Security Affairs
AUGUST 28, 2024
The group continued to carry out password spray attacks targeting the educational sector for infrastructure procurement and focused on the satellite, government, and defense sectors for intelligence gathering. The first sample, contained in a file named Network Security.zip including: YAHSAT NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20240421.pdf.exe
Security Affairs
APRIL 22, 2024
This tool modifies a JavaScript constraints file and executes it with SYSTEM-level permissions. Microsoft has observed APT28 using GooseEgg in post-compromise activities against various targets, including government, non-governmental, education, and transportation sector organizations in Ukraine, Western Europe, and North America.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Security Affairs
MARCH 28, 2019
This campaign was carried out by threat actors impersonating an educational accreditation council to hit users in the United States. The attackers used decoy documents apparently coming from the Council on Social Work Education (CSWE), a US association representing social work education. ” continues the analysis.
Security Affairs
APRIL 27, 2020
Moth of the victims belongs to high-tech, wholesale and education sectors. The ransomware also drops on the Desktop 10 text files, named README1.txt txt, The README.txt files include instructions to contact the crooks via an email address in order to receive information on how to make the payments. txt through README10.txt,
Security Affairs
DECEMBER 22, 2022
This group focuses on public school districts and other educational institutions, like other ransomware gangs it implements a double extortion model and publishes data stolen from the victims on a data leak site. The malware dropped ransom notes with the file name “AllYFilesAE” in each encrypted directory.
Security Affairs
APRIL 9, 2023
.” Wi also published two proof-of-concept (PoC) exploits for this vulnerability that can be used to escape the sandbox to create an empty file named “flag” on the host. In October 2022, VM2 maintainers addressed another critical sandbox escape vulnerability tracked as CVE-2022-36067.
Security Affairs
APRIL 24, 2021
“The bot is embedded into the ToxicEye RAT configuration file and compiled into an executable file (an example of a file name we found was ‘paypal checker by saint.exe’). Experts also noticed that the RAT implements Ransomware features such as the ability to encrypt and decrypt victim’s files.
Expert insights. Personalized for you.
321 
Let's personalize your content