Malware

Pierluigi Paganini May 10, 2020
Swiss rail vehicle manufacturer Stadler hit by a malware-based attack

Stadler, a Swiss manufacturer of railway rolling stock disclosed a data breach, hackers attempted to blackmail the company. International rail vehicle manufacturer, Stadler, disclosed a security breach that might have also allowed the attackers to steal company data. Attackers confirmed that attackers compromised the IT network of the company and deployed some of its machines with malware that […]

Pierluigi Paganini May 10, 2020
Coronavirus-themed attacks May 03 – May 09, 2020

This post includes the details of the Coronavirus-themed attacks launched from May 03 to May 09, 2020. Threat actors exploit the interest in the Coronavirus outbreak while infections increase worldwide, experts are observing new campaigns on a daily bases. Please give me your vote for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERShttps://docs.google.com/forms/d/e/1FAIpQLSe8AkYMfAAwJ4JZzYRm8GfsJCDON8q83C9_wu5u10sNAt_CcA/viewform Below […]

Pierluigi Paganini May 09, 2020
North Korea-linked Lazarus APT uses a Mac variant of the Dacls RAT

North Korea-linked Lazarus APT group employed a Mac variant of the Dacls Remote Access Trojan (RAT) in recent attacks. North Korea-linked Lazarus APT already used at least two macOS malware in previous attacks, now researchers from Malwarebytes have identified a new Mac variant of the Linux-based Dacls RAT. The activity of the Lazarus APT group (aka HIDDEN COBRA) […]

Pierluigi Paganini May 09, 2020
Sodinokibi gang hacked law firm of the celebrities and threatens to release the docs

The Sodinokibi ransomware gang stolen gigabytes of legal documents from the law firm of the stars, Grubman Shire Meiselas & Sacks (GSMLaw). The Sodinokibi ransomware group claims to have stolen gigabytes of legal documents from the entertainment and law firm Grubman Shire Meiselas & Sacks (GSMLaw) that has dozens of international stars and celebrities among […]

Pierluigi Paganini May 09, 2020
SilverTerrier gang uses COVID-19 lures in BEC attacks against healthcare, government organizations

Nigerian cyber gang SilverTerrier, specialized in BEC attacks, used COVID-19 lures in recent attacks on healthcare and government organizations. Researchers at Palo Alto Networks observed a Nigerian cyber gang, tracked as SilverTerrier and specialized in BEC attacks, using COVID-19 lures in a recent wave of attacks on healthcare and government organizations. SilverTerrier has been active since […]

Pierluigi Paganini May 08, 2020
Phishers turning hard-working: CERT-GIB records upsurge of phishing resource blockages as duration of attacks grows

Group-IB, a Singapore-based cybersecurity company, observed the growth of the lifespan of phishing attacks in the second half of 2019. This trend, revealed by Group-IB’s Computer Emergency Response Team (CERT-GIB), resulted in the tremendous increase in the number of phishing websites blockages over the given period — it rose by over 230 percent year-on-year. In 2019 in general, web […]

Pierluigi Paganini May 07, 2020
Poulight Stealer, a new Comprehensive Stealer from Russia

Researchers from Cybaze-Yoroi ZLab monitored the evolution and the diffusion of an infostealer dubbed Poulight that most likely has a Russian origin. Introduction Nowadays, info-stealer is one of the most common threats. This category of malware includes famous malware like Azorult, Agent Tesla, and Hawkeye. Infostealer market is one of the most remunerative for cyber criminals, information gathered […]

Pierluigi Paganini May 07, 2020
Naikon APT is flying under the radar since 2015

Chinese-speaking Naikon APT group leverages a new backdoor called Aria-body to target organizations in South Asia and Australia. The Naikon APT group is a China-linked cyber espionage group that has been active at least since 2010 and that remained under the radar over the past five years while targeting entities in Asia-Pacific (APAC) region. The […]

Pierluigi Paganini May 07, 2020
Snake Ransomware hits Europe’s largest private hospital operator Fresenius during COVID-19 outbreak

Snake Ransomware operators launched a new campaign that has infected numerous companies worldwide including an health care organization. The operators behind the Snake Ransomware have launched a new campaign that targeted companies worldwide and that infected at least one organization in the healthcare industry over the last few days. In January experts observed a new […]

Pierluigi Paganini May 07, 2020
Brazilian trojan banker is targeting Portuguese users using browser overlay

Since the end of April 2020, a new trojan has been affecting Portuguese users from several bank organizations. The modus operandi of this piece of malware is not new in Portugal. At least since the year of 2014 that new variants have been observed, with minor changes, and with the objective of collecting bank details […]