June 20, 2024 at 11:54AM Symantec reports that telecommunications companies in an unnamed Asian country have been targeted by Chinese espionage groups since at least 2021. The campaign included the use of custom backdoors such as Coolclient, Quickheal, and Rainyday, associated with known Chinese state-sponsored threat actors. The motive and collaboration among the threat actors … Read more
June 12, 2024 at 12:45PM Symantec reported that a ransomware group possibly exploited a patched Windows privilege escalation vulnerability before Microsoft’s fix. The flaw, tracked as CVE-2024-26169, could allow attackers to obtain System privileges. Symantec found evidence suggesting the Black Basta ransomware group exploited this vulnerability as a zero-day, hitting over 500 organizations globally. Summary … Read more
June 12, 2024 at 08:10AM The Black Basta ransomware operation exploited a Windows privilege escalation vulnerability (CVE-2024-26169) as a zero-day before a fix was available. Microsoft patched it on March 12, 2024. Symantec’s report links the exploit to Black Basta, with indications of its usage as a zero-day. This highlights the need to apply the … Read more
May 17, 2024 at 05:33AM The Kimsuky APT group, associated with North Korea’s Reconnaissance General Bureau, has been observed deploying the Gomir backdoor on Linux to target South Korean organizations. The malware shares extensive code with GoBear and is distributed through trojanized security programs. The campaign highlights the preference for software installation packages as infiltration … Read more
February 16, 2024 at 11:12AM Alpha ransomware, emerging in 2023 with a low profile, has recently ramped up attacks and launched a data leak site. Symantec links it to the now-defunct Netwalker ransomware based on tools and tactics, indicating a strong link between the two. Alpha, an emerging threat, demands between 0.272 BTC and up … Read more
October 20, 2023 at 09:24AM Symantec’s cybersecurity unit, Broadcom, has reported that the Iran-linked hacking group Crambus spent eight months infiltrating a Middle Eastern government’s compromised network. Crambus, also known as APT34 and MuddyWater, conducted espionage operations on behalf of the Iranian government. The attackers deployed various malware, including a PowerShell backdoor called PowerExchange, and … Read more