File names and Phishing - Information Management Today

PLAYFULGHOST backdoor supports multiple information stealing features

Security Affairs

JANUARY 5, 2025

Google researchers analyzed a new malware family called PLAYFULGHOST that supports multiple features, including keylogging, screen and audio capture, remote shell, and file transfer/execution. The backdoor is distributed through: Phishing emails with themes such as code of conduct to trick users into downloading the malware.

File names

File names Archiving Phishing Encryption

CERT-UA warns of a phishing campaign targeting government entities

Security Affairs

AUGUST 13, 2024

CERT-UA warned that Russia-linked actor is impersonating the Security Service of Ukraine (SSU) in a new phishing campaign to distribute malware. The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new phishing campaign targeting organizations in the country, including government entities.

Phishing

Phishing Government File names Access

A crafty phishing campaign targets Microsoft OneDrive users

Security Affairs

JULY 30, 2024

Researchers detected a sophisticated phishing campaign targeting Microsoft OneDrive users to trick them into executing a PowerShell script. Over the past few weeks, the Trellix Advanced Research Center observed a sophisticated phishing campaign targeting Microsoft OneDrive users. ” reads the report published by Trellix.

Phishing

Phishing File names Archiving Access

Webinars

Automation, Evolved: Your New Playbook For Smarter Knowledge Work

MORE WEBINARS

Glove Stealer bypasses Chrome’s App-Bound Encryption to steal cookies

Security Affairs

NOVEMBER 15, 2024

Gen Digital observed phishing campaigns distributing the Glove Stealer. The campaign observed by researchers used a phishing message with an HTML file attachment. Threat actors relies on social engineering tactics like ClickFix and FakeCaptcha to trick users into executing malicious scripts via PowerShell or Run prompts.

Encryption

Encryption File names Phishing Passwords

Experts warn of a new wave of Bumblebee malware attacks

Security Affairs

OCTOBER 22, 2024

Most Bumblebee infections started by users executing LNK files which use a system binary to load the malware. The malware is distributed through phishing messages using a malicious attachment or a link to the malicious archive containing Bumblebee. “the new Bumblebee payload is delivered via MSI files.

File names

File names Phishing Ransomware Archiving

MikroTik botnet relies on DNS misconfiguration to spread malware

Security Affairs

JANUARY 16, 2025

In late November, the experts spotted a malspam campaign impersonating DHL which used emails about freight invoices, attaching zip files named “Invoice###.zip” The zip archive contains an obfuscated JavaScript file, which creates and executes a PowerShell script that connects to the C2 (62.133.60[.]137),

File names

File names Authentication Access Archiving

Group-IB uncovers PerSwaysion – sophisticated phishing campaign targeting executives worldwide

Security Affairs

APRIL 30, 2020

Group-IB uncovered a new sophisticated phishing campaign, tracked as PerSwaysion, against high-level executives of more than 150 companies worldwide. . PerSwaysion is a highly-targeted phishing campaign. New round of phishing attempts leveraging current victim’s account usually takes less than 24 hours.

Phishing

Phishing Cloud Financial Services Authentication

Introducing the PhishingKitTracker

Security Affairs

JULY 17, 2020

Experts that want to to study phishing attack schema and Kit-composition can use the recently PhishingKitTracker, which is updated automatically. If you are a security researcher or even a passionate about how attackers implement phishing you will find yourself to look for phishing kits. Disclaimer.

Phishing

Phishing File names Archiving IT

Russia-linked Armageddon APT targets Ukrainian state organizations, CERT-UA warns

Security Affairs

APRIL 5, 2022

Ukraine CERT-UA spotted a spear-phishing campaign conducted by Russia-linked Armageddon APT targeting local state organizations. The phishing messages have been sent from “vadim_melnik88@i[.]ua,” The messages use the HTML-file “War criminals of the Russian Federation.htm” as attachment.

Military

Military Phishing Archiving File names

Fake Falcon crash reporter installer used to target German Crowdstrike users

Security Affairs

JULY 28, 2024

On July 24, 2024, CrowdStrike experts identified a spear-phishing campaign targeting German customers by exploiting the recent issue with Falcon Sensor updates. ” The spear-phishing page includes the brands of the targeted company and CrowdStrike. “The website it[.]com min.js” to evade detection.

Passwords

Passwords Phishing File names Metadata

North Korea-linked Kimsuky APT attack targets victims via Messenger

Security Affairs

MAY 17, 2024

The attack chain starts with the theft of the identity of a real person in South Korea, then the victims were contacted via Facebook Messenger. Threat actors pretended to share private documents they had written with the victims. “The initial individual approach is similar to an email-based spear phishing attack strategy.

File names

File names Phishing Communications Security

Chinese APT Earth Baxia target APAC by exploiting GeoServer flaw

Security Affairs

SEPTEMBER 23, 2024

The threat actor used spear-phishing emails and exploited the recently patched GeoServer vulnerability CVE-2024-36401. is a Remote Code Execution (RCE) issue caused by unsafe evaluation of property names as XPath expressions. GeoServer is an open-source server that allows users to share and edit geospatial data.

Phishing

Phishing File names Cloud Government

Crooks target Healthcare facilities involved in Coronavirus containment with Ransomware

Security Affairs

APRIL 14, 2020

PaloAlto Networks experts warn of malicious Coronavirus themed phishing campaigns targeting government and medical organizations. The attacks against the Canadian healthcare organizations were discovered between March 24 and March 26, they started with coronavirus -themed phishing campaigns that were carried out in the last months.

Ransomware

Ransomware Phishing Government File names

Cuba ransomware affiliate targets Ukraine, CERT-UA warns

Security Affairs

OCTOBER 24, 2022

On October 21, 2022, the Ukraine CERT-UA uncovered a phishing campaign impersonating the Press Service of the General Staff of the Armed Forces of Ukraine. The phishing messages included a link to a third-party website for downloading a document titled ‘?????_309.pdf’

Ransomware

Ransomware Phishing File names IT

BlackWater, a malware that uses Cloudflare Workers for C2 Communication

Security Affairs

MARCH 15, 2020

Researchers from MalwareHunterTeam discovered a suspicious RAR file named “COVID-19-” that was being distributed online, likely through phishing emails. "Important The RAR archive contains a file named “Important – COVID-19” that displays a Word icon.

Communications

Communications File names Archiving Phishing

Threat actors leverage Microsoft Teams to spread malware

Security Affairs

FEBRUARY 17, 2022

Once an attacker obtained Microsoft 365 credentials, for example from a previous phishing campaign or data breach, that can access Teams and other Office applications. “Compounding this problem is the fact that default Teams protections are lacking, as scanning for malicious links and files is limited.

File names

File names Phishing Data breaches Access

QNodeService Trojan spreads via fake COVID-19 tax relief

Security Affairs

MAY 16, 2020

Experts spotted a new malware dubbed QNodeService that was involved in Coronavirus-themed phishing campaign, crooks promise victims COVID-19 tax relief. Researchers uncovered a new malware dubbed QNodeService that was employed in a Coronavirus-themed phishing campaign.

Phishing

Phishing File names Access Government

Russia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 Windows flaw

Security Affairs

APRIL 22, 2024

GooseEgg is usually deployed with a batch script, commonly named execute.bat or doit.bat. This script creates a file named servtask.bat, which includes commands for saving or compressing registry hives. Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks.

Military

Military File names Education Phishing

Google TAG: Russia, Belarus-linked APTs targeted Ukraine

Security Affairs

MARCH 8, 2022

The attackers carried out both phishing campaigns and DDoS attacks. This activity ranges from espionage to phishing campaigns.” ” FancyBear has conducted several large credential phishing campaigns aimed at the users of Ukrainian media company UkrNet. ” wrote Shane Huntley, Google’s TAG lead.

Military

Military Phishing File names Government

PLAYFULGHOST backdoor supports multiple information stealing features

Security Affairs

JANUARY 5, 2025

Google researchers analyzed a new malware family called PLAYFULGHOST that supports multiple features, including keylogging, screen and audio capture, remote shell, and file transfer/execution. The backdoor is distributed through: Phishing emails with themes such as code of conduct to trick users into downloading the malware.

File names

File names Archiving Phishing Encryption

Crooks use hidden directories of compromised HTTPS sites to deliver malware

Security Affairs

APRIL 2, 2019

Hacked websites were used for several malicious purposes, experts observed compromised WordPress and Joomla websites serving Shade /Troldesh ransomware, coin miners, backdoors, and some times were involved in phishing campaigns. The attackers use these locations to hide malware and phishing pages from the administrators.

CMS

CMS Phishing Ransomware File names

Xenomorph malware is back after months of hiatus and expands the list of targets

Security Affairs

SEPTEMBER 26, 2023

In August 2023 ThreatFabric discovered new samples distributed via phishing webpages designed to trick recipients into installing malicious APKs. “ThreatFabric was able to identify active campaigns distributing the malware via phishing pages. The list of targets is larger than previous versions.

Phishing

Phishing File names Manufacturing IT

Iran-linked group Cobalt Dickens hit over 60 universities worldwide

Security Affairs

SEPTEMBER 12, 2019

Iran-linked Cobalt Dickens APT group carried out a spear-phishing campaign aimed at tens of universities worldwide. This operation is similar to the threat group’s August 2018 campaign , using compromised university resources to send library-themed phishing emails.” ” reads the analysis published by Secureworks.

Phishing

Phishing Libraries File names Metadata

Iran-linked Seedworm APT targets Telecoms organizations across the Middle East and Asia

Security Affairs

DECEMBER 15, 2021

A suspected ScreenConnect setup MSI appeared to have been delivered in a zipped file named “Special discount program.zip”, suggesting that it arrived in a spear-phishing email.” The malicious archive was likely spread through spear-phishing messages. Evidence of a possible vector was found at only one target.

File names

File names Passwords Phishing Archiving

Evilnum APT used Python-based RAT PyVil in recent attacks

Security Affairs

SEPTEMBER 3, 2020

Attackers carried out spear-phishing emails using the Know Your Customer regulations (KYC) as a lure. The new infection chain starts by including just one LNK file in the ZIP archive attached to spear-phishing messages. The PyVil RAT was recently employed in attacks against FinTech companies across the U.K.

Phishing

Phishing Encryption File names Metadata

New Cyber Attack Campaign Leverages the COVID-19 Infodemic

Security Affairs

FEBRUARY 26, 2020

During our Threat Intelligence activities we noticed a suspicions artifact named “ CoronaVirusSafetyMeasures_pdf ”, so, intrigued by its name and by its recent submission on Yomi Hunter ( LINK ), we decided to deep dive into it. Probably, the infection vector was a phishing mail containing a specific attachment. exe” appeared.

File names

File names Communications Encryption IT

GhostWriter APT targets state entities of Ukraine with Cobalt Strike Beacon

Security Affairs

MARCH 28, 2022

Ukraine CERT-UA uncovered a spear-phishing campaign conducted by Belarus-linked GhostWriter APT group targeting Ukrainian state entities with Cobalt Strike Beacon. The phishing messages use a RAR-archive named “Saboteurs.rar”, which contains RAR-archive “Saboteurs 21.03.rar.”

Archiving

Archiving CMS File names Phishing

Russia-linked APT29 relies on Google Drive, Dropbox to evade detection

Security Affairs

JULY 19, 2022

The phishing messages included a link to a malicious HTML file ( EnvyScout ) that acted as a dropper for additional malicious payloads, including a Cobalt Strike beacon. “Many of these documents appear to be phishing documents associated with common cybercrime techniques. The payload file is an ISO file named Agenda.iso.

Phishing

Phishing Cloud File names Metadata

Cisco confirms that data leaked by the Yanluowang ransomware gang were stolen from its systems

Security Affairs

SEPTEMBER 12, 2022

Once obtained the credentials, the attackers launched voice phishing attacks in an attempt to trick the victim into accepting the MFA push notification started by the attacker. The content of these files match what we already identified and disclosed.” ” reads an update published by Cisco on September September 11, 2022.

Ransomware

Ransomware IT Authentication File names

APT29 abused the Windows Credential Roaming in an attack against a diplomatic entity

Security Affairs

NOVEMBER 10, 2022

Mandiant researchers in early 2022 responded to an incident where the Russia-linked APT29 group (aka SVR group , Cozy Bear , Nobelium , and The Dukes ) successfully phished a European diplomatic entity. Then the attacker can write an arbitrary number of bytes to any file on the file system, posing as the victim account.

File names

File names Passwords Phishing Encryption

Sofacy APT group used a new tool in latest attacks, the Cannon

Security Affairs

NOVEMBER 20, 2018

The Russia-linked APT group delivers Cannon in a spear-phishing attack that targets government organizations in North America, Europe and in a former USSR state. Hackers used weaponized files named ‘crash list (Lion Air Boeing 737).docx’ docx’ for their campaigns.

File names

File names Phishing Communications Government

Specially Crafted ZIP archives allow bypassing secure email gateways

Security Affairs

NOVEMBER 7, 2019

Experts observed a new phishing campaign that used a specially crafted ZIP archive that was designed to bypass secure email gateways to distribute malware. Attackers have devised a new technique to distribute malware bypassing secure email gateways and other security solutions by using a specially crafted ZIP file.

Archiving

Archiving Security File names Phishing

ObliqueRAT, a new malware employed in attacks on government targets in Southeast Asia

Security Affairs

FEBRUARY 23, 2020

The threat actor uses phishing messages with weaponized Microsoft Office documents to deliver the RAT. The maldocs used in this campaign have benign file names such as “Company-Terms.doc”, “DOT_JD_GM.doc.” ” The most recent campaign started in January 2020 and is still ongoing.

Government

Government File names Passwords Phishing

ToxicEye RAT exploits Telegram communications to steal data from victims

Security Affairs

APRIL 24, 2021

Threat actors behind ToxicEye spread the RAT via phishing emails containing a malicious.exe file. “The bot is embedded into the ToxicEye RAT configuration file and compiled into an executable file (an example of a file name we found was ‘paypal checker by saint.exe’).

Communications

Communications File names Encryption Education

New APT34 campaign uses LinkedIn to deliver fresh malware

Security Affairs

JULY 22, 2019

“In late June 2019, FireEye identified a phishing campaign conducted by APT34, an Iranian-nexus threat actor.” The phishing campaign primarily targeted organizations in the energy and oil and gas, along with government entities. The fake profiles asked the victims to open the weaponized excel file named ERFT-Details.

File names

File names Phishing Government Passwords

How to deliver malware using weaponized Microsoft Office docs embedding YouTube video

Security Affairs

OCTOBER 28, 2018

Attackers could use this for malicious purposes such as phishing, as the document will show the embedded online video with a link to YouTube, while disguising a hidden html /javascript code that will be running in the background and could potentially lead to further code execution scenarios.”

File names

File names Phishing Security IT

Microsoft Vancouver leaking website credentials via overlooked DS_STORE file

Security Affairs

DECEMBER 8, 2021

By getting their hands on Microsoft Vancouver’s WordPress login, phishers could use the original Microsoft domain to carry out massive phishing campaigns that would bypass phishing filters. Such phishing messages would be displayed as legitimate emails coming from Microsoft.

Passwords

Passwords Metadata File names Phishing

China-linked threat actors are targeting the government of Ukraine

Security Affairs

MARCH 18, 2022

Google recently announced to have blocked a phishing campaign originating conducted by China-linked cybereaspionage group APT31 (aka Zirconium , Judgment Panda, and Red Keres) and aimed at Gmail users associated with the U.S. government.

Government

Government File names Phishing Security

Russia-linked Gamaredon APT targets Ukrainian authorities with new malware

Security Affairs

FEBRUARY 3, 2023

The attack chain starts with spear-phishing messages with a.RAR attachment named “12-1-125_09.01.2023.” The.RAR archive contains the.LNK file named “Запит Служба безпеки України 12-1-125 від 09.01.2023.lnk” GammaSteel is a PowerShell script used to conduct reconnaissance and execute additional commands.

File names

File names Archiving Phishing Government

Catches of the month: Phishing scams for August 2021

IT Governance

AUGUST 10, 2021

Welcome to August’s review of phishing scams, in which we look at criminals’ latest tactics and provide examples of successful frauds. Microsoft issues alert about “crafty” phishing scams. Security researchers at Microsoft are again warning users about phishing scams imitating SharePoint.

Phishing

Phishing File names Security Risk

Himera and AbSent-Loader Leverage Covid19 lures

Security Affairs

MAY 29, 2020

Researchers at ZLab spotted a new phishing campaign using Covid19 lures to spread Himera and Absent-Loader. . Thus, once clicked, it allows this malicious document to execute a malicious file named HimeraLoader.exe. Introduction. The following picture reports the infection chain used in this campaign: Figure 2: Infection Chain.

File names

File names IT Phishing Marketing

DeathRansom ransomware evolves encrypting files, but experts identified its author

Security Affairs

JANUARY 5, 2020

Files names and paths observed in numerous campaigns conducted by the operator revealed a link to the scat01 and SoftEgorka nicknames, the vitasa01 [ @ ] yandex. According to the experts, the same individual was responsible for phishing attacks and scam attempts on his forum mates.” ru website. .”

Encryption

Encryption Ransomware IT Phishing

Is BazarLoader malware linked to Trickbot operators?

Security Affairs

APRIL 18, 2021

The phishing messages include links pointing to Slack or BaseCamp cloud storage, for this reason, they don’t raise suspicion when are received by employees working at an organization that uses the above services. Some of the files’ names observed by the experts are presentation-document.exe, preview-document-[number].exe

File names

File names Ransomware Phishing Encryption

New Gallmaker APT group eschews malware in cyber espionage campaigns

Security Affairs

OCTOBER 10, 2018

” Gallmaker uses spear phishing messages using a weaponized Office document that uses the Dynamic Update Exchange (DDE) protocol to execute commands in the memory of the targeted device. Rather, the attack activity we observed is carried out exclusively using LotL tactics and publicly available hack tools.”

Military

Military File names Government Libraries

PLAYFULGHOST backdoor supports multiple information stealing features

CERT-UA warns of a phishing campaign targeting government entities

Webinars

Trending Sources

A crafty phishing campaign targets Microsoft OneDrive users

Webinars

Glove Stealer bypasses Chrome’s App-Bound Encryption to steal cookies

Experts warn of a new wave of Bumblebee malware attacks

MikroTik botnet relies on DNS misconfiguration to spread malware

Group-IB uncovers PerSwaysion – sophisticated phishing campaign targeting executives worldwide

Introducing the PhishingKitTracker

Russia-linked Armageddon APT targets Ukrainian state organizations, CERT-UA warns

Fake Falcon crash reporter installer used to target German Crowdstrike users

North Korea-linked Kimsuky APT attack targets victims via Messenger

Chinese APT Earth Baxia target APAC by exploiting GeoServer flaw

Crooks target Healthcare facilities involved in Coronavirus containment with Ransomware

Cuba ransomware affiliate targets Ukraine, CERT-UA warns

BlackWater, a malware that uses Cloudflare Workers for C2 Communication

Threat actors leverage Microsoft Teams to spread malware

QNodeService Trojan spreads via fake COVID-19 tax relief

Russia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 Windows flaw

Google TAG: Russia, Belarus-linked APTs targeted Ukraine

PLAYFULGHOST backdoor supports multiple information stealing features

Crooks use hidden directories of compromised HTTPS sites to deliver malware

Xenomorph malware is back after months of hiatus and expands the list of targets

Iran-linked group Cobalt Dickens hit over 60 universities worldwide

Iran-linked Seedworm APT targets Telecoms organizations across the Middle East and Asia

Evilnum APT used Python-based RAT PyVil in recent attacks

New Cyber Attack Campaign Leverages the COVID-19 Infodemic

GhostWriter APT targets state entities of Ukraine with Cobalt Strike Beacon

Russia-linked APT29 relies on Google Drive, Dropbox to evade detection

Cisco confirms that data leaked by the Yanluowang ransomware gang were stolen from its systems

APT29 abused the Windows Credential Roaming in an attack against a diplomatic entity

Sofacy APT group used a new tool in latest attacks, the Cannon

Specially Crafted ZIP archives allow bypassing secure email gateways

ObliqueRAT, a new malware employed in attacks on government targets in Southeast Asia

ToxicEye RAT exploits Telegram communications to steal data from victims

New APT34 campaign uses LinkedIn to deliver fresh malware

How to deliver malware using weaponized Microsoft Office docs embedding YouTube video

Microsoft Vancouver leaking website credentials via overlooked DS_STORE file

China-linked threat actors are targeting the government of Ukraine

Russia-linked Gamaredon APT targets Ukrainian authorities with new malware

Catches of the month: Phishing scams for August 2021

Himera and AbSent-Loader Leverage Covid19 lures

DeathRansom ransomware evolves encrypting files, but experts identified its author

Is BazarLoader malware linked to Trickbot operators?

New Gallmaker APT group eschews malware in cyber espionage campaigns

Stay Connected