Security Affairs

DECEMBER 6, 2022

The encryption and decryption are not robust and the ransomware lack features like Windows Shadow Copy removal, File unlocking for a more thorough impact, Anti-analysis, and Defensive evasion (AMSI bypass, disabling event logging, etc.). At this point in this ransomware, the encryption process has already finished.

Ransomware 354

Ransomware Encryption Libraries IT 354

Security Affairs

JUNE 15, 2022

Hertzbleed attack: Researchers discovered a new vulnerability in modern Intel and AMD chips that could allow attackers to steal encryption keys. Intel provided guidance to mitigate the attack by hardening their libraries and applications. “Hertzbleed is a new family of side-channel attacks: frequency side channels.

Encryption 243

Encryption Libraries Security Cybersecurity 243

Security Affairs

SEPTEMBER 2, 2024

These parameters, managed via the clap::args library, include options like: sleep : Delays execution of the ransomware by a specified number of seconds. ui : Displays real-time progress and statistics of the encryption process, such as the number of files encrypted. ” reported Truesec.

Ransomware 340

Ransomware Encryption Libraries IT 340

Security Affairs

JULY 7, 2022

The development team behind the OpenSSL project fixed a high-severity bug in the library that could potentially lead to remote code execution. The maintainers of the OpenSSL project fixed a high-severity heap memory corruption issue , tracked as CVE-2022-2274 , affecting the popular library. SecurityAffairs – hacking, encryption).

Libraries 324

Libraries Encryption Communications Security 324

Security Affairs

JUNE 17, 2022

Experts discovered a feature in Microsoft 365 suite that could be abused to encrypt files stored on SharePoint and OneDrive and target cloud infrastructure. Researchers from Proofpoint reported that a feature in the in Microsoft 365 suite could be abused to encrypt files stored on SharePoint and OneDrive. ” continues the report.

Libraries 283

Libraries Encryption Ransomware Cloud 283

Security Affairs

JANUARY 17, 2022

Some variants of the ransomware append the English name of the target company to the filenames of the encrypted files. “The SFile ransomware uses the Mbed TLS library, RSA-2048 and AES-256 algorithms for file encryption. as the suffix name. . ” reported The Record. . ” reported The Record. Pierluigi Paganini.

Ransomware 364

Ransomware Encryption Libraries Communications 364

The Last Watchdog

MARCH 24, 2025

Quantum computings ability to break todays encryption may still be years awaybut security leaders cant afford to wait. Related: Quantum standards come of age The real threat isnt just the eventual arrival of quantum decryptionits that nation-state actors are already stockpiling encrypted data in harvest now, decrypt later attacks.

Encryption 130

Encryption Financial Services Risk Libraries 130

Security Affairs

NOVEMBER 2, 2022

The OpenSSL project fixed two high-severity flaws in its cryptography library that can trigger a DoS condition or achieve remote code execution. The OpenSSL project has issued security updates to address a couple of high-severity vulnerabilities, tracked as CVE-2022-3602 and CVE-2022-3786 , in its cryptography library. of the library.

Libraries 311

Libraries Encryption Authentication Communications 311

Security Affairs

AUGUST 12, 2024

. “Attackers use the classic DLL sideloading technique: when the desktop.exe file is launched, the malicious VERSION.dll library is loaded into the corresponding process” reads the report published by Kaspersky. “This library is a backdoor packed with the VMProtect tool.

Libraries 345

Libraries Encryption Cloud Archiving 345

Security Affairs

SEPTEMBER 8, 2024

This issue arises because the GeoTools library API, which GeoServer uses, evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library, allowing arbitrary code execution. GeoServer versions prior to 2.23.6,

Libraries 338

Libraries Encryption Cybersecurity Access 338

Security Affairs

APRIL 30, 2020

The malware also downloads the Command-and-control (C2) URLs, C2 communication is encrypted using Base64, RC4, and Curve25519. . Most recent versions of EventBot also include a ChaCha20 library that can improve performance, but it is not currently being used, a circumstance that suggests authors are actively working to optimize EventBot. .

Financial Services 358

Financial Services Libraries Encryption Authentication 358

eSecurity Planet

JANUARY 5, 2024

Strong encryption protects data securely from unauthorized access, but the specific algorithms that qualify as strong encryption change over time as computing power increases and researchers develop new ways to break encryption. What Makes an Encryption Algorithm Strong?

Encryption 124

Encryption Passwords Libraries Security 124

Security Affairs

FEBRUARY 12, 2024

The experts exploited the vulnerability to reconstruct encryption keys and developed a decryptor that allows victims of the Rhysida ransomware to recover their encrypted data for free. Rhysida ransomware employed a secure random number generator to generate the encryption key and subsequently encrypt the data.

Ransomware 327

Ransomware Encryption Paper Manufacturing 327

Security Affairs

OCTOBER 23, 2018

The flaw affects the process implemented by the Signal Desktop application to encrypt locally stored messages. Signal Desktop application leverages an encrypted SQLite database called db.sqlite to store the user’s messages. The encryption key is used each time Signal Desktop application accessed the database.

Encryption 279

Encryption Passwords Libraries Cybersecurity 279

Security Affairs

JANUARY 11, 2022

Another gang, Night Sky ransomware operation, started exploiting the Log4Shell vulnerability in the Log4j library to gain access to VMware Horizon systems. The Night Sky ransomware operation started exploiting the Log4Shell flaw (CVE-2021-44228) in the Log4j library to gain access to VMware Horizon systems.

Ransomware 340

Ransomware Libraries File names Encryption 340

Security Affairs

JULY 1, 2023

This Linux version is 64-bit and also uses the Boost library, it uses the Crypto++ library instead of Windows CryptoAPI. “During the run, the ransomware generates a symmetric encryption key using CryptGenRandom() , which is the random number generator implemented by Windows CryptoAPI. . Bernstein’s implementation ).”

Ransomware 246

Ransomware Encryption Libraries Education 246

Security Affairs

SEPTEMBER 12, 2018

exe will drop malware components — several C++ and Python libraries and the Python 2.7 Core dynamic-link library (DLL) — along with the main ransomware executable (lockyfud.exe, which was created via PyInstaller ) in C:Users{user}AppDataLocalTempis-{random}.tmp.” When successfully run, the Facture_23100.31.07.2018.exe

Ransomware 276

Ransomware Libraries Encryption Archiving 276

Security Affairs

MARCH 19, 2020

” According to the experts, the first infections were observed in late 2019, victims reported their files were encrypted by a strain of malware. locked to the filename of the encrypted files. CERT-FR’s alert states that the Pysa ransomware code based on public Python libraries. newversion file extension instead of.

Ransomware 357

Ransomware Government Encryption Passwords 357

Security Affairs

MARCH 31, 2024

The Linux version of DinodasRAT uses Pidgin’s libqq qq_crypt library functions for encryption and decryption of data. The library uses the Tiny Encryption Algorithm ( TEA ) in CBC mode to cipher and decipher the data. 0x18 DealExShell Execute shell command and send its output to C2. 0x28 DealLocalProxy Send “ok”.

Libraries 362

Libraries Encryption Communications Government 362

Security Affairs

APRIL 3, 2019

. “While continuing to monitor activity of the OceanLotus APT Group, BlackBerry Cylance researchers uncovered a novel payload loader that utilizes steganography to read an encrypted payload concealed within a.png image file.” ” reads the report published by the experts.

Libraries 267

Libraries Encryption Communications Manufacturing 267

Security Affairs

DECEMBER 31, 2021

CVE-2021-45732 : Configuration Manipulation via Hardcoded Encryption Routines. Researchers discovered multiple instances of known vulnerable jQuery libraries (such as jquery 1.4.2), for this reason, they are urging to update them to the latest available versions. CVE-2021-23147 : Insufficient UART Protection Mechanisms.

Communications 359

Communications Libraries Encryption Passwords 359

Security Affairs

FEBRUARY 10, 2020

The good news is that according to the Agency, data was encrypted, it also added that Google and Adobe were not able to see the CP R numbers. “Google Hosted Libraries have been designed to remove all information that allows identifying users before logging on. ” states the Government Agency. “Google has accessed 1.2

Encryption 358

Encryption Libraries Access Government 358

Security Affairs

JULY 5, 2024

Unique features include multiple DNS resolution methods, prioritizing DNS over HTTPS ( DoH ) for command and control (C2) resolution, and using the uncommon Smux library for C2 communication, encrypted via XOR The analysis revealed that Zergeca’s C2 IP address, 84[.]54.51.82, ” concludes.

Encryption 346

Encryption Libraries Communications IT 346

Security Affairs

JULY 14, 2021

The openssl program is a command line tool in macOS for using the various cryptography functions (SSL, TLS) of OpenSSL’s crypto library from the shell. Some of the most commonly seen variants in the wild are: Bash scripts invoking encrypted Zip file Macho Binary downloading a Bash script Bash scripts decoding the payload.

Encryption 332

Encryption Passwords Libraries Security 332

Security Affairs

JULY 30, 2024

These included relocating malicious functions to obfuscated native libraries, using certificate pinning to secure C2 communications, and determine if it was running on a rooted device or in an emulated environment. “In April 2024, we found a suspicious sample that turned out to be a new version of Mandrake.

Libraries 318

Libraries Communications Encryption IT 318

Security Affairs

MAY 9, 2020

The Mac version uses the same AES key and IV as the Linux variant to encrypt and decrypt the config file. Like the Linux variant, the backdoor communicates with the C&C using a TLS connection and encrypts data using the RC4 algorithm. “Both Mac and Linux variants use the WolfSSL library for SSL communications.

Libraries 319

Libraries Communications Encryption Authentication 319

Security Affairs

JANUARY 11, 2019

In this phase, the ransomware sends to the command and control server information on the encryption process, including a string that contains the Initialization Vector (IV) and a random password used by the ransomware to encrypt the files. “To combat this ransomware, Cisco Talos is releasing a free decryption tool.

Ransomware 279

Ransomware Encryption Passwords Libraries 279

Security Affairs

MARCH 17, 2021

According to the experts, the first infections were observed in late 2019, victims reported their files were encrypted by a strain of malware. locked to the filename of the encrypted files. CERT-FR’s alert states that the Pysa ransomware code based on public Python libraries. The malicious code appended the extension .

Education 308

Education Ransomware Encryption Government 308

Security Affairs

FEBRUARY 16, 2021

The “ rlottie ” folder caught their attention, it was the folder used for the Samsung native library for playing Lottie animations, originally created by Airbnb. ” The experts used a fuzzy approach to test the Samsung’s C++ library rlottie to parse Lottie animations and triaging the crashes.

Access 318

Access Libraries Encryption Security 318

Security Affairs

OCTOBER 28, 2021

The encrypted module is subsequently received with a unique identifier – signature – and an additional key for its decryption.” ” Wslink runs as a service and can accept modules in the form of encrypted portal executable (PE) files only from a specific IP address.

Encryption 300

Encryption Libraries Communications Security 300

Security Affairs

FEBRUARY 23, 2019

It is also possible to decrypt single files paying $19.99, in this case, victims have to send the encrypted file to the operators. The ransomware is an ELF ARM binary that does not append a specific extension to the encrypted files. Gillespie says that it matches the encryption algorithm he noted above.”

Ransomware 277

Ransomware Encryption File names Libraries 277

Security Affairs

JULY 24, 2023

OpenSSH (Open Secure Shell) is a set of open-source tools and utilities that provide secure encrypted communication over a network. The vulnerability can be exploited only if certain libraries are installed on systems running the vulnerable versions and the SSH authentication agent is forwarded to an attacker-controlled system.

Libraries 246

Libraries Authentication Encryption Security 246

Security Affairs

NOVEMBER 27, 2018

The Event-Stream library is a very popular NodeJS module used to allow developers the management of data streams, it has nearly 2 million downloads a week. It has been estimated that the tainted version of the library was downloaded by nearly 8 million developers. The malicious code was introduced in the version 3.3.6,

Libraries 263

Libraries Encryption IT Security 263

Security Affairs

JANUARY 6, 2023

One of the most important capabilities of ransomware is the capability of targeting specific files to encrypt. FileCoder and MacRansom use the Linux find utility to search for selected files to encrypt. . However, these same ransomware families differ in encryption logic. ” reads the analysis published by Microsoft.

Ransomware 246

Ransomware Encryption Libraries Security 246

Security Affairs

JULY 16, 2021

The developers are embedding Joker as a payload that can be encrypted in different ways, either a.dex file xored or encrypted with a number, or through the same. dex file as before. The payload is hidden inside an image using steganography to evade scanner detection.

Encryption 363

Encryption Libraries Cloud Security 363

Security Affairs

AUGUST 24, 2022

Tox is a peer-to-peer serverless instant messaging services that uses NaCl for encryption and decryption. The binary is written in C and has only statically linked the c-toxcore library. Threat actors are using the Tox peer-to-peer instant messaging service as a command-and-control server, Uptycs researchers reported.

Communications 346

Communications Ransomware Libraries Encryption 346

Security Affairs

OCTOBER 18, 2022

Spyder Loader loads AES-encrypted blobs to create the wlbsctrl.dll which acts as a next-stage loader that executes the content. Like the sample analyzed by Cyberreason, the Spyder Loader sample analyzed by Symantec uses the CryptoPP C++ library.

File names 327

File names Encryption Manufacturing Libraries 327