Operation Blockbuster revealed
...lunch around 3am GMT. Considering normal working hours, this indicates the attackers are probably located on a timezone of GMT+8 or GMT+9. What is perhaps most surprising is the amount... more…Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware
...29 00:00:00 2018 GMT Not After : May 29 23:59:59 2019 GMT Subject: OU=Domain Control Validated, OU=PositiveSSL, CN=celasllc.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus:... more…Conditional Malicious iFrame Targeting WordPress Web Sites
...one: sitylertudes.abbotaleweekendgetaway.com HTTP/1.1 302 Found Server: nginx Date: Sat, 13 Sep 2014 02:05:29 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 370 Connection: keep-alive Set-Cookie: ehihm=7MMcADE2AAIAAgBpphNU__9pphNUQAABAAAAaaYTVAA-; expires=Sun, 13-Sep-2015 02:05:29 GMT; path=/; domain=dolberop.chrisxp.us Location:... more…The Roof Is on Fire: Tackling Flame’s C&C Servers
...primarily targeting Windows computers in the Middle East. Several hours later, around 4PM GMT, the Flame command-and-control infrastructure, which had been operating for years, went dark. For the past weeks,... more…Octopus-infested seas of Central Asia
For the last two years we have been monitoring a Russian-language cyberespionage actor that focuses on Central Asian users and diplomatic entities. We named the actor DustSquad... more…LuckyMouse signs malicious NDISProxy driver with certificate of Chinese IT company
What happened? Since March 2018 we have discovered several infections where a previously unknown Trojan was injected into the lsass.exe system process memory. These implants were injected... more…SLUB Gets Rid of GitHub, Intensifies Slack Use
...unknown. Inside team sales-yww9809, it contained two users, Lomin (lomio8158@cumallover[.]me) and Yolo (yolo1617@cumallover[.]me) who were both created on the same day (May 23, 2019). Lomin’s timezone was GMT time and... more…Targeted Attacks: Stealing Information Through Google Drive
...Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Date: Thu, 14 Oct 2014 08:08:32 GMT Content-Disposition: attachment; filename=”sample.txt”; filename*=UTF-8”sample.txt X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection:... more…WannaCry FAQ: What you need to know today
...been contained? We started tracking the attack early today to determine if it’s spiking again. Since 06.00 UTC/GMT Monday 15th May, we observed a sixfold decrease in attacks across our... more…Energetic Bear/Crouching Yeti: attacks on servers
Energetic Bear/Crouching Yeti is a widely known APT group active since at least 2010. The group tends to attack different companies with a strong focus on the... more…South Korea Probes Cyber Shutdown During Olympics Ceremony
...systems crashed at about 7:15 pm (1015 GMT) on Friday and were still not back to normal at midday on Saturday, Games organizers said. read more Read more: South Korea... more…How to keep our kids safe online – start by talking about it
...Day website, here: https://www.saferinternet.org.uk/advice-centre And if you’re interested in joining the discussion on how to keep children safe online, we’ll be hosting a Twitter chat from 13:00 GMT today. You... more…UK Regulators Search Cambridge Analytica Offices
...approved a search warrant. Around 18 enforcement agents from the office of Information Commissioner Elizabeth Denham entered the company’s London headquarters at around 8:00pm (2000 GMT) to execute the warrant.... more…Olympic Destroyer is still alive
In March 2018 we published our research on Olympic Destroyer, an advanced threat actor that hit organizers, suppliers and partners of the Winter Olympic Games 2018 held... more…WannaCry ransomware used in widespread attacks all over the world
...to check: 9:00am - 11:00am GMT from Monday to Friday. Once the payment is checked, you can start decrypting your files immediately. Contact If you need our assistance, send a... more…Turla renews its arsenal with Topinambour
Turla, also known as Venomous Bear, Waterbug, and Uroboros, is a Russian speaking threat actor known since 2014, but with roots that go back to 2004 and... more…Kam dál?
- DMARC and Spam: Why It Matters
- Hacktivist group possibly compromised hundreds of websites
- Mt Gox hit with $75 million suit over failed partnership
- Private sector fights on despite cybersecurity bill’s failure
- Judge Allows Evidence Gathered From FBI’s Spoofed Cell Tower
- LinkedIn hit with lawsuit over massive data breach
- "KimcilWare" Ransomware Targets Magento Websites
- How cybercriminals abuse the travel and hospitality industry
- Yahoo! to Warn Users of State-Sponsored Attacks
- SSCC 115 – XP "as a giant 0-day", choosing and remembering passwords, and next-gen HTTP [PODCAST]