Malware

20 Mar

Bitcoin ATM Manufacturer General Bytes Closes Cloud Service After User Hot Wallets Are Compromised

Attacks, Malware

This incident highlights the importance of security measures when it comes to storing and managing cryptocurrency. Users should be careful when choosing where to store their funds and should always use secure storage options such as hardware wallets or cold storage. Additionally, companies that offer cloud-based cryptocurrency services must prioritize security to prevent unauthorized access and protect their customers’ funds. https://cointelegraph.com/news/bitcoin-atm-maker-shuts-cloud-service-after-user-hot-wallets-compromised

Read More
20 Mar

Alleged BreachForums Owner Pompompurin Arrested on Cybercrime Charges

Attacks, Malware

A separate BreachForums administrator under the alias Baphomet immediately posted a message following Pompompurin’s arrest. Baphomet claimed they retained control of the forum’s infrastructure and stated they would keep everyone updated on the situation. After the site went down, Baphomet began using the forum’s Telegram channel to provide updates to the forum’s community. On the morning of March 20th, Baphomet stated the migration process has slowed but claims the forum will return. In the meantime,…

Read More
20 Mar

New dotRunpeX Malware Spreads via Malicious Ads

Attacks, Malware

According to Check Point’s study, “each dotRunpeX sample has an embedded payload of a certain malware family to be injected,” with the injector identifying a list of anti-malware processes that should be terminated. This is made possible by exploiting a weak process explorer driver (procexp.sys) built into dotRunpeX to gain kernel mode execution. The malware may be linked to Russian-speaking threat actors. This conclusion was made based on the language references in the code. The…

Read More
20 Mar

CISA kicks off ransomware vulnerability pilot to help spot ransomware-exploitable flaws

Data Breaches, Malware, Social Engineering

Last week, the US Cybersecurity and Infrastructure Security Agency (CISA) announced the launch of the Ransomware Vulnerability Warning Pilot (RVWP) program to “proactively identify information systems that contain security vulnerabilities commonly associated with ransomware attacks.” Once the program identifies vulnerable systems, regional CISA personnel will notify them so they can mitigate the flaws before attackers can cause too much damage.  CISA says it will seek out affected systems using existing services, data sources, technologies, and…

Read More
20 Mar

BianLian ransomware group shifts focus to extortion

Data Breaches, Malware, Social Engineering

Ransomware group BianLian has shifted the main focus of its attacks away from encrypting the files of its victims to focusing more on extortion as a means to extract payments from victims, according to cybersecurity firm Redacted. The shift in the operating model comes as a result of Avast’s release of a decryption tool that allowed a victim of the BianLian ransomware gang to decrypt and recover their files without paying any ransom. The decryption…

Read More
17 Mar

BianLian Ransomware Gang Shifts Focus to Pure Data Extortion

Attacks, Malware

CPR’s analysis revealed that the gang has already targeted several organizations, including a large US-based medical testing laboratory, and a multinational pharmaceutical company, among others. The group’s modus operandi involves exfiltrating data, encrypting it, and then publishing it on their data leak site if the victim refuses to pay the ransom. CPR warns that BianLian’s shift in tactics could inspire other ransomware groups to follow suit, creating more problems for organizations already grappling with the…

Read More
17 Mar

Google Finds 18 Zero-Day Vulnerabilities in Samsung Exynos Chipsets

Attacks, Malware

Device owners should install patches for these vulnerabilities as soon as they are made available by the vendor. It was also recommended to disable Wi-Fi calling and Voice-over-LTE to mitigate the impact of the vulnerabilities until patches are released. https://www.bleepingcomputer.com/news/security/google-finds-18-zero-day-vulnerabilities-in-samsung-exynos-chipsets/

Read More
17 Mar

Adobe Acrobat Sign Abused to Push Redline Info-Stealing Malware

Attacks, Malware

While it isn’t necessarily a novel tactic to utilize legitimate resources to aid in phishing campaigns, it is an effective one. Often when an end-user receives a phishing email from a legitimate source such as Adobe Sign, it makes them much more likely to fall for it as many users don’t know how to properly identify a phishing email. Many times, training around phishing states to look for things such as a suspicious title, suspicious…

Read More
17 Mar

Two Patch Tuesday flaws you should fix right now

Data Breaches, Malware, Social Engineering

Microsoft released its monthly security bulletin this week, covering patches for over 80 vulnerabilities across its products. However, two of them had already been used by attackers before patches were released. One vulnerability affects all supported versions of Outlook for Windows and allows attackers to steal Net-NTLMv2 hashes and then use them in NTLM (New Technology LAN Manager) relay attacks against other systems. The second allows attackers to bypass Microsoft SmartScreen, a technology built into…

Read More