APT

Pierluigi Paganini March 25, 2019
Free Tools: spotting APTs through Malware streams

Cyber security expert and founder of Yoroi has published a new tool that could be used to spot APTs (Advanced Persistent Threats) through Malware streams. There are many ways to spot Advanced Persistent Threats, for example during a forensic analysis on “high rate incident” or having sandbox systems on critical infrastructures or again working as […]

Pierluigi Paganini March 22, 2019
Russian APT groups target European governments ahead of May Elections

Russian APT groups are targeting European governments for cyber-espionage purposes ahead of the upcoming European elections. According to experts from FireEye, Russia-linked APT28 (aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, and STRONTIUM) and Sandworm Team (also TeleBots) cyberespionage groups are targeting European governments for cyber-espionage purposes ahead of the upcoming European elections. The activity of the Russia-linked groups is […]

Pierluigi Paganini March 19, 2019
Experts observed the growth of hi-tech crime landscape in Asia in 2018

Security experts at Group-IB presented at Money2020 Asia the results of an interesting analysis of hi-tech crime landscape in Asia in 2018. Group-IB, an international company that specializes in preventing cyberattacks, on Money2020 Asia presented the analysis of hi-tech crime landscape in Asia in 2018 and concluded that cybercriminals show an increased interest in Asia […]

Pierluigi Paganini March 13, 2019
CVE-2019-0797 Windows Zero-Day exploited by FruityArmor and SandCat APT Groups

One of the zero-day flaws (CVE-2019-0797) patched this week by Microsoft has been exploited in targeted attacks by several threats groups, including FruityArmor and SandCat APT groups. This week, Microsoft released Patch Tuesday security updates for March 2019 that address 64 flaws, including two Windows zero-day vulnerabilities exploited in targeted attacks. One of the flaws, […]

Pierluigi Paganini March 10, 2019
Security Affairs newsletter Round 204 – News of the week

A new round of the weekly SecurityAffairs newsletter arrived! The best news of the week with Security Affairs. Kindle Edition Paper Copy Once again thank you! ·      A Cobalt Strike flaw exposed attackers infrastructure ·      The operator of DDoS-for-hire service pleads guilty ·      The Wireshark Foundation released Wireshark 3.0.0 ·      Annual RSA Conference Exclusive 2019 […]

Pierluigi Paganini March 07, 2019
Microsoft warns of economic damages caused by Iran-linked hackers

Researchers at Microsoft warn of damages caused by cyber operations conducted by Iran-linked cyberespionage groups. Security experts at Microsoft are warning of economic damages caused by the activity of Iran-linked hacking groups that are working to penetrate systems, businesses, and governments worldwide. According to Microsoft, the attackers already caused hundreds of millions of dollars in […]

Pierluigi Paganini March 07, 2019
Whitefly espionage group was linked to SingHealth Singapore Healthcare Breach

Security experts at Symantec linked the massive Singapore Healthcare breach suffered by SingHealth to the ‘Whitefly’ cyberespionage group. In 2018, the largest healthcare group in Singapore, SingHealth, has suffered a massive data breach that exposed personal information of 1.5 million patients who visited the clinics of the company between May 2015 and July 2018. Stolen […]

Pierluigi Paganini March 06, 2019
APT40 cyberespionage group supporting growth of China’s naval sector

A cyber-espionage group, tracked as APT40, apparently linked to the Chinese government is focused on targeting countries important to the country’s Belt and Road Initiative. The cyber-espionage group tracked as APT40 (aka TEMP.Periscope, TEMP.Jumper, and Leviathan), apparently linked to the Chinese government, is focused on targeting countries important to the country’s Belt and Road Initiative […]

Pierluigi Paganini March 05, 2019
Iran-Linked Chafer APT recently used python-based backdoor

The Iran-linked Chafer APT group used a new Python-based backdoor in recent attacks aimed at a Turkish government entity. The Iran-linked Chafer APT group used a new Python-based backdoor in attacks carried out in November 2018 that targeted a Turkish government entity. The Chafer APT group has distributed data stealer malware since at least mid-2014, […]

Pierluigi Paganini March 04, 2019
Experts collect more evidence that link Op ‘Sharpshooter’ to North Korea

Security researchers at McAfee have linked the Op. Sharpshooter with the North Korea-linked Lazarus APT group after analyzing code from a command and control (C2) server. Security experts at McAfee analyzed the code of a C2 server involved in the cyber espionage campaign tracked as Op. Sharpshooter and linked it with the North Korea-linked APT […]