Security Affairs

JUNE 26, 2021

The provided sample of exfiltrated files includes business data and documents, as well as Argus certificates and development files. The sample archive is password protected – but the file names and types are clearly visible. Altus Group has been informed about the new development.

Ransomware 340

Ransomware File names Archiving Encryption 340

Security Affairs

MAY 7, 2021

This includes passwords, usernames, document scans, health records, bank account and credit card details, as well as other essential data, all easily searchable and conveniently stored in one place. Can’t come up with a strong password? Most organizations use databases to store sensitive information. What were we looking at?

Passwords 363

Passwords Authentication Access File names 363

Security Affairs

AUGUST 28, 2024

The group continued to carry out password spray attacks targeting the educational sector for infrastructure procurement and focused on the satellite, government, and defense sectors for intelligence gathering. The first sample, contained in a file named Network Security.zip including: YAHSAT NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20240421.pdf.exe

IT 321

IT Education File names Passwords 321

Security Affairs

APRIL 18, 2021

“The attack begins with a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth).” ” The attack used a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth). .

File names 298

File names Archiving Passwords Communications 298

Security Affairs

MARCH 11, 2019

Experts observed the STOP ransomware installing the Azorult password-stealing Trojan to steal account credentials, cryptocurrency wallets, and more. The STOP ransomware made the headlines because it is installing password-stealing Trojans on the victims’ machines. ” reads a blog post published by Bleepingcomputer.

Encryption 271

Encryption Ransomware Passwords File names 271

Security Affairs

FEBRUARY 16, 2024

Turla operators used the scripts to exfiltrate keys used to secure the password databases of popular password management software. killme” : Create a BAT file (see below) with a name based on the current tick count. The cybersecurity firm identified three different TinyTurla-NG samples, and gained access to two of them.

CMS 343

CMS File names Passwords Access 343

Security Affairs

SEPTEMBER 10, 2020

To access the internal MySQL database, the malware reads credentials from Linknat VOS2009 and VOS3000 configuration files. “Interestingly, the password from the configuration file is stored encrypted. The CDRThief can start from any location on the disk, using any file name. ” continues the analysis.

Metadata 363

Metadata Encryption File names Passwords 363

Security Affairs

NOVEMBER 10, 2022

.” The researchers discovered an Arbitrary File Write vulnerability, an attacker can exploit the issue to control the msPKIAccountCredentials LDAP attribute and add a malicious Roaming Token entry where the identifier string contains directory traversal characters. ” concludes the report.

File names 342

File names Passwords Phishing Encryption 342

Security Affairs

FEBRUARY 23, 2020

The malicious documents trick victims into inserting a password contained in the message to view their contents. The VB script in the maldocs is activated once the user enters the correct password for the document, a technique was already observed by other attackers in the wild.

Government 361

Government File names Passwords Phishing 361

Security Affairs

FEBRUARY 7, 2022

The experts warn that the decryptor consumes most of the processor’s computing power in order to retrieve the password, the cracking process may take up to tens of hours. “During password cracking, all your available processor cores will spend most of their computing power to find the decryption password. .

Ransomware 246

Ransomware Encryption Passwords File names 246

Security Affairs

FEBRUARY 10, 2024

The researchers noticed that the backdoor contained a plist file named ‘test’. Some configurations also include specific instructions about what data to collect, such as the maximum size and maximum number of files, as well as lists of targeted extensions and directories, or directories to exclude” Bitdefender continues.

Ransomware 346

Ransomware File names Passwords IT 346

Security Affairs

OCTOBER 5, 2021

The ransomware operators then executed a tiny Python script (6kb) to encrypt all virtual disks and VM settings files of the virtual machines hosted on the server. ” reads the Sophos analysis. “One by one, the attackers executed the Python script, passing the path to datastore disk volumes as an argument to the script. .”

Encryption 363

Encryption Ransomware File names Passwords 363

Security Affairs

DECEMBER 15, 2021

A suspected ScreenConnect setup MSI appeared to have been delivered in a zipped file named “Special discount program.zip”, suggesting that it arrived in a spear-phishing email.” In the case of two tools – SharpChisel and Password Dumper – identical versions were used in this campaign to those that were documented by Trend.”

File names 282

File names Passwords Phishing Archiving 282

Security Affairs

MARCH 30, 2020

“Current malspam campaigns feature booby-trapped document files named “COVID 19 relief” and subject lines relying on the same theme. Sphinx’s targets have not changed from its past configuration files as it continues to focus on banks in the US, Canada, and Australia.” ” continues the post.”Next,

File names 340

File names Passwords Sales Government 340

Security Affairs

JANUARY 19, 2019

One of the first questions I wanted to answer was: “ What are the most used passwords ? “. I am aware that many researches wrote about the most used passwords, but now I do have the opportunity to measure it. To get real used passwords and to evaluate the reality. So let’s see what are the most used passwords out there!

Data breaches 273

Data breaches Passwords File names Sales 273

Security Affairs

SEPTEMBER 17, 2024

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.” The specific flaw exists within the way Internet Explorer prompts the user after a file is downloaded. reads the advisory published by ZDI. The flaw impacts WhatsUp Gold versions released before 2024.0.0.

IT 319

IT File names Cybersecurity Encryption 319

Security Affairs

JULY 26, 2022

In this campaign, the spam message contains an HTML file that has base64 encoded images and a password-protected ZIP file. The password-protected zip file contains an ISO file (i.e. iso ), and the password for opening it is reported in the HTML file. Report Jul 14 47787.iso

Passwords 260

Passwords File names Libraries Security 260

Security Affairs

JULY 8, 2022

The Taiwanese vendor QNAP is warning of a new family of ransomware targeting its NAS devices using weak passwords. Threat actors are targeting devices exposed online with the SMB service enabled, they perform brute-force attacks against accounts using weak passwords. ” reads the advisory published by the vendor.

Ransomware 273

Ransomware Encryption Passwords File names 273

Security Affairs

JULY 22, 2020

The botnet used a modified version of Mimikatz to steal credentials and any other passwords of the compromised network, then send them back to the C2 for reuse. The C2 share the passwords with other modules that attempt to verify their validity on other systems using SMB and RDP protocols. .

Mining 301

Mining File names Passwords Communications 301

Security Affairs

JULY 17, 2020

Almost every file into the raw folder is malicious so I strongly recommend you to neither open these files, nor misuse the code to prank your friends. Playing with these kits may lead to irreversible consequences which may affect anything from personal data to passwords and banking information. NB: Large File System Hahead.

Phishing 352

Phishing File names Archiving IT 352

Security Affairs

DECEMBER 8, 2021

The metadata stored on the file led the researchers to several WordPress database dumps, which contained multiple administrator usernames and email addresses, as well as the hashed password for the Microsoft Vancouver website.

Passwords 277

Passwords Metadata File names Phishing 277

Security Affairs

SEPTEMBER 16, 2024

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.” “The specific flaw exists within the way Internet Explorer prompts the user after a file is downloaded. ” reads the advisory published by ZDI.

Archiving 342

Archiving File names Libraries Passwords 342

Security Affairs

JUNE 7, 2024

The attacks detected by Akamai exploit the flaws to download a file named “public.txt” from a compromised server in China. This file is saved on victims’ systems as “roeter.php,” likely a misspelling of “router.” ” continues the analysis.

File names 342

File names Passwords Access Cloud 342

Security Affairs

JANUARY 21, 2019

A rogue server could send a LOAD DATA LOCAL statement to the client to get access to any file for which the client has read permission. “In theory, a patched server could be built that would tell the client program to transfer a file of the server’s choosing rather than the file named by the client in the LOAD DATA statement.”

Passwords 279

Passwords File names Access Sales 279

Security Affairs

MAY 31, 2023

Upon analyzing of the impacted UEFI firmware, the researchers identified a file named File Name: 8ccbee6f7858ac6b92ce23594c9e2563ebcef59414b5ac13ebebde0c715971b2.bin .” Firmware security firm Eclypsium said it first detected the anomaly in April 2023. Gigabyte has since acknowledged and addressed the issue.

File names 246

File names Risk Passwords Security 246

Security Affairs

MARCH 17, 2020

This brand new Ursnif campaign is delivered as a malicious mail containing a password protected document: Hash e9697d963d66792a91991e64537707a94f466421615277d91675b83a408eef93 Threat Ursnif document dropper Brief Description Ursnif Document Dropper Password Protected Ssdeep 12288:9ZPntL7GQw8jzl7v4MvvnaTiIY11jTW84LYMdX9:ftXGxQ7vBvvnjVbTWthdt.

Archiving 363

Archiving Passwords Encryption IT 363

Security Affairs

MARCH 1, 2021

. “And if that same site visitor clicks the “direct download link” provided on this page, they receive a.zip archive file with a filename that exactly matches the search query terms used in the initial search, which itself contains another file named in precisely the same way.” ” continues the analysis.

Search queries 313

Search queries CMS Ransomware File names 313

Security Affairs

JUNE 4, 2019

The infection chain is composed by different stages of password protected SFX (self extracting archive), each containing vbs or batch scripts. Execution of “ winupd.exe ” (SFX) and relative password (uyjqystgblfhs). The response body will contain a new executable file, named “jasfix.exe”, representing the new stage.

Archiving 235

Archiving Passwords File names Military 235

Security Affairs

FEBRUARY 8, 2023

It creates temporary files with the “ lock” and “ trash” extensions. It uses hardcoded file names designed to masquerade as Microsoft office executables: OfficeTemplate.exe and MicrosoftOfficeDashboard.exe” reads the analysis published by Symantec.

File names 246

File names Passwords Phishing Encryption 246

Security Affairs

JULY 19, 2018

Thousands of account credentials associated with the popular file storage service Mega have been published online, The former NSA hacker Patrick Wardle, co-founder at Digita Security , discovered in June a text file containing over 15,500 usernames, passwords, and files names.

Data breaches 181

Data breaches IT File names Passwords 181

Security Affairs

SEPTEMBER 10, 2020

To access the internal MySQL database, the malware reads credentials from Linknat VOS2009 and VOS3000 configuration files. “Interestingly, the password from the configuration file is stored encrypted. The CDRThief can start from any location on the disk, using any file name. ” continues the analysis.

Metadata 256

Metadata Encryption File names Passwords 256

Security Affairs

DECEMBER 5, 2021

Upon executing the fake installers, they execute the following pieces of malware on the victim’s system: A password stealer called RedLine Stealer. The installer has many different file names. The group resurfaced in April 2021, the malvertising campaigns targeted users in Canada, the U.S., For example: viber-25164.exe,

Sales 255

Sales File names Passwords Access 255

Security Affairs

AUGUST 18, 2023

Then the loaders retrieve a second-stage payload stored in password-protected ZIP archive from Alibaba buckets. “The [HUI] loader is executed through sideloading by legitimate executables vulnerable to DLL hijacking and stages a payload stored in an encrypted file.” ” reads the analysis published by SentinelOne.

Archiving 246

Archiving File names Encryption Passwords 246

Security Affairs

JUNE 6, 2023

. “The stealer then enumerates directories and checks for the presence of targeted files and specific file extensions. If any matches are found, it creates a new, password-protected zip file (zip file name-n.zip) that includes an exact copy of the identified file along with its corresponding folder tree structure.

Ransomware 245

Ransomware Encryption Archiving File names 245

Security Affairs

JULY 22, 2019

The fake profiles asked the victims to open the weaponized excel file named ERFT-Details. ValueVault is a Golang -compiled version of the Windows Vault Password Dumper browser credential theft tool from Massimiliano Montoro , the developer of Cain & Abel. xls that was used as a dropper.

File names 278

File names Phishing Government Passwords 278

Security Affairs

MARCH 28, 2019

The decoy files also included a shortcut file named Thumbs.db.lnk that could be exploited by attacker to steal NTLM hashes from the system. “Upon extraction, WinRAR copies a previously unknown payload we call SappyCache to the Startup folder with the file name ‘ekrnview.exe’.

Archiving 267

Archiving File names Education Libraries 267

Security Affairs

MAY 13, 2023

“Preliminary investigations indicate that Checkmate attacks via SMB services exposed to the internet and employs a dictionary attack to break accounts with weak passwords. Once the attacker successfully logs in to a device, they encrypt data in shared folders and leave a ransom note with the file name “!CHECKMATE_DECRYPTION_README”

Ransomware 246

Ransomware Encryption Passwords File names 246