APT Archives - Page 12 of 114

Pierluigi Paganini September 09, 2024

TIDRONE APT targets drone manufacturers in Taiwan

A previously undocumented threat actor tracked TIDRONE targets organizations in military and satellite industries in Taiwan. Trend Micro spotted an allegedly China-linked threat actor, tracked TIDRONE, targeting drone manufacturers in Taiwan. The group, which was previously undocumented, uses enterprise resource planning (ERP) software and remote desktops to deploy advanced malware, including CXCLNT and CLNTEND. CXCLNT […]

Pierluigi Paganini September 09, 2024

Multiple malware families delivered exploiting GeoServer GeoTools flaw CVE-2024-36401

Multiple threat actors actively exploited the recently disclosed OSGeo GeoServer GeoTools flaw CVE-2024-36401 in malware-based campaigns. Researchers at Fortinet FortiGuard Labs reported that threat actors exploited the recently disclosed OSGeo GeoServer GeoTools flaw (CVE-2024-36401) to deliver various malware families, including cryptocurrency miners, bots, and the SideWalk backdoor. GeoServer is an open-source server that allows users […]

Pierluigi Paganini September 05, 2024

Is Russian group APT28 behind the cyber attack on the German air traffic control agency (DFS)?

A cyber attack hit the German air traffic control agency (DFS) disrupting its operations, experts attribute it to Russia-linked group APT28. A cyber attack targeted the German Air Traffic Control Agency (DFS), as reported by Spiegel and European Truth. DFS, based in Langen near Frankfurt, confirmed that attackers breached its office connection but confirmed that […]

Pierluigi Paganini August 31, 2024

North Korea-linked APT Citrine Sleet exploit Chrome zero-day to deliver FudModule rootkit

North Korea-linked APT exploited the recently patched Google Chrome zero-day CVE-2024-7971 to deploy the FudModule rootkit. North Korea-linked group Citrine Sleet (aka AppleJeus, Labyrinth Chollima, UNC4736, Hidden Cobra) have exploited the recently patched Google Chrome zero-day CVE-2024-7971(CVSS score 8.8) to deploy the FudModule rootkit, states Microsoft. Microsoft researchers linked with medium confidence the attacks to Citrine […]

Pierluigi Paganini August 30, 2024

South Korea-linked group APT-C-60 exploited a WPS Office zero-day

South Korea-linked group APT-C-60 exploited a zero-day in the Windows version of WPS Office to target East Asian countries. South Korea-linked group APT-C-60 exploited a zero-day, tracked as CVE⁠-⁠2024⁠-⁠7262, in the Windows version of WPS Office to deploy the SpyGlace backdoor in the systems on targets in East Asia. WPS Office is a comprehensive office […]

Pierluigi Paganini August 30, 2024

Russia-linked APT29 reused iOS and Chrome exploits previously developed by NSO Group and Intellexa

Russia-linked APT29 group was spotted reusing iOS and Chrome exploits previously developed by surveillance firms NSO Group and Intellexa. Google TAG (Threat Analysis Group) researchers observed the Russia-linked group APT29 (aka SVR group, BlueBravo, Cozy Bear, Nobelium, Midnight Blizzard, and The Dukes). using exploits previously used by surveillance software vendors NSO Group and Intellexa. The circumstance suggests that the nation-state actors […]

Pierluigi Paganini August 29, 2024

Iran-linked group APT33 adds new Tickler malware to its arsenal

Iran-linked group APT33 used new Tickler malware in attacks against organizations in the government, defense, satellite, oil and gas sectors. Microsoft researchers reported that the Iran-linked cyberespionage group APT33 (aka Peach Sandstorm, Holmium, Elfin, Refined Kitten, and Magic Hound) used new custom multi-stage backdoor called Tickler to compromise organizations in sectors such as government, defense, satellite, oil, and gas […]

Pierluigi Paganini August 27, 2024

China-linked APT Volt Typhoon exploited a zero-day in Versa Director

China-linked APT group Volt Typhoon exploited a zero-day flaw in Versa Director to upload a custom webshell in target networks. China-linked APT Volt Typhoon exploited a zero-day vulnerability, tracked as CVE-2024-39717, in Versa Director, to deploy a custom webshell on breached networks. Versa Director is a centralized management and orchestration platform used primarily by Internet […]

Pierluigi Paganini August 24, 2024

Russian national arrested in Argentina for laundering money of crooks and Lazarus APT

A Russian national was arrested in Argentina for laundering proceeds from illicit actors, including North Korea-linked Lazarus Group. This week, the Argentine Federal Police (PFA) arrested a Russian national for laundering proceeds from illicit actors and seized millions of dollars in assets from his Argentinian-based operation. The cybercriminal facilitated money laundering by accepting illicit cryptocurrency […]

Pierluigi Paganini August 23, 2024

China-linked APT Velvet Ant exploited zero-day to compromise Cisco switches

China-linked APT group Velvet Ant exploited a recently disclosed zero-day in Cisco switches to take over the network appliance. Researchers at cybersecurity firm Sygnia reported that the China-linked APT group Velvet Ant has exploited the recently disclosed zero-day CVE-2024-20399 in Cisco switches to take over the network devices. In July 2024, Cisco addressed the NX-OS zero-day CVE-2024-20399 […]

APT

TIDRONE APT targets drone manufacturers in Taiwan

Multiple malware families delivered exploiting GeoServer GeoTools flaw CVE-2024-36401

Is Russian group APT28 behind the cyber attack on the German air traffic control agency (DFS)?

North Korea-linked APT Citrine Sleet exploit Chrome zero-day to deliver FudModule rootkit

South Korea-linked group APT-C-60 exploited a WPS Office zero-day

Russia-linked APT29 reused iOS and Chrome exploits previously developed by NSO Group and Intellexa

Iran-linked group APT33 adds new Tickler malware to its arsenal

China-linked APT Volt Typhoon exploited a zero-day in Versa Director

Russian national arrested in Argentina for laundering money of crooks and Lazarus APT

China-linked APT Velvet Ant exploited zero-day to compromise Cisco switches

newsletter

Subscribe to my email list and stay
up-to-date!

recent articles

UK NCA arrested four people over M&S, Co-op cyberattacks

PerfektBlue Bluetooth attack allows hacking infotainment systems of Mercedes, Volkswagen, and Skoda

Qantas data breach impacted 5.7 million individuals

DoNot APT is expanding scope targeting European foreign ministries

Nippon Steel Solutions suffered a data breach following a zero-day attack

QUICK LINKS

APT

newsletter

Subscribe to my email list and stay up-to-date!

recent articles

Subscribe to my email list and stay
up-to-date!