Operation Blockbuster revealed
...lunch around 3am GMT. Considering normal working hours, this indicates the attackers are probably located on a timezone of GMT+8 or GMT+9. What is perhaps most surprising is the amount... more…Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware
...29 00:00:00 2018 GMT Not After : May 29 23:59:59 2019 GMT Subject: OU=Domain Control Validated, OU=PositiveSSL, CN=celasllc.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus:... more…Conditional Malicious iFrame Targeting WordPress Web Sites
...one: sitylertudes.abbotaleweekendgetaway.com HTTP/1.1 302 Found Server: nginx Date: Sat, 13 Sep 2014 02:05:29 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 370 Connection: keep-alive Set-Cookie: ehihm=7MMcADE2AAIAAgBpphNU__9pphNUQAABAAAAaaYTVAA-; expires=Sun, 13-Sep-2015 02:05:29 GMT; path=/; domain=dolberop.chrisxp.us Location:... more…The Roof Is on Fire: Tackling Flame’s C&C Servers
...primarily targeting Windows computers in the Middle East. Several hours later, around 4PM GMT, the Flame command-and-control infrastructure, which had been operating for years, went dark. For the past weeks,... more…SLUB Gets Rid of GitHub, Intensifies Slack Use
...unknown. Inside team sales-yww9809, it contained two users, Lomin (lomio8158@cumallover[.]me) and Yolo (yolo1617@cumallover[.]me) who were both created on the same day (May 23, 2019). Lomin’s timezone was GMT time and... more…Octopus-infested seas of Central Asia
For the last two years we have been monitoring a Russian-language cyberespionage actor that focuses on Central Asian users and diplomatic entities. We named the actor DustSquad... more…LuckyMouse signs malicious NDISProxy driver with certificate of Chinese IT company
What happened? Since March 2018 we have discovered several infections where a previously unknown Trojan was injected into the lsass.exe system process memory. These implants were injected... more…Targeted Attacks: Stealing Information Through Google Drive
...Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Date: Thu, 14 Oct 2014 08:08:32 GMT Content-Disposition: attachment; filename=”sample.txt”; filename*=UTF-8”sample.txt X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection:... more…WannaCry FAQ: What you need to know today
...been contained? We started tracking the attack early today to determine if it’s spiking again. Since 06.00 UTC/GMT Monday 15th May, we observed a sixfold decrease in attacks across our... more…Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities
Executive Summary Throughout the autumn of 2018 we analyzed a long-standing (and still active at that time) cyber-espionage campaign that was primarily targeting foreign diplomatic entities based... more…Olympic Destroyer is still alive
In March 2018 we published our research on Olympic Destroyer, an advanced threat actor that hit organizers, suppliers and partners of the Winter Olympic Games 2018 held... more…Energetic Bear/Crouching Yeti: attacks on servers
Energetic Bear/Crouching Yeti is a widely known APT group active since at least 2010. The group tends to attack different companies with a strong focus on the... more…UK Regulators Search Cambridge Analytica Offices
...approved a search warrant. Around 18 enforcement agents from the office of Information Commissioner Elizabeth Denham entered the company’s London headquarters at around 8:00pm (2000 GMT) to execute the warrant.... more…Operation ShadowHammer: a high-profile supply chain attack
In late March 2019, we briefly highlighted our research on ShadowHammer attacks, a sophisticated supply chain attack involving ASUS Live Update Utility, which was featured in a... more…COMpfun successor Reductor infects files on the fly to compromise TLS traffic
In April 2019, we discovered new malware that compromises encrypted web communications in an impressive way. Analysis of the malware allowed us to confirm that the operators... more…South Korea Probes Cyber Shutdown During Olympics Ceremony
...systems crashed at about 7:15 pm (1015 GMT) on Friday and were still not back to normal at midday on Saturday, Games organizers said. read more Read more: South Korea... more…Kam dál?
- Microsoft Internet Explorer CTreePos Use-After-Free Remote Code Execution Vulnerability
- US, Canada issue alert on ransomware
- Software applications have on average 24 vulnerabilities inherited from buggy components
- New products of the week 5.30.16
- Microsoft Patches Flaws in Windows, Office, Edge
- Microsoft Windows JET Database Engine CVE-2019-0897 Remote Code Execution Vulnerability
- Hackers Awarded $267,000 at Pwn2Own 2018
- BitCoin exchange loses $250,0000 after unencrypted keys stolen
- A New Wave of Buggy WordPress Infections
- Configuring password complexity in Windows and Active Directory