Demystifying to Network Security

Comments

Post a Comment

Popular posts from this blog

Fin7 cyber crime group

Image
Cybersecurity researchers have discovered new infrastructure linked to a financially motivated threat actor known as  FIN7 . The two clusters of potential FIN7 activity "indicate communications inbound to FIN7 infrastructure from IP addresses assigned to Post Ltd (Russia) and SmartApe (Estonia), respectively," Team Cymru  said  in a report published this week as part of a joint investigation with Silent Push and Stark Industries Solutions. The findings build on a  recent report  from Silent Push, which found several Stark Industries IP addresses that are solely dedicated to hosting FIN7 infrastructure. The latest analysis indicates that the hosts linked to the e-crime group were likely procured from one of Stark's resellers. "Reseller programs are common in the hosting industry; many of the largest VPS (virtual private server) providers offer such services," the cybersecurity company said. "Customers procuring infrastructure via resellers generally must fol...
Read more

Working of UUloader malware

Image
A new type of malware called UULoader is being used by threat actors to deliver next-stage payloads like  Gh0st RAT  and  Mimikatz . The Cyberint Research Team, which discovered the malware, said it's distributed in the form of malicious installers for legitimate applications targeting Korean and Chinese speakers. There is evidence pointing to UULoader being the work of a Chinese speaker due to the presence of Chinese strings in program database (PDB) files embedded within the DLL file. One of the executables is a legitimate binary that's susceptible to DLL side-loading, which is used to sideload the DLL file that ultimately loads the final stage, an obfuscate file named "XamlHost.sys" that's nothing but remote access tools such as Gh0st RAT or the Mimikatz credential harvester. Present within the MSI installer file is a Visual Basic Script (.vbs) that's responsible for launching the executable – e.g., Realtek – with some UULoader samples also running a decoy ...
Read more

APT 42 Goals

Image
APT 42’s Recent Campaign Highlights and Trends In a recent campaign, threat actors from APT42 targeted organizations in Western and Middle Eastern countries through social engineering attacks. They impersonated journalists to gain the trust of their targets and infiltrated corporate networks and cloud environments. The attackers used malicious emails to deliver two custom backdoors, named Nicecurl and Tamecat, which allowed them to execute commands and steal sensitive data from the compromised systems. In recent campaigns, APT42 has predominantly focused on targeting entities that oppose Iran, including government and political bodies, media and journalism outlets, healthcare organizations, academic institutions, and non-governmental organizations (NGOs). APT42’s activities are not limited to direct cyber-attacks. The group also conducts extensive credential harvesting operations, intricately designed to appear as legitimate interactions. These operations are carried out through carefu...
Read more