Malware

28 Feb

LastPass: The crooks used a keylogger to crack a corporatre password vault

Information, Malware

by Paul Ducklin There’s no date on the update, but as far as we can make out, LastPass just [2023-02-27] published a short document entitled Incident 2 – Additional details of the attack. As you probably remember, because the bad news broke just before the Christmas holiday season in December 2022, LastPass suffered what’s known in the jargon as a lateral movement attack. Simply put, lateral movement is just a fancy way of saying, “Once…

Read More
27 Feb

PureCrypter Malware Hits Government Orgs with Ransomware, Info-Stealers

Attacks, Malware

To protect against attacks such as this, organizations should:• Configure email clients to notify users when emails originate from outside the organization.• Focus on cyber security awareness and training.• Regularly provide users with training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.• Ensure Office applications are configured to disable all macros without notification.• Pay special attention to warning notifications in email clients and Office applications.• Implement monitoring of…

Read More
27 Feb

Stanford University Suffers Data Breach

Attacks, Malware

Individuals who were affected by this incident should consider following these steps: 1. Take advantage of the identity theft protection services offered by the university. This will help monitor any suspicious activity related to personal information.2. Monitor financial accounts and credit reports regularly. Look for any unauthorized activity or changes to credit reports that aren’t recognized.3. Change passwords for any accounts that use the same password as the Stanford University account. Use strong, unique passwords…

Read More
27 Feb

PlugX Trojan Masked as Legitimate Windows Debugger Tool

Attacks, Malware

The hijacking of x64dbg to load PlugX was discovered last month by Palo Alto Networks Unit 42, which discovered a new variant of the malware that hides malicious files on removable USB devices to propagate the infection to other Windows hosts. Persistence is achieved by changing the Windows Registry and setting up scheduled processes to maintain access. Trend Micro’s analysis also revealed the use of x32dbg.exe to deploy a backdoor, a User Datagram Protocol (UDP)…

Read More
27 Feb

Cybersecurity in wartime: how Ukraine’s infosec community is coping

Data Breaches, Malware, Social Engineering

Whenever shells rain down on Ukraine, Yuriy Gatupov’s colleagues put a ‘+’ sign in a chat room. Then, the pluses are counted. “We check if everybody is alive,” he says. Gatupov, the owner of two cybersecurity companies, says it is vital to stay connected during a time of war. With Russia now controlling around 18% of Ukraine’s territory including Donbas and Crimea, tech workers face formidable challenges. Air raid sirens blast all the time. Explosions…

Read More
27 Feb

Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!

Information, Malware

by Paul Ducklin Thanks to Tommy Mysk and Talal Haj Bakry of @mysk_co for the impetus and information behind this article. The duo describe themselves as “two iOS developers and occasional security researchers on two continents.” In other words, although cybersecurity isn’t their core business, they’re doing what we wish all programmers would do: not taking application or operating system security features for granted, but keeping their own eyes on how those features work in…

Read More
24 Feb

US warns of cyberattacks by Russia on anniversary of Ukraine war

Data Breaches, Malware, Social Engineering

The US Cybersecurity and Infrastructure Security Agency has issued an advisory urging organizations to increase cybersecurity vigilance today, the anniversary of Russia’s invasion of Ukraine, in the wake of a cyberattack against several Ukrainian government websites. “The United States and European nations may experience disruptive and defacement attacks against websites in an attempt to sow chaos and societal discord,” the CISA advisory said. The cyberattack in Ukraine, detected yesterday, hit the websites of a number…

Read More
24 Feb

Microsoft tells Exchange admins to revert previously recommended antivirus exclusions

Data Breaches, Malware, Social Engineering

Microsoft is advising Exchange Server administrators to remove some of the endpoint antivirus exclusions that the company’s own documentation recommended in the past. The rules are no longer needed for server stability and their presence could prevent the detection of backdoors deployed by attackers. “Times have changed, and so has the cybersecurity landscape,” the Exchange Server team said in a blog post. “We’ve found that some existing exclusions — namely the Temporary ASP.NET Files and…

Read More
24 Feb

Dutch Police Arrest Three Ransomware Group Members

Attacks, Malware

The threat of leaking data if a ransom is not paid is a common tactic amongst ransomware actors. In this case, the group would still leak data even if ransom was paid. By using this model, the group was setting themselves up to not get paid by anyone because there would be no benefit to paying. Although this is a risk taken by companies paying a ransom, most groups do not follow this model to…

Read More