October 31, 2024 at 11:37AM North Korea’s Andariel group has begun using Play ransomware, marking their first collaboration with an underground ransomware network. This shift indicates a potential increase in high-impact attacks. Researchers recommend heightened vigilance against future ransomware incidents, as the group remains a significant threat, particularly in sectors vulnerable to cyber attacks. ### … Read more
October 8, 2024 at 12:05PM GoldenJackal, an APT hacking group, breached air-gapped European government systems using custom toolsets to steal sensitive data, including emails, encryption keys, and documents. They utilized malware like GoldenDealer and GoldenAce, spreading through USB drives. Kaspersky warned of their focus on government entities for espionage. ESET reported new modular toolsets used … Read more
October 8, 2024 at 11:56AM The APT hacking group GoldenJackal breached air-gapped government systems in Europe using custom toolsets to steal sensitive data, including emails, encryption keys, and documents. The attacks occurred at least twice, targeting government and diplomatic entities for espionage. GoldenJackal also developed a new modular toolset to optimize covert operations. Multiple tools … Read more
October 7, 2024 at 04:06PM The Chinese state-sponsored APT, Salt Typhoon, reportedly breached major US broadband provider networks, gaining access to lawful intercept infrastructure used by law enforcement for wiretapping. The affected providers include AT&T, Verizon, and Lumen Technologies. Sources suggest the APT had access to internet traffic and targeted entities outside the US. This … Read more
October 4, 2024 at 03:49PM The US Department of Justice and Microsoft collaborated to take down over 100 domains linked to the Russian hacker group Star Blizzard, known for targeting journalists, non-governmental organizations, and Russia experts. This action aims to disrupt their cyber activities and protect against potential election interference. However, experts anticipate continued threats … Read more
September 26, 2024 at 12:35AM A threat actor known as “SloppyLemming,” identified as an advanced persistent threat (APT) by Crowdstrike, is conducting espionage against government and law enforcement targets in the Indian subcontinent. They utilize Cloudflare Worker cloud services and various tools in phishing attack chains for credential harvesting and email compromise, targeting sensitive organizations … Read more
September 23, 2024 at 02:18AM A suspected APT from China targeted a Taiwanese government organization and other APAC countries by exploiting a security flaw. The activity uses various techniques and malware like Cobalt Strike and EAGLEDOOR to infiltrate and gather data from government and energy sectors. The threat actor’s sophistication and adaptability are notable. Key … Read more
September 20, 2024 at 06:45AM Mandiant is tracking Iranian APT threat actor UNC1860, linked to MOIS, which facilitates remote network access. UNC1860, known for sophisticated tools and prior destructive attacks, is associated with APT34 and implicated in cyber operations targeting U.S. elections. Iran’s increasing cyber activities coincide with heightened regional involvement. CISA warned of Iranian … Read more
September 19, 2024 at 06:15AM The US government disrupted a Chinese state-sponsored botnet named Raptor Train, created by Flax Typhoon. The botnet compromised over 260,000 devices, powering DDoS attacks and routing malware. Law enforcement operations successfully neutralized the botnet, despite attempted interference by the hackers. Five Eyes agencies issued a joint advisory and efforts continue … Read more
September 16, 2024 at 03:56PM CISA orders U.S. federal agencies to secure systems against a Windows MSHTML spoofing bug exploited by the Void Banshee APT group. The vulnerability (CVE-2024-43461) was exploited before being fixed, allowing attackers to execute code on unpatched Windows systems. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog, and … Read more