APT

Pierluigi Paganini January 05, 2017
FireCrypt comes as a malware building kit and includes DDoS code

Recently experts from MalwareHunterTeam discovered FireCrypt ransomware, a threat that comes as a malware building kit and includes DDoS code. Ransomware has become one of the fastest growing threats, new malware implements sophisticated features to avoid detection and rapidly spread among the greatest number of machines. Recently experts from MalwareHunterTeam discovered a new strain of ransomware dubbed FireCrypt, […]

Pierluigi Paganini December 31, 2016
FBI-DHS JAR report links Russian hackers to Presidential Election hacks

A FBI-DHS JAR report released implicated Russian hacking group APT28 and APT29 in attacks against 2016 Presidential Election. The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) published on Thursday a Joint Analysis Report(JAR) that provides information about the tools, infrastructure and TTPs used by the Russian civilian and military intelligence […]

Pierluigi Paganini December 29, 2016
The OSCE organization was victim of a major cyber attack

The Organization for Security and Co-operation in Europe (OSCE) confirmed to have suffered suffer a “major” cyber attack. Hackers targeted the Organisation for Security and Cooperation in Europe (OSCE), the news was confirmed on Wednesday by a spokeswoman for the organization. The OSCE is a security and human rights watchdog, clearly the attack is part of […]

Pierluigi Paganini December 22, 2016
Fancy Bear APT tracked Ukrainian artillery units with an Android implant

The Russian APT group Fancy Bear used a malware implant on Android devices to track and target Ukrainian artillery units from late 2014 through 2016. The popular hacking group, known as Fancy Bear, APT 28, Pawn Storm, Sednit or Sofacy, is once again in the headlines. Experts from the cyber security firm CrowdStrike reported the alleged Russian nation-state actor used malware implant […]

Pierluigi Paganini December 16, 2016
PROMETHIUM and NEODYMIUM APTs used same Zero-Day to Target Turkish citizens

Microsoft discovered two distinct APT groups, PROMETHIUM and NEODYMIUM, that exploited the same Flash Player zero-day flaw on same targets. Security researchers have discovered two distinct APT groups, PROMETHIUM and NEODYMIUM, that exploited the same Flash Player zero-day vulnerability (CVE-2016-4117) in cyber espionage campaigns on Turkish citizens living in Turkey and various other European countries. Both […]

Pierluigi Paganini December 15, 2016
BlackEnergy hackers, now TeleBots, target Ukrainian banks

The BlackEnergy hacker group that targeted the Ukrainian grid one year ago, now identified as TeleBots, are targeting Ukrainian banks. The BlackEnergy hacker group that targeted the Ukrainian grid one year ago causing a power outage in the country are now targeting Ukrainian banks. The Ukrainian government accused Russia of being involved in the attack, […]

Pierluigi Paganini May 24, 2016
Operation Ke3chang, alleged Chinese hackers target Indian Embassies Worldwide

Security experts from PaloAlto Networks collected evidence that the Operation Ke3chang discovered by FireEye in 2013 is still ongoing. Back in 2013, the security researchers at FireEye spotted a group of China-Linked hackers that conducted an espionage campaign on foreign affairs ministries in Europe. The campaign was named ‘Operation Ke3chang,’ now threat actors behind the […]

Pierluigi Paganini July 09, 2015
Morpho, the financially motivated espionage target giant firms

Morpho is the name of a financially motivated espionage group that targets large enterprises, including Microsoft, Apple, Twitter, and Facebook. Security experts have discovered and analyzed the activities of a financially motivated APT group, dubbed Morpho and Wild Neutron, that has targeted a large number of high profile companies worldwide. According to the analysis published by […]

Pierluigi Paganini January 12, 2015
MiniDuke, CosmicDuke and OnionDuke have a same matrix

Security experts collected further evidences of the link between the CosmicDuke, Miniduke and OnioDuke Advanced Persistent Threat campaigns. Researchers at F-Secure firm are constantly monitoring the cyber espionage campaigns MiniDuke, CosmicDuke and OnionDuke and provided an interesting update on the hacking operation. Below a short description of the campaigns: MiniDuke: Kaspersky Lab and Hungary’s Laboratory of Cryptography and System Security, or CrySyS, […]

Pierluigi Paganini May 30, 2014
Iranian hackers behind most elaborate spying campaign on social media

Experts at iSight issued a report describing the most elaborate net-based spying campaign organized by Iranian hackers using social media. Iranian Hackers use a network of fake accounts (NEWSCASTER network) on principal social media to spy on US officials and political staff worldwide, this is reported in an analysis done by iSIGHT Partners. A few days ago […]