APT

Pierluigi Paganini April 04, 2019
The German chemicals giant Bayer hit by a cyber attack

The German chemicals giant Bayer confirmed that of a cyber attack, it confirmed the incident but clarified that no data has been stolen. The chemicals giant Bayer is the last victims of a cyber attack, it confirmed the incident, but pointed out the hackers haven’t stolen any data. According to the company, at the beginning […]

Pierluigi Paganini April 03, 2019
OceanLotus APT group leverages a steganography-based loader to deliver backdoors

The OceanLotus APT group, also known as APT32 or Cobalt Kitty, leverages a steganography-based loader to deliver backdoors on compromised systems. Security researchers at Cylance discovered that the OceanLotus APT (also known as APT32 or Cobalt Kitty, group is using a loader leveragingsteganography to deliver a version of Denes backdoor and an updated version of […]

Pierluigi Paganini March 31, 2019
Security Affairs newsletter Round 207 – News of the week

A new round of the weekly SecurityAffairs newsletter arrived! The best news of the week with Security Affairs. Kindle Edition Paper Copy Once again thank you! Federal Emergency Management Agencys (FEMA) data leak exposes data of 2.3M survivors Malware Static Analysis Microsoft Defender APT now protects also macOS WordPress Social Warfare plugin zero-day exploited in […]

Pierluigi Paganini March 31, 2019
Microsoft took control of 99 domains used by Iran-linked Phosphorus APT

Microsoft this week announced that it had taken control of 99 domains used by an Iran-linked APT group tracked by the company as Phosphorus. Microsoft has recently announced that it had taken control of 99 domains used by an Iran-linked APT group tracked by the tech giant as Phosphorus (aka APT35, Charming Kitten, NewsBeef, Newscaster […]

Pierluigi Paganini March 28, 2019
Lazarus APT continues to target cryptocurrency businesses with Mac malware

North Korea-linked Lazarus group made the headlines again, it has been leveraging PowerShell to target both Windows and macOS machines. The North Korea-linked Lazarus APT group made has been leveraging PowerShell to target both Windows and macOS machines in a new wave of attacks. The discovery was made by experts at Kaspersky Lab, the campaign […]

Pierluigi Paganini March 28, 2019
ASUS fixes supply chain of Live Update tool hit in Operation ShadowHammer

ASUS released security patches to fix the issues in the Live Update utility that were exploited by threat actors in Operation ShadowHammer. ASUS announced to have released a fix for the Live Update utility that was exploited by threat actors behind the Operation ShadowHammer to deliver malware to hundreds of users.  The Operation ShadowHammer took […]

Pierluigi Paganini March 27, 2019
LUCKY ELEPHANT campaign targets South Asian governments

The NETSCOUT Threat Intelligence team uncovered a credential harvesting campaign tracked as LUCKY ELEPHANT targeting mostly South Asian governments. Security experts at NETSCOUT Threat Intelligence team uncovered a credential harvesting campaign, tracked as LUCKY ELEPHANT, targeting mostly South Asian governments. The campaign was discovered in early March 2019, threat actors behind the LUCKY ELEPHANT campaign […]

Pierluigi Paganini March 25, 2019
Operation ShadowHammer – Supply-Chain attack hit ASUS users

Operation ShadowHammer – ASUS is the last victim of a clamorous supply chain attack that delivered a backdoor to more than one million users, Kaspersky Lab reported. Over 1 million ASUS users may have been impacted by a supply chain attack that leveraged the ASUS Live Update utility to inject a backdoor in ASUS systems. […]

Pierluigi Paganini March 25, 2019
Free Tools: spotting APTs through Malware streams

Cyber security expert and founder of Yoroi has published a new tool that could be used to spot APTs (Advanced Persistent Threats) through Malware streams. There are many ways to spot Advanced Persistent Threats, for example during a forensic analysis on “high rate incident” or having sandbox systems on critical infrastructures or again working as […]

Pierluigi Paganini March 22, 2019
Russian APT groups target European governments ahead of May Elections

Russian APT groups are targeting European governments for cyber-espionage purposes ahead of the upcoming European elections. According to experts from FireEye, Russia-linked APT28 (aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, and STRONTIUM) and Sandworm Team (also TeleBots) cyberespionage groups are targeting European governments for cyber-espionage purposes ahead of the upcoming European elections. The activity of the Russia-linked groups is […]