Security Affairs

JUNE 26, 2023

China-linked APT group VANGUARD PANDA, aka Volt Typhoon, was spotted observing a novel tradecraft to gain initial access to target networks. CrowdStrike researchers observed the China-linked APT group VANGUARD PANDA, aka Volt Typhoon , using a novel tradecraft to gain initial access to target networks. ” concludes the report.

Cleanup 246

Cleanup Libraries Access Manufacturing 246

Security Affairs

NOVEMBER 20, 2023

The Rhysida ransomware group claimed responsibility for the recent cyberattack on the British Library that has caused a major IT outage. The ransomware group claims to have stolen a substantial trove of ‘impressive data’ and is auctioning it for 20 BTC. The victims of the group are “targets of opportunity.”

Libraries 351

Libraries Ransomware Manufacturing Education 351

Security Affairs

SEPTEMBER 25, 2023

A stealthy APT group tracked as Gelsemium was observed targeting a Southeast Asian government between 2022 and 2023. Palo Alto Unit42 researchers an APT group tracked as Gelsemium targeting a Southeast Asian government. Gelsemium is a group focused on cyberespionage that has been active since at least 2014.

Government 336

Government Manufacturing Education Access 336

Security Affairs

FEBRUARY 8, 2024

The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure. In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.

Energy and Utilities 340

Energy and Utilities Communications Military Manufacturing 340

Security Affairs

MAY 5, 2021

The group targeted the organization with phishing attacks aimed at spreading at least three new sophisticated malware strains. FireEye’s Mandiant unit observed two distinct waves of attacks carried out by the cybercrime group in December 2020. ” states the analysis published by FireEye.

Manufacturing 339

Manufacturing Phishing Military Retail 339

Security Affairs

MAY 7, 2021

Hancitor became another commodity malware which partnered with ransomware gangs to help them gain initial access to target networks – the increasing trend outlined by Group-IB researchers in the recent Ransomware Uncovered 2020/2021 report. In addition, the group leveraged some custom tools for network reconnaissance. exe: Figure 3.

Ransomware 332

Ransomware Education Manufacturing Healthcare 332

Security Affairs

NOVEMBER 16, 2022

DTrack is a modular backdoor used by the Lazarus group since 2019 , it was employed in attacks against a wide variety of targets, from financial environments to a nuclear power plan. The second stage payload is a heavily obfuscated shellcode, the APT group used an encryption method different for each sample.

Manufacturing 354

Manufacturing Education Encryption IT 354

Data Breach Today

JUNE 26, 2023

Group Targeting Transportation, Construction, Government Agencies, CrowdStrike Says A Chinese state hacker is using novel tradecraft to gain initial access to victim systems, according to CrowdStrike.

Manufacturing 147

Manufacturing Education Communications Government 147

Security Affairs

JUNE 6, 2022

The IT giant has seized the domains used by the threat actors employed in its attacks aimed at organizations in tech, transportation, government, and education sectors located in the U.S., The APT group created fake social media profiles, often posing as recruiters, then used them to trick targets into providing personal information.

Phishing 338

Phishing Manufacturing Education Cybersecurity 338

Security Affairs

FEBRUARY 19, 2024

Lockbit ransomware group administrative staff has confirmed with us their websites have been seized. In 2022, LockBit was one of the most active ransomware groups, and its prevalence continued into 2023.

Energy and Utilities 338

Energy and Utilities Ransomware Agriculture Financial Services 338

Security Affairs

OCTOBER 28, 2020

Steelcase is a US-based furniture company that produces office furniture, architectural and technology products for office environments and the education, health care and retail industries. It is the largest office furniture manufacturer in the world. Steelcase has 13,000 employees and $3.7 billion in 2020.

Ransomware 324

Ransomware Computer and Electronics Manufacturing Mining 324

Security Affairs

DECEMBER 13, 2023

The group managed to maintain access without being detected for as long as possible. The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure. The APT group is using almost exclusively living-off-the-land techniques and hands-on-keyboard activity to evade detection.

Communications 340

Communications Manufacturing Education Government 340

Security Affairs

APRIL 19, 2024

The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure. In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.

Energy and Utilities 331

Energy and Utilities Communications Military Access 331

Security Affairs

SEPTEMBER 15, 2024

Port of Seattle confirmed on Friday that the Rhysida ransomware group was behind the cyberattack that hit the agency in August. Port of Seattle confirmed on Friday that the Rhysida ransomware group was behind the cyberattack. The Rhysida ransomware group has been active since May 2023.

Ransomware 324

Ransomware Manufacturing Education Encryption 324

Security Affairs

FEBRUARY 21, 2024

. “The Department of State is announcing reward offers totaling up to $15 million for information leading to the arrest and/or conviction of any individual participating in a LockBit ransomware variant attack and for information leading to the identification and/or location of any key leaders of the LockBit ransomware group.”

Energy and Utilities 334

Energy and Utilities Ransomware Agriculture Manufacturing 334

Security Affairs

DECEMBER 19, 2022

The Qilin ransomware-as-a-service (RaaS) group uses a double-extortion model, with most of the victims in the manufacturing and IT industries. The ransomware was originally written in Go language and was employed in attacks aimed at healthcare and education sectors in countries like Thailand and Indonesia. AGENDA.THIAFBB.”

Ransomware 357

Ransomware Encryption Passwords Education 357

Security Affairs

JUNE 6, 2024

.” The operation led to the arrest of two members of the ransomware gang in Poland and Ukraine and the seizure of hundreds of crypto wallets used by the group. The authorities also seized the dark web Tor leak site used by the group. It was the first time that the admin of the notorious group was identified by law enforcement.

Energy and Utilities 343

Energy and Utilities Ransomware Agriculture Encryption 343

Security Affairs

FEBRUARY 20, 2024

Lockbit ransomware group administrative staff has confirmed with us their websites have been seized. pic.twitter.com/SvpbeslrCd — vx-underground (@vxunderground) February 19, 2024 The operation led to the arrest of two members of the ransomware gang in Poland and Ukraine and the seizure of hundreds of crypto wallets used by the group.

Energy and Utilities 334

Energy and Utilities Ransomware Manufacturing Agriculture 334

Security Affairs

OCTOBER 30, 2021

The list was published with the intent of raising awareness of common hardware weaknesses through CWE and educating designers and programmers on how to address them as part of the product development lifecycle. . The list includes a total of 12 vulnerabilities entries that had a score from 1.03 to 1.42 (the highest possible score was 2.0).

Manufacturing 364

Manufacturing Access Education Security 364

Security Affairs

SEPTEMBER 23, 2023

MILES/CBS NEWS TEXAS The Royal ransomware group is behind the attack and threatens to publish stolen data if the City will not meet its ransom demand. Once obtained access to the City’s network, the group performed reconnaissance and information-gathering activities using legitimate third-party remote management tools.

Ransomware 336

Ransomware Encryption Systems administration Cybersecurity 336

Security Affairs

FEBRUARY 12, 2024

The Rhysida ransomware group has been active since May 2023. The ransomware gang hit organizations in multiple industries, including the education, healthcare, manufacturing, information technology, and government sectors. The victims of the group are “targets of opportunity.”

Ransomware 327

Ransomware Encryption Paper Manufacturing 327

Security Affairs

AUGUST 27, 2024

China-linked APT group Volt Typhoon exploited a zero-day flaw in Versa Director to upload a custom webshell in target networks. The company confirmed that at least one APT group actively exploited the flaw in the wild. The group also relies on customized versions of open-source tools for C2 communications and to stay under the radar.

Energy and Utilities 327

Energy and Utilities Communications Authentication Access 327

Security Affairs

AUGUST 25, 2023

China-linked APT group Flax Typhoon targeted dozens of organizations in Taiwan as part of a suspected espionage campaign. The group relies on tools built into the operating system, along with some legitimate software. The group primarily relies on living-off-the-land techniques and hands-on-keyboard activity.

Manufacturing 246

Manufacturing Education Access Government 246

Security Affairs

MAY 25, 2023

A China-linked APT group, tracked as Volt Typhoon, breached critical infrastructure organizations in the U.S. China-linked APT cyber espionage group Volt Typhoon infiltrated critical infrastructure organizations in the U.S. The group managed to maintain access without being detected for as long as possible.

Communications 246

Communications Manufacturing Access Archiving 246

Security Affairs

JUNE 15, 2023

The LockBit ransomware group successfully extorted roughly $91 million from approximately 1,700 U.S. According to a joint advisory published by cybersecurity agencies, the LockBit ransomware group has successfully extorted roughly $91 million in about 1,700 attacks against U.S. organizations since 2020. organizations since 2020.

Ransomware 246

Ransomware Cybersecurity Agriculture Education 246

Security Affairs

APRIL 5, 2023

A series of vulnerabilities in multiple smart devices manufactured by Nexx can be exploited to remotely open garage doors, and take control of alarms and plugs. “Nexx has not replied to any correspondence from myself, DHS (CISA and US-CERT) or VICE Media Group.” ” reads a post published by Sabetan.

Manufacturing 246

Manufacturing Cybersecurity Education Authentication 246

Security Affairs

APRIL 16, 2023

It manufactures self-service kiosks, point-of-sale terminals, automated teller machines, check processing systems, and barcode scanners. NCR is suffering an outage on its Aloha point of sale platform since Wednesday after it was hit by a ransomware attack conducted by the BlackCat/ALPHV ransomware group.

Ransomware 246

Ransomware Sales Manufacturing Cybersecurity 246

Security Affairs

FEBRUARY 28, 2024

“These operations have targeted various industries, including Aerospace & Defense, Education, Energy & Utilities, Governments, Hospitality, Manufacturing, Oil & Gas, Retail, Technology, and Transportation. ” reads the joint report. reads the press release published by DoJ.

Energy and Utilities 333

Energy and Utilities Military Government Phishing 333

Krebs on Security

NOVEMBER 17, 2022

Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. There are multiple examples of ransomware groups doing just that after security researchers crowed about finding vulnerabilities in their ransomware code.

Ransomware 353

Ransomware Encryption Manufacturing Phishing 353

Security Affairs

APRIL 12, 2023

. “Although there is no evidence that the data concerned have been used for fraudulent purposes, out of extreme caution, we invite you to pay particular attention and to verify any contact attempt via e-mail, mail and/or text message that may appear to come from Hyundai Italia or by other entities of the Hyundai Group.

Data breaches 246

Data breaches Manufacturing Cybersecurity Education 246

Security Affairs

JUNE 3, 2023

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. Another option is that BlackSuit emerged from a splinter group within the original Royal ransomware gang.”

Ransomware 246

Ransomware Encryption File names Cybersecurity 246

Security Affairs

MARCH 3, 2023

Unlike other ransomware operations, Royal doesn’t offer Ransomware-as-a-Service, it appears to be a private group without a network of affiliates. Once on the domain controller, the threat actor deactivated antivirus protocols [T1562.001] by modifying Group Policy Objects [T1484.001].” ” reads the alert.

Ransomware 246

Ransomware Encryption Cybersecurity Communications 246

Security Affairs

MAY 4, 2023

MILES/CBS NEWS TEXAS The Royal ransomware group is behind the attack and threatens to publish stolen data if the City will not meet its ransom demand. Unlike other ransomware operations, Royal doesn’t offer Ransomware-as-a-Service, it appears to be a private group without a network of affiliates. Source J.D. reads the alert.

Ransomware 246

Ransomware IT Encryption Education 246

The Last Watchdog

NOVEMBER 12, 2023

This is precisely what the consortium of software companies and device manufacturers, led Google, Amazon and Apple, set out to achieve when Matter was conceived four years ago. It’s important that as consumers are shopping for these smart home devices that they learn to recognize the Matter trademark so that they can make educated decisions.”

Security 276

Security Manufacturing Authentication Marketing 276

Thales Cloud Protection & Licensing

SEPTEMBER 11, 2018

In this blog, and in and accompanying interview with our colleague Daniel Hjort from Nexus Group, we discuss the challenges that industry faces to ensure safe deployment and management of IoT technologies. Typically, when they are manufactured, IoT devices receive their initial identity in the form of a “digital birth certificate.”

Manufacturing 89

Manufacturing IoT Authentication Security 89

Security Affairs

SEPTEMBER 22, 2019

The security researchers Satnam Narang of Tenable reported that tens of thousands of installs are exposed online, the IT ticketing application is widely adopted in several sectors including the healthcare, government, education and manufacturing industry. ” The vulnerability affect product versions prior 3.9.16, from 3.10.0

Access 266

Access Manufacturing Education Security 266

Security Affairs

APRIL 4, 2023

The software is used by organizations in almost every industry, including automotive, food & beverage, hospitality, Managed Information Technology Service Provider (MSP), and manufacturing. AppleJeus is known to be a backdoor used by North Korea-linked Lazarus APT Group.

Manufacturing 246

Manufacturing Cybersecurity Education Security 246