stealer malware. Below is the list of malicious websites analyzed by the researchers: avast-securedownload[.]com bitdefender-app[.]com

Archiving 340

Archiving Mining Information Security IT 340

Security Affairs

JUNE 30, 2023

The attackers sent the password for the RAR archive in a separate email. Volexity first spotted the POWERSTAR backdoor in 2021, the experts observed the Iranian APT distributing the malicious code in a surprising number of different ways. ” continues the report.

IT 246

IT Phishing Cleanup Passwords 246