Month: July 2021
Experts Uncover Several C&C Servers Linked to WellMess Malware
30 July 2021Cybersecurity researchers on Friday unmasked new command-and-control (C2) infrastructure belonging to the Russian threat actor tracked as APT29, aka Cozy Bear, that has been spotted actively serving WellMess malware as part of an ongoing attack campaign. More than 30 C2 servers operated by the Russian foreign intelligence have been uncovered, Microsoft-owned cybersecurity subsidiary RiskIQ said […]
Read More
Several Malicious Typosquatted Python Libraries Found On PyPI Repository
30 July 2021As many as eight Python packages that were downloaded more than 30,000 times have been removed from the PyPI portal for containing malicious code, once again highlighting how software package repositories are evolving into a popular target for supply chain attacks. “Lack of moderation and automated security controls in public software repositories allow even inexperienced […]
Read More
Phony Call Centers Tricking Users Into Installing Ransomware and Data-Stealers
30 July 2021An ongoing malicious campaign that employs phony call centers has been found to trick victims into downloading malware capable of data exfiltration as well as deploying ransomware on infected systems. The attacks — dubbed “BazaCall” — eschew traditional social engineering techniques that rely on rogue URLs and malware-laced documents in favor of a vishing-like method […]
Read More
A New Wiper Malware Was Behind Recent Cyberattack On Iranian Train System
30 July 2021A cyber attack that derailed websites of Iran’s transport ministry and its national railway system earlier this month, causing widespread disruptions in train services, was the result of a never-before-seen reusable wiper malware called “Meteor.” The campaign — dubbed “MeteorExpress” — has not been linked to any previously identified threat group or to additional attacks, […]
Read More
Hackers Exploit Microsoft Browser Bug to Deploy VBA Malware on Targeted PCs
29 July 2021An unidentified threat actor has been exploiting a now-patched zero-day flaw in Internet Explorer browser to deliver a fully-featured VBA-based remote access trojan (RAT) capable of accessing files stored in compromised Windows systems, and downloading and executing malicious payloads as part of an “unusual” campaign. The backdoor is distributed via a decoy document named “Manifest.docx” […]
Read More
New Ransomware Gangs — Haron and BlackMatter — Emerge on Cybercrime Forums
29 July 2021Two new ransomware-as-service (RaaS) programs have appeared on the threat radar this month, with one group professing to be a successor to DarkSide and REvil, the two infamous ransomware syndicates that went off the grid following major attacks on Colonial Pipeline and Kaseya over the past few months. “The project has incorporated in itself the […]
Read More
Best Practices to Thwart Business Email Compromise (BEC) Attacks
29 July 2021Business email compromise (BEC) refers to all types of email attacks that do not have payloads. Although there are numerous types, there are essentially two main mechanisms through which attackers penetrate organizations utilizing BEC techniques, spoofing and account take-over attacks. In a recent study, 71% of organizations acknowledged they had seen a business email compromise […]
Read More
New Android Malware Uses VNC to Spy and Steal Passwords from Victims
29 July 2021A previously undocumented Android-based remote access trojan (RAT) has been found to use screen recording features to steal sensitive information on the device, including banking credentials, and open the door for on-device fraud. Dubbed “Vultur” due to its use of Virtual Network Computing (VNC)’s remote screen-sharing technology to gain full visibility on targeted users, the […]
Read More
Top 30 Critical Security Vulnerabilities Most Exploited by Hackers
29 July 2021Intelligence agencies in Australia, the U.K., and the U.S. issued a joint advisory on Wednesday detailing the most exploited vulnerabilities in 2020 and 2021, once again demonstrating how threat actors are able to weaponize publicly disclosed flaws to their advantage swiftly. “Cyber actors continue to exploit publicly known—and often dated—software vulnerabilities against broad target sets, […]
Read More
UBEL is the New Oscorp — Android Credential Stealing Malware Active in the Wild
28 July 2021An Android malware that was observed abusing accessibility services in the device to hijack user credentials from European banking applications has morphed into an entirely new botnet as part of a renewed campaign that began in May 2021. Italy’s CERT-AGID, in late January, disclosed details about Oscorp, a mobile malware developed to attack multiple financial […]
Read More