Security Affairs

JULY 12, 2021

Once again, an archive of data collected from hundreds of millions of LinkedIn user profiles surfaced on a hacker forum, where it’s currently being sold for an undisclosed sum. LinkedIn’s refusal to treat malicious scraping as a security problem can potentially allow cybercriminals to gather data on new victims with impunity.

Archiving 361

Archiving Passwords Data collection Sales 361

Security Affairs

AUGUST 12, 2024

Threat actors sent phishing emails with RAR archive attachments containing a Windows shortcut to install malware. “Attackers use the classic DLL sideloading technique: when the desktop.exe file is launched, the malicious VERSION.dll library is loaded into the corresponding process” reads the report published by Kaspersky.

Libraries 343

Libraries Encryption Cloud Archiving 343

Security Affairs

JULY 17, 2024

Trend Micro researchers discovered that the flaw was actively exploited in the wild in May and reported it to Microsoft which addressed the zero-day with the July 2024 Patch Tuesday security updates. The archives are disseminated in cloud-sharing websites, Discord servers, and online libraries, and other means.

Archiving 319

Archiving Ransomware Libraries Passwords 319

Security Affairs

JULY 25, 2021

Security researchers from Trend Micro continues to monitor the evolution of the XCSSET macOS malware, new variants are able to steal login information from multiple apps, including Telegram and Google Chrome, and send them to C2. The post XCSSET MacOS malware targets Telegram, Google Chrome data and more appeared first on Security Affairs.

Libraries 286

Libraries Passwords Archiving Access 286

Security Affairs

MARCH 28, 2019

The recently patched vulnerability affecting the popular archiver utility WinRAR has been exploited to deliver new malware to targeted users. The flaw is an “Absolute Path Traversal” issue in the library that could be exploited to execute arbitrary code by using a specially-crafted file archive. Pierluigi Paganini.

Archiving 272

Archiving File names Education Libraries 272

Security Affairs

MAY 23, 2024

The messages use specially crafted archives containing LNK files disguised as regular documents. These archives mimicked the installation process of Microsoft Defender or exploited current US political issues. Upon receiving a request, it executes the encoded JavaScript code using the Microsoft.JScript library.

Archiving 332

Archiving Military Communications Phishing 332

Security Affairs

JUNE 8, 2022

0patch researchers released an unofficial security patch for a Windows zero-day vulnerability dubbed DogWalk. 0patch released an unofficial security patch for a new Windows zero-day vulnerability in the Microsoft Support Diagnostic Tool (MSDT) dubbed DogWalk. The expert warned to pay special attention to not open .diagcab

Security 246

Security File names Libraries Archiving 246

Security Affairs

MAY 31, 2020

Every week the best security articles from Security Affairs free for you in your email box. The post Security Affairs newsletter Round 266 appeared first on Security Affairs. A new round of the weekly SecurityAffairs newsletter arrived! NetWalker ransomware gang threatens to release Michigan State University files.

Security 213

Security Data breaches Ransomware Sales 213

The Texas Record

DECEMBER 16, 2020

When most people think of archives, the first thing that comes to mind is Indiana Jones swinging on vines and storing artifacts in giant rooms. While that is an interesting popular image, the archives and archivists here at the Texas State Library and Archives Commission (TSLAC) are the protectors of documented history.

Archiving 106

Archiving Libraries Paper Access 106

Security Affairs

AUGUST 23, 2024

Cato Security found a new info stealer, called Cthulhu Stealer, that targets Apple macOS and steals a wide range of information. Cado Security researchers have discovered a malware-as-a-service (MaaS) targeting macOS users dubbed Cthulhu Stealer. ” reads the report published by Cado Security.

Passwords 322

Passwords Blockchain Libraries Archiving 322

Security Affairs

MAY 17, 2021

. “Once launched, Bizarro downloads a ZIP archive from a compromised website. While writing this article, we saw hacked WordPress, Amazon and Azure servers used for storing archives. It loads the magnification.dll library and gets the address of the deprecated MagSetImageScalingCallback API function,” continues the analysis.

Archiving 322

Archiving Libraries Authentication IT 322

Security Affairs

DECEMBER 31, 2020

Security Center under the Ministry of National Defense recorded a large number of virus-infected e-mails addressed to several state institutions. The Emotet campaign uses malicious emails that attempt to trick recipients into opening the zipped archive with the password included in the message. Security Center. Security Center.

Passwords 277

Passwords Archiving Libraries Government 277

Security Affairs

MARCH 19, 2019

The ransomware was involved in the attacks observed by the Qihoo 360 Threat Intelligence Center in the wild, threat actors used an archive named “vk_4221345.rar” The attacker lures victims to decompress the archive through embedding a corrupt and incomplete female picture. rar” that delivers JNEC. bitcoins (about $200).

Ransomware 260

Ransomware Archiving Encryption Libraries 260

Security Affairs

SEPTEMBER 12, 2018

Security experts from Trend Micro have spotted a new strain of ransomware involved in attacks in July and August, the malicious code was posing as the Locky ransomware. exe will drop malware components — several C++ and Python libraries and the Python 2.7 “The malicious URL leads to a ZIP file (Facture_23100.31.07.2018.zip)

Ransomware 276

Ransomware Libraries Encryption Archiving 276

Security Affairs

SEPTEMBER 24, 2023

BBTok is written in Delphi and uses the Visual Component Library (VCL) to dynamically generate interfaces. Upon clicking the link, it results in the download of either a ZIP archive or an ISO image, depending on the operating system of the victim’s machine. The phishing messages include a malicious link.

Phishing 345

Phishing Libraries Archiving IT 345

Security Affairs

APRIL 8, 2021

An archive containing data purportedly scraped from 500 million LinkedIn profiles has been put for sale on a popular hacker forum, with another 2 million records leaked as a proof-of-concept sample by the post author. Consider using a password manager to create strong passwords and store them securely. Original Post at [link].

Passwords 361

Passwords Phishing Personal data Libraries 361

Security Affairs

FEBRUARY 16, 2019

Researchers at Cybereason’s Nocturnus team have uncovered a new Astaroth Trojan campaign that is currently exploiting the Avast antivirus and security software developed by GAS Tecnologia to steal information and drop malicious modules. 7zip file as an attachment or include a hyperlink that points to the archive.

Passwords 279

Passwords Archiving Libraries Security 279

Security Affairs

JULY 14, 2021

The Dropbox link leads to a RAR archive that masquerades as a Word document by setting the “file_subpath” parameter to point to a filename with a.DOCX extension. “The archive contains two malicious DLL libraries as well as two legitimate executables that sideload the DLL files. Pierluigi Paganini.

Archiving 246

Archiving File names Government Libraries 246

Security Affairs

NOVEMBER 10, 2019

The best news of the week with Security Affairs. A flaw in the Libarchive library impacts major Linux distros. Specially Crafted ZIP archives allow bypassing secure email gateways. DNA-testing startup Veritas Genetics disclosed a security breach. A new round of the weekly newsletter arrived! Pierluigi Paganini.

Security 165

Security Ransomware Libraries Archiving 165

Security Affairs

JUNE 7, 2024

The UA-CERT states that the “sync.exe” file contains the legitimate SyncThing components and SPECTR malware files, including additional libraries and scripts.

Archiving 210

Archiving Libraries Phishing Passwords 210

Security Affairs

JANUARY 29, 2023

This forum hosted a ZIP archive that contains the malicious.js Below is the attack chain of this new variant: The user visits an UNC2565-compromised site (usually related to business documents) and downloads a malicious ZIP archive. Recently observed trojanized JavaScript libraries include jQuery, Chroma.js, and Underscore.js.

Libraries 246

Libraries Archiving Ransomware IT 246

Security Affairs

AUGUST 17, 2018

The security researcher Sam Thomas from Secarma, has discovered a new attack technique that leverages critical deserialization vulnerabilities in PHP programming language. Phar archives are similar to Java JAR archives but are specific for PHP applications. A Phar application or library could be distributed in a single file.

Archiving 190

Archiving Metadata Libraries Authentication 190

Security Affairs

DECEMBER 3, 2018

Security experts at HackenProof are warning Open Elasticsearch instances expose over 82 million users in the United States. Elasticsearch is a Java-based search engine based on the free and open-source information retrieval software library Lucene. ” reads a blog post published by HackenProof. citizens (i.e. citizens (i.e.

Data breaches 279

Data breaches Libraries Analytics Archiving 279

Security Affairs

JULY 21, 2021

The leak comes more than four months after Humana, the third-largest health insurance company in the US, notified 65,000 of its health plan members about a security breach where “a subcontractor’s employee disclosed medical records to unauthorized individuals” between October 12, 2020, and December 16, 2020. What was leaked?

Insurance 306

Insurance Passwords Libraries Access 306

eSecurity Planet

SEPTEMBER 22, 2022

Trellix security researchers have revealed a major vulnerability in the Python tarfile library that could be exploited in software supply chain attacks. See the Top Code Debugging and Code Security Tools. The post Unpatched Python Library Affects More Than 300,000 Open Source Projects appeared first on eSecurityPlanet.

Libraries 113

Libraries Archiving Risk Security 113

Security Affairs

JULY 8, 2023

The spear-phishing message appears as a benign conversation lure masquerading as a senior fellow with the Royal United Services Institute (RUSI) to the public media contact for a nuclear security expert at a US-based think tank focused on foreign affairs. The.rar archive contained a dropper named “Abraham Accords & MENA.pdf.lnk.”

Archiving 246

Archiving Cloud File names Metadata 246

Security Affairs

OCTOBER 13, 2023

The threat actors leverage spear-phishing emails to deliver archive files utilizing DLL side-loading schemes. The CurKeep payload is very small, it is 10kb in size, contains 26 functions and is not statically compiled with any library. appeared first on Security Affairs. Is it linked to ToddyCat APT?

Government 327

Government IT Encryption Libraries 327

Security Affairs

DECEMBER 19, 2019

The most serious issue is related to the Archive_Tar third-party library, it has been assigned a severity rating of critical. Archive_Tar is a tool designed for handling TAR archive files in PHP. ” reads the security advisory published by Drupal for the vulnerability SA-CORE-2019-012. The issue affects Drupal 7x, 8.7.x

CMS 182

CMS Libraries Archiving Access 182

Preservica

MARCH 18, 2022

Academic libraries are in the midst of rapid, widespread changes as it shifts into the digital age. Our libraries have been a steady flame for patrons to depend on, not just throughout the pandemic, but throughout history. See how Preservica customers are creating engaging internal and public access.

Libraries 96

Libraries Digital preservation Archiving e-Discovery 96

Security Affairs

FEBRUARY 13, 2023

The attack chain starts with phishing emails or social media messages distributing a RAR archive. The archive contains two files, Interview questions.txt, and Interview conditions.word.exe. The files pose an interview for a fake cryptocurrency role or job opening. ” continues the report.

Archiving 246

Archiving File names Libraries Phishing 246

Security Affairs

FEBRUARY 25, 2023

The experts noticed that both the Domino and Agile software appear to be using old certificates and the Agile servers use old vulnerable libraries. The attackers used two legitimate software packages, the HCL Domino (formerly IBM Domino) and the Agile DGS and Agile FD servers. Modified versions of the publicly available Lilith RAT.

Passwords 246

Passwords Libraries Archiving Access 246

Security Affairs

SEPTEMBER 3, 2020

The second layer of Python code decodes and loads to memory the main RAT and the imported libraries. The new infection chain starts by including just one LNK file in the ZIP archive attached to spear-phishing messages. The post Evilnum APT used Python-based RAT PyVil in recent attacks appeared first on Security Affairs.

Phishing 363

Phishing Encryption File names Metadata 363

Security Affairs

MAY 7, 2022

“This launcher, dropped into the Tasks directory by the first stager, proxies all calls to wer.dll and its exports to the original legitimate library. The attack chain aims at distributing.RAR archive from the legitimate site file.io .” continues the analysis. Threat actors also used to sign modules to avoid detection.

Encryption 251

Encryption Libraries Archiving Communications 251

Security Affairs

JULY 14, 2021

These malware are the most predominant malware in macOS, also with a history of evading and bypassing the built-in Xprotect, Gatekeeper, Notarization and File Quarantine security features of macOS. funzip is a macOS utility that extracts a ZIP or gzip file directly to output from archives or other piped input.

Encryption 330

Encryption Passwords Libraries Security 330

Security Affairs

AUGUST 3, 2018

“For example, the archive mentioned above contains an executable file, which has the same name and is a password-protected self-extracting archive. The archive extracts the files and runs a script that installs and launches the actual malware in the system.” states the researchers. Pierluigi Paganini.

Phishing 174

Phishing Libraries Passwords Archiving 174

Security Affairs

SEPTEMBER 24, 2021

billion entries but is also willing to split the archive into smaller portions for potential buyers. To see if any of your online accounts were exposed in previous security breaches, use our personal data leak checker with a library of 15+ billion breached records. The poster is asking $100,000 for the full database of 3.8

Sales 282

Sales Passwords Personal data Phishing 282

Security Affairs

JULY 1, 2021

The archive was posted on the hacker forum for anyone to access. To see if any of your online accounts were exposed in previous security breaches, use our personal data leak checker with a library of 15+ billion breached records. What was shared by the threat actor? Follow me on Twitter: @securityaffairs and Facebook.

Data breaches 260

Data breaches Sales Data collection Libraries 260