#cyberespionage — Public Fediverse posts

A Cambodia malware campaign hides SparkRAT in PNG files and abuses a vulnerable driver to kill antivirus, Acronis TRU reports.

#SparkRAT #BYOVD #Cambodia #Malware #CyberEspionage #SilverFox

http://securityonline.info/cambodia-malware-campaign-sparkrat/?utm_source=mastodon&utm_medium=jetpack_social

Cobalt Strike Beacon delivered via GitHub and social media – Source: securelist.com https://ciso2ciso.com/cobalt-strike-beacon-delivered-via-github-and-social-media-source-securelist-com/ #rssfeedpostgeneratorecho #MalwareDescriptions #MalwareTechnologies #CyberSecurityNews #Targetedattacks #cyberespionage #DLLsideloading #Socialnetworks #Windowsmalware #securelistcom #CobaltStrike #DLLhijacking #shellcode #research #Malware #GitHub #Trojan

EAGERBEE, with updated and novel components, targets the Middle East – Source: securelist.com https://ciso2ciso.com/eagerbee-with-updated-and-novel-components-targets-the-middle-east-source-securelist-com/ #rssfeedpostgeneratorecho #APT(Targetedattacks) #MalwareDescriptions #MalwareTechnologies #CyberSecurityNews #Targetedattacks #cyberespionage #securelistcom #CoughingDown #APTreports #backdoor #EagerBee #Malware #APT

Careto is back: what’s new after 10 years of silence? – Source: securelist.com https://ciso2ciso.com/careto-is-back-whats-new-after-10-years-of-silence-source-securelist-com/ #rssfeedpostgeneratorecho #APT(Targetedattacks) #CyberSecurityNews #Targetedattacks #cyberespionage #securelistcom #APTreports #backdoor #Malware #Careto #APT

APT trends report Q1 2024 – Source: securelist.com https://ciso2ciso.com/apt-trends-report-q1-2024-source-securelist-com/ #rssfeedpostgeneratorecho #APT(Targetedattacks) #CyberSecurityNews #Targetedattacks #cyberespionage #MobileMalware #securelistcom #Hacktivists #APTreports #backdoor #Kimsuky #Trojan #APT

ToddyCat is making holes in your infrastructure – Source: securelist.com https://ciso2ciso.com/toddycat-is-making-holes-in-your-infrastructure-source-securelist-com/ #rssfeedpostgeneratorecho #APT(Targetedattacks) #CyberSecurityNews #Targetedattacks #cyberespionage #securelistcom #APTreports #datatheft #ToddyCat #WhatsApp #APT #ssh #VPN

The Computer Emergency Response Team of Ukraine (CERT-UA) reports that the threat actor group UAC-0184 is increasingly using popular messengers and social engineering in 2024 to target the Ukrainian military, and steal documents/messenger data (e.g. Signal). Malware delivered include IDAT, RemcosRAT, VIOTTOKEYLOGGER, XWorm, SIGTOP and TUSC. A lot of IOC provided, and images depict infection chains or lure messages. 🔗 (Ukrainian language) https://cert.gov.ua/article/6278521

#CERTUA #UAC0184 #Ukraine #cyberespionage #threatintel #IOC #RemcosRAT #IDAT #xworm

DHS Cyber Safety Review Board (CSRB) absolutely savages Microsoft over the June 2023 Exchange Online breach by Chinese threat actor Storm-0558 and accessing U.S. government emails right before Secretary of State Anthony Blinken was to visit China. This 34 page PDF is written in the style of a U.S. Government Accountability Office (GAO) report. 🔗 https://www.dhs.gov/news/2024/04/02/cyber-safety-review-board-releases-report-microsoft-online-exchange-incident-summer

Key takeways (copied verbatim, emphasis mine):

• "Google's Threat Analysis Group was able to link at least one entity tied to this threat actor to the group responsible for the 2009 compromise of Google and dozens of other private companies in a campaign known as Operation Aurora, as well as the RSA SecurID incident."
• "However, by the conclusion of this review, Microsoft was still unable to demonstrate to the Board that it knew how Storm-0558 had obtained the 2016 MSA key."
• "Microsoft acknowledged to the Board in November 2023 that its September 6, 2023 blog post about the root cause was inaccurate, it did not update that post until March 12, 2024, as the Board was concluding its review and only after the Board's repeated questioning about Microsoft's plans to issue a correction;"

#DHS #CSRB #Microsoft #MSRC #China #cyberespionage #Storm0558