Malware

23 Nov

Online retailers should prepare for a holiday season spike in bot-operated attacks

Data Breaches, Malware, Social Engineering

With the holiday shopping season in full swing, retail websites can expect a spike in account takeover fraud, DDoS, and other attacks, including attacks via APIs, which now represent almost half of e-commerce traffic. According to a recent report from application and data security company Imperva, bots account for more than 40% of traffic to online retail websites on average, with around 24% of traffic coming from “bad bots” that engage in various forms of…

Read More
23 Nov

How to reset a Kerberos password and get ahead of coming updates

Data Breaches, Malware, Social Engineering

Do you recall when you last reset your Kerberos password? Hopefully that was not the last time I suggested you change it, back in April of 2021, when I urged you to do a regular reset of the KRBTGT account password. If you’ve followed my advice, you are already one step ahead of the side effects caused by the November updates that introduced Kerberos changes. While many of you may be waiting to install the…

Read More
22 Nov

DraftKings Sports App Hacked

Attacks, Malware

DraftKings said that almost 300 thousand dollars was stolen from user accounts. According to some of the victims, when they took to Twitter to get help from DraftKings, there were many twitter accounts commenting aabout getting free money using various techniques, but none of them could be identified as the actual attacker. Attacks like these highlight the reasons why it is important to not reuse passwords, especially on websites that credit card information is being…

Read More
22 Nov

Cybercriminals Increasingly Using Aurora Stealer Malware

Attacks, Malware

Companies can detect Aurora and malware like it by implementing command line logging and looking for unusual WMIC and PowerShell commands. Additionally, implementing Canary files can help detect file grabber activity, and user behavioral analysis on netflow data can help detect anomalous network activity, such as connections to strange external ports. Application allowlisting can also help prevent the loader activity seen in Aurora. https://thehackernews.com/2022/11/researchers-warn-of-cyber-criminals.html https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar/

Read More
22 Nov

Microsoft Azure launches DDoS IP protection for SMBs

Data Breaches, Malware, Social Engineering

Microsoft is extending the Azure DDoS Protection family with a new product focusing on small and medium-size businesses (SMBs). The product, DDoS IP Protection for SMBs, was announced at Microsoft’s Ignite conference and is now in public preview. DDoS IP Protection for SMBs is designed to provide enterprise-grade DDoS (distributed denial of service) protection at a price that’s attractive to SMBs, Microsoft said. With the new product, Microsoft’s Azure DDoS Protection family now has two…

Read More
22 Nov

Know thy enemy: thinking like a hacker can boost cybersecurity strategy

Data Breaches, Malware, Social Engineering

As group leader for Cyber Adversary Engagement at MITRE Corp., Maretta Morovitz sees value in getting to know the enemy – she can use knowledge about cyber adversaries to distract, trick, and deflect them and develop strategies to help keep threat actors from getting whatever they’re after. That could mean placing decoys and lures that exploit their expectations for what an attacker will find when they first hack into an environment, she says. Or it…

Read More
21 Nov

New Ransomware Encrypts Files, Then Steals Discord Accounts

Attacks, Malware

While this ransomware generally targets consumers rather than the enterprise, it could still pose a significant threat to large communities. Therefore, users that are impacted by AxLocker should immediately change Discord passwords, as it will invalidate the token stolen by the ransomware. While this may not help recover files, it will prevent further compromise of accounts, data, and Discord communities. https://www.bleepingcomputer.com/news/security/new-ransomware-encrypts-files-then-steals-your-discord-account/

Read More
21 Nov

Google Wins Court Case Against Russians Linked to Glupteba Botnet

Attacks, Malware

Starovikov and Filippov, who claim to have been software engineers for an organization known as Valtron LLC, are accused of seeking to mislead the court and acting to deny Google access to discoverable data. According to a settlement submitted to Google, the actors demanded $1 million each from the company and $110,000 in legal costs in exchange for providing the private keys to Bitcoin addresses linked to the Glupteba botnet. However, the Mountain View-based company…

Read More
21 Nov

Luna Moth callback phishing campaign leverages extortion without malware

Data Breaches, Malware, Social Engineering

Palo Alto’s Unit 42 has investigated several incidents linked to the Luna Moth group callback phishing extortion campaign targeting businesses in multiple sectors, including legal and retail. The analysis discovered that the threat actors behind the campaign leverage extortion without malware-based encryption, have significantly invested in call centers and infrastructure unique to attack targets, and are evolving their tactics over time. Unit 42 stated that the campaign has cost victims hundreds of thousands of dollars…

Read More