Security Affairs

JANUARY 28, 2021

The TeamTNT cybercrime group has improved its Linux cryptocurrency miner by implementing open-source detection evasion capabilities. The TeamTNT cybercrime group has upgraded their Linux cryptocurrency miner by adding open-source detection evasion capabilities, AT&T Alien Labs researchers warn. Pierluigi Paganini.

Libraries 353

Libraries IT Mining Security 353

Krebs on Security

SEPTEMBER 18, 2024

Scammers are flooding Facebook with groups that purport to offer video streaming of funeral services for the recently deceased. One of the many scam funeral group pages on Facebook. One of many look-alike landing pages for video streaming services linked to scam Facebook funeral groups.

Passwords 64

Passwords Mining IT Marketing 64

Security Affairs

JUNE 24, 2024

The cybercrime group ExCobalt targeted Russian organizations in multiple sectors with a previously unknown backdoor known as GoRed. Members of the ExCobalt group have been active since at least 2016, the researchers believe that the group is linked to the notorious Cobalt Gang.

File names 293

File names Communications Mining Archiving 293

Security Affairs

FEBRUARY 28, 2019

Security expert Marco Ramilli analyzed a new piece of malware apparently designed to target PIK-Group that implements ransomware , Trojan, and Miner capabilities. which according to google translate would be: “PIK Group of Companies order details”. According to zcashnetwork the attacker’s wallet received from mining activity 4.89

Ransomware 264

Ransomware Mining File names Encryption 264

Security Affairs

JANUARY 10, 2025

The executable then downloads a text file containing XMRig configuration details to initiate mining activities. Fraudulent interviews and job offers use fake websites, email addresses, group chats and text messages. If the environment passes these checks, it displays a fake error message before proceeding. ” concludes the report.

Phishing 280

Phishing Mining Authentication Communications 280

Data Breach Today

MARCH 28, 2023

APT43 Launders Crypto Through Mining, Says Mandiant North Korean hackers are stealing cryptocurrency to fund operations under an apparent mandate from Pyongyang to be self-sufficient, threat intel firm Mandiant says.

Mining 291

Mining IT 291

Krebs on Security

MARCH 7, 2022

Three stories here last week pored over several years’ worth of internal chat records stolen from the Conti ransomware group, the most profitable ransomware gang in operation today. “We find young forks on exchanges (those that can be mined), analyze their infrastructure,” Begemot wrote. We start ddosing. We release ddos.

Ransomware 270

Ransomware Mining Blockchain Sales 270

Security Affairs

SEPTEMBER 16, 2020

A threat actor is launching brute-force attacks on MSSQL servers in the attempt to access them to install a new crypto-mining malware dubbed MrbMiner. A group of hackers is launching brute-force attacks on MSSQL servers with the intent to compromise them and install crypto-mining malware dubbed MrbMiner. Mining process.”

Mining 360

Mining Passwords Access Security 360

Data Breach Today

FEBRUARY 4, 2021

Researchers: 'Hildegard' Linked to TeamTNT Hacking Group A previously undocumented malware variant called "Hildegard" is targeting Kubernetes clusters, according to Palo Alto Networks' Unit 42. The malicious code is likely the work of the TeamTNT hacking group, which mines for monero cryptocurrency.

Mining 346

Mining 346

Security Affairs

NOVEMBER 9, 2021

182 used in this campaign was previously associated with the operations of the TeamTNT group. “Our July 2021 research into TeamTNT showed that the group previously used credential stealers that would rake in credentials from configuration files. Experts noticed that the IP address 45[.]9[.]148[.]182 Pierluigi Paganini.

Mining 289

Mining Security IT Information Security 289

Data Breach Today

APRIL 25, 2021

Cybereason Says Russian Hacking Group Prometei is Behind the Campaign A Russian botnet group called Prometei is exploiting critical Microsoft Exchange Server vulnerabilities to mine cryptocurrency from various organizations across the world, a new report by security firm Cybereason finds.

Mining 306

Mining Security 306

Security Affairs

MAY 26, 2021

Researchers from Trend Micro reported that about 50,000 IPs were compromised across multiple Kubernetes clusters in a cryptojacking campaign conducted by TeamTNT group. The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. sh) used by the TeamTNT group.

Mining 353

Mining Cloud Security IT 353

Security Affairs

AUGUST 18, 2020

The TeamTNT botnet is a crypto-mining malware operation that has been active since April and that targets Docker installs. The activity of the TeamTNT group has been detailed by security firm Trend Micro, but the new feature was added only recently. It’s the first worm we’ve seen that contains such AWS specific functionality.

Mining 304

Mining Security Access IT 304

Security Affairs

NOVEMBER 16, 2018

According to Group-IB’s report findings, Asia is one of the most actively attacked regions in the world, the company presented latest cybercrime trends. According to Group-IB’s report findings, Asia is one of the most actively attacked regions in the world. Espionage as one of the main APT groups’ goals.

Phishing 272

Phishing Manufacturing Marketing Blockchain 272

WIRED Threat Level

MARCH 28, 2023

A spy group working for the Kim regime has been feeding stolen coins into crypto mining services in an effort to throw tracers off their trail.

Mining 159

Mining IT Blockchain Security 159

Security Affairs

JANUARY 10, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. The activity of the TeamTNT group has been detailed by security firm Trend Micro, but in August experts from Cado Security discovered that that botnet is also able to target misconfigured Kubernetes installations.

Mining 361

Mining Metadata Authentication Security 361

Security Affairs

MARCH 7, 2020

Computer systems at EVRAZ, a multinational vertically integrated steel making and mining company, have been hit by Ryuk ransomware. EVRAZ is one of the world’s largest multinational vertically integrated steel making and mining companies with headquarters in London.

Ransomware 361

Ransomware Computer and Electronics Mining Manufacturing 361

Security Affairs

JULY 24, 2018

.” The binary establishes a connection to the C&C server, then scans processes running on the compromised device and attempts to kill any that are running the CoinHive script that could be mining Monero. He is currently Global CISO for the ATCO Group of companies. Pierluigi Paganini.

Mining 177

Mining IoT Blockchain Risk 177

Data Breach Today

APRIL 26, 2021

Cybereason Says Russian Hacking Group Prometei Is Behind the Campaign A Russian botnet group called Prometei is exploiting critical Microsoft Exchange Server vulnerabilities to mine cryptocurrency across the world, a new report by security firm Cybereason finds.

Mining 278

Mining Security 278

Security Affairs

SEPTEMBER 9, 2021

The financially motivated TeamTNT hacking group expanded its arsenal with new tools used to target thousands of victims worldwide. Researchers from AT&T Alien Labs uncovered a new campaign, tracked as Chimaera, conducted by the TeamTNT group , aimed at organizations worldwide. ” reads the analysis published by AT&T.

Mining 304

Mining IT Cloud Security 304

Security Affairs

JULY 7, 2022

Researchers uncovered a large-scale cryptocurrency mining campaign targeting the NPM JavaScript package repository. Checkmarx researchers spotted a new large-scale cryptocurrency mining campaign, tracked as CuteBoi , that is targeting the NPM JavaScript package repository. CuteBoi relies on a disposable email service called mail.tm

Mining 342

Mining Security IT Information Security 342

Data Breach Today

JANUARY 21, 2023

Crypto Mining Campaign Targets Public Cloud Environments, Increases Security Risks Cybersecurity researchers say a Chinese for-profit threat group tracked as 8220 Gang is targeting cloud providers and poorly secured applications with a custom-built crypto miner and IRC bot.

Cloud 162

Cloud Mining Risk Cybersecurity 162

Security Affairs

MAY 27, 2021

The Federal Bureau of Investigation (FBI) reported that an APT group had breached the network of a local US municipal government by exploiting vulnerabilities in an unpatched Fortinet VPN. As of at least May 2021, an APT actor group almost certainly exploited a Fortigate appliance to access a webserver hosting the domain for a U.S.

Government 337

Government Mining Archiving Encryption 337

Security Affairs

JUNE 19, 2021

Experts from Recorded Future’s Insikt Group linked a series of attacks, part of RedFoxtrot China-linked campaigns, to the PLA China-linked Unit 69010. These targets suggest the group is likely interested in gathering intelligence on military technology and defense” reads the report published by the Insikt Group.

Military 337

Military Mining Government Communications 337

Security Affairs

JANUARY 23, 2021

Sophos researchers that investigated the recently uncovered crypto-mining campaign targeting SQL servers with MrbMiner malware believe that it was conducted by an Iran-based company. The name of the miner comes after one of the domains used by the group to host their malicious code.

Mining 351

Mining Communications Access Privacy 351

Security Affairs

MAY 3, 2024

The Ubiquiti EdgeRouter botnet is still used by Russia-linked group APT28 and cybercriminals organizations. Trend Micro researchers reported that the EdgeRouter botnet , called Moobot , used by the APT28 group is still active and is also used by cyber criminal organizations. ” reported Trend Micro. ” reported Trend Micro.

Healthcare 311

Healthcare Phishing Mining e-Discovery 311

Security Affairs

AUGUST 23, 2024

The Qilin ransomware group has been active since at least 2022 but gained attention in June 2024 for attacking Synnovis , a UK governmental service provider for healthcare. The group typically employs “double extortion,” stealing and encrypting victims’ data, then threatening to expose it unless a ransom is paid.

Ransomware 336

Ransomware Passwords Mining Encryption 336

Security Affairs

OCTOBER 4, 2023

The software firm also recommends checking instances for the following indicators of compromise: unexpected members of the confluence-administrator group unexpected newly created user accounts requests to /setup/*.action

Mining 355

Mining Access Authentication Cloud 355

Security Affairs

NOVEMBER 10, 2023

The hacktivist group Anonymous Sudan claimed responsibility for the massive distributed denial-of-service (DDoS) attack that took down the website of Cloudflare. “ To be clear, there was no Cloudflare breach. ” reads the message published on the group’s Telegram channel.

Mining 354

Mining Cloud IT Security 354

Security Affairs

APRIL 1, 2020

Cybersecurity researchers spotted a crypto-mining botnet, tracked as Vollgar, that has been hijacking MSSQL servers since at least 2018. Researchers at Guardicore Labs discovered a crypto-mining botnet , tracked as Vollgar botnet , that is targeting MSSQL databases since 2018. ” continues the analysis.

Mining 353

Mining Passwords Education Cybersecurity 353

Security Affairs

DECEMBER 1, 2020

Microsoft warns of Vietnam-linked Bismuth group that is deploying cryptocurrency miner while continues its cyberespionage campaigns. Researchers from Microsoft reported that the Vietnam-linked Bismuth group, aka OceanLotus , Cobalt Kitty , or APT32 , is deploying cryptocurrency miners while continues its cyberespionage campaigns.

Mining 340

Mining Manufacturing Government Phishing 340

Security Affairs

APRIL 22, 2022

The Lemon_Duck cryptomining botnet is targeting Docker servers to mine cryptocurrency on Linux systems. Crowdstrikes researchers reported that the Lemon_Duck cryptomining botnet is targeting Docker to mine cryptocurrency on Linux systems. “The “a.asp” file is the actual payload in this attack. ” concludes the report.

Mining 246

Mining Access Cloud Cybersecurity 246

Security Affairs

MARCH 8, 2020

“According to the SBI, the ransomware, named Ryuk, was started by a Russian hacker group and finds its way into a network once someone opens a malicious email attachment. A few days ago EVRAZ , one of the world’s largest multinational vertically integrated steel making and mining companies, has been hit by the Ryuk ransomware.

Ransomware 362

Ransomware IT Computer and Electronics Mining 362

Security Affairs

JANUARY 31, 2021

The Rocke group is using a new piece of cryptojacking malware dubbed Pro-Ocean to target Apache ActiveMQ, Oracle WebLogic, and Redis installs. The cybercrime group Rocke is using a new piece of cryptojacking malware called Pro-Ocean to target vulnerable Apache ActiveMQ, Oracle WebLogic, and Redis intalls. ” concludes the report.

Cloud 299

Cloud Libraries Mining IT 299

Security Affairs

OCTOBER 23, 2020

“The Group’s teams are fully mobilized to ensure a return to normal as quickly as possible and everything is done to ensure business continuity. A few days before, EVRAZ , one of the world’s largest multinational vertically integrated steel making and mining companies, has been hit by the Ryuk ransomware.

Ransomware 356

Ransomware Computer and Electronics Mining Manufacturing 356

Data Breach Today

JUNE 4, 2018

The very design of bitcoin, as well as some other virtual currencies, can lend a surprising amount of information about the groups using it to transact. Expert Says Virtual Currency Systems Leak Useful Data to Track Criminals Experts have long warned that bitcoin is not as private as it appears.

Mining 160

Mining IT 160

Security Affairs

DECEMBER 2, 2020

Evasion and Persistence: The botnet achieves persistence in multiple ways; kills running processes, potentially competing for mining tools and eliminates EDR. They are grouped in 2 groups. The second group of python scripts downloads and runs the Tsunami binaries. There are 4 python scripts in total. 8080 209.141.35.17:8080.

Mining 344

Mining IoT Cloud Security 344