Intelligence

Pierluigi Paganini April 12, 2017
Watch out! Shadow Brokers dump includes remote root exploits for Solaris boxes

The security expert Matthew Hickey has discovered two tools dubbed EXTREMEPARR and EBBISLAND which were specifically designed to target Solaris systems. After the mysterious Shadow Brokers group has leaked the archive containing the stolen NSA hacking tools and exploits, security experts started analyzing the huge trove of data. Experts discovered that NSA operators developed an attack […]

Pierluigi Paganini April 11, 2017
Symantec confirms that Longhorn group is tied to CIA operators detailed in Vault 7

Symantec reportedly linked the CIA hacking tools to several cyber attacks powered over the years by the Longhorn group. Security experts analyzed the alleged CIA hacking tools included in the Vault 7 dump that have been used against at least 40 governments and private organizations across 16 countries. Researchers at company firm Symantec reportedly linked the CIA […]

Pierluigi Paganini April 08, 2017
The Shadow Brokers release more alleged NSA hacking tools and exploits

The Shadow Brokers hacking crew sent a message to President Trump commenting recent political events and released more alleged NSA hacking tools. The Shadow Brokers is the mysterious group that in October 2016 claimed to have stolen a bunch of hacking tools used by the NSA for its operations. At the end of October 2016, the hackers […]

Pierluigi Paganini April 07, 2017
WikiLeaks leaked files on the Grasshopper framework, a CIA Tool for creating customized malware installers

Wikileaks published a new batch of 27 documents detailing the Grasshopper framework used by its agents to create custom installers for Windows malware. WikiLeaks continues to disclose documents included in the CIA Vault 7 archive, on Friday published a new batch of 27 documents detailing a framework, dubbed Grasshopper, allegedly used to create custom installers for Windows malware. […]

Pierluigi Paganini April 06, 2017
Operation Cloud Hopper – APT10 goes after Managed Service Providers

Security experts uncovered a widespread campaign tracked as Operation Cloud Hopper known to be targeting managed service providers (MSPs) worldwide. Chinese APT10 group is the main suspect. Security experts from PwC UK and BAE Systems have uncovered a widespread hacking campaign, tracked as Operation Cloud Hopper, targeting managed service providers (MSPs) in multiple countries worldwide. The experts […]

Pierluigi Paganini April 05, 2017
South Korean users targeted with a new stealthy malware, the ROKRAT RAT

Security experts at CISCO Talos have spotted a new insidious remote access tool dubbed ROKRAT that implements sophisticated anti-detection measures. The ROKRAT RAT targets Korean users, people using the popular Korean Microsoft Word alternative Hangul Word Processor (HWP). In the past, we saw other attacks against people using the HWP application. The ROKRAT RAT was used […]

Pierluigi Paganini April 04, 2017
Joining the dots between the ancient Moonlight Maze espionage campaigns and the Turla APT

Experts at Kaspersky presented the findings of its research that definitively connect the Moonlight Maze cyber espionage campaigns to the Turla APT group. One year ago, the researcher Thomas Rid at the Security Analyst Summit disclosed the alleged links between the Moonlight Maze cyber espionage operation of mid 1990s and the Turla APT. Today at […]

Pierluigi Paganini April 01, 2017
WikiLeaks Reveals the Marble framework, used by the CIA to make hard the attribution

WikiLeaks has published the third batch of documents dubbed Marble that revealed the CIA anti-forensics tool dubbed Marble framework. WikiLeaks released the third batch of the CIA Vault7 archive that shed light the anti-forensics tools used by the intelligence Agency, The first tranche of CIA documents from Vault7 was related to hacking tools and techniques, while […]

Pierluigi Paganini March 31, 2017
Turla hacking group continues to improve its Carbon backdoor

The Russian group Turla has continued to improve its Carbon backdoor, experts from ESET detected new versions released on a regular basis. The Russian APT group known as Turla (also known as Waterbug, KRYPTON and Venomous Bear) has continued to improve its Carbon backdoor, experts from ESET detected new versions released on a regular basis. Carbon is a […]

Pierluigi Paganini March 28, 2017
APT29 group used domain fronting to evade detection long before these techniques were widely known

Experts at FireEye discovered the APT29 group adopted domain fronting long before these techniques were widely known in the IT security community. Security firm FireEye continues to follow APT29 group (aka The Dukes, Cozy Bear and Cozy Duke), on Monday it revealed that the cyber spies have been using a technique called “domain fronting” to make hard […]