APT

Pierluigi Paganini July 17, 2017
Russian nation-state actors blamed for cyber attacks against Irish energy networks

Irish energy networks have been targeted by spear phishing attacks, Russian nation-state actors are the prime suspects for the cyber attacks. Hackers have targeted Irish energy networks, senior engineers at the Electricity Supply Board (ESB), which supplies both Northern Ireland and the Republic, were targeted by spear phishing messages allegedly sent by a Russian threat actor linked […]

Pierluigi Paganini July 12, 2017
Katyusha Scanner, a new SQLi Vulnerability Scanner Available for $500 in the underground

Katyusha Scanner is a new fully automated SQLi vulnerability scanner discovered by researchers at security firm Recorded Future. Recorded Future security researchers have discovered a fully automated SQLi vulnerability scanner, dubbed Katyusha Scanner, on a hacking forum. The tool is offered for sale for just $500, it allows mass scans, simply managed from a smartphone […]

Pierluigi Paganini July 10, 2017
OSX DoK Malware linked to Operation Emmental used to target Swiss Banks again

Crooks behind the Operation Emmental hacking campaign have started targeting the Swiss banks using a variant of the DoK Mac OS X malware. In July 2014, malware researchers at Trend Micro published a report on the hacking campaign “Operation Emmental” that was targeting Swiss bank accounts whit a multi-faceted attack that allowed crooks to bypass two factor authentication implemented […]

Pierluigi Paganini July 10, 2017
FBI and DHS warn of targeted attacks on US Nuclear Facilities

Since May, APT actors have been penetrating the networks of US companies that operate nuclear facilities and that works in the energy industry. According to a joint report issued by the Department of Homeland Security and the FBI published last week, since May, hackers have been penetrating the networks of businesses that operate nuclear power stations, manufacturing […]

Pierluigi Paganini June 29, 2017
Shadow Brokers sent out first round of exploits and threaten to dox former NSA hacker

Shadow Brokers has sent out the first round of exploits to the subscribers of its service, the hackers also threaten to dox former NSA hacker. In May the notorious Shadow Brokers group announced the launch of a monthly subscription model for its data dumps, 0-Day Exploit Subscriptions goes for $21,000 per month. The group claimed […]

Pierluigi Paganini June 18, 2017
Kasperagent malware used in a new campaign leveraging Palestine-Themed decoy files

Researchers uncovered a new cyber espionage campaign involving the Kasperagent spyware delivered with Palestine-Themed decoy files. In March, experts at security firm Qihoo 360 have spotted a cyber espionage campaign conducted by a threat actor tracked as APT-C-23 and Two-Tailed Scorpion. A few weeks later, in April, researchers at Palo Alto Networks and ClearSky also shared the […]

Pierluigi Paganini June 14, 2017
Joint Technical Alert published by DHS and FBI warns of North Korea’s Hidden Cobra APT

The United States Computer Emergency Readiness Team (US-CERT) issued a technical alert about the activity of the North Korea’s ‘Hidden Cobra’ APT group. The joint Technical Alert (TA) report is the result of the efforts between of the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). The US Government has tracked […]

Pierluigi Paganini June 12, 2017
Experts spotted Industroyer ICS Malware and linked it to Ukraine Power Outage

Researchers at antivirus firm ESET have discovered a new strain of malware, dubbed Industroyer, that appears to have been designed to target power grids. The experts published a detailed analysis of the malware, they speculated the malicious code has been involved in the December 2016 attack on an electrical substation in Ukraine. “Win32/Industroyer is a sophisticated piece […]

Pierluigi Paganini June 09, 2017
Platinum hackers leverages Intel Active Management tools to bypass Windows firewall

The PLATINUM hacker group has developed a system leveraging Intel Active Management Technology (AMT) to bypass the Windows firewall. Microsoft is warning users of a new attack that leverage Intel’s Active Management Technology to evade firewalls and other endpoint-based network monitoring. The technique has been already used by a threat actor in Southeast Asia dubbed […]

Pierluigi Paganini June 07, 2017
Russia-linked hacker group APT28 continues to target Montenegro

Once again, Montenegro was targeted by the Russia-linked hacker group APT28, according to the experts it is just the beginning. On June 5 Montenegro officially joined NATO alliance despite the strong opposition from Russian Government that threatened to retaliate. Cybersecurity experts believe that a new wave of attacks from the cyberspace will hit the state. In February, for […]