Cybercrime

Pierluigi Paganini March 02, 2022
NVIDIA discloses data breach after the recent cyber attack

Chipmaker giant Nvidia confirmed a data breach after the recently disclosed security incident, proprietary information stolen. The chipmaker giant Nvidia was recently the victim of a cyber attack that impacted some of its systems for two days. The security breach is not connected to the ongoing crisis in Ukraine, according to a person familiar with […]

Pierluigi Paganini February 28, 2022
Researcher leaked Conti’s internal chat messages in response to its support to Russia

A Ukrainian researcher leaked tens of thousands of internal chat messages belonging to the Conti ransomware operation. A Ukrainian researcher leaked 60,694 messages internal chat messages belonging to the Conti ransomware operation after the announcement of the group of its support to Russia. Researchers from cybersecurity firm Hold Security confirmed that the researcher was able to access […]

Pierluigi Paganini February 28, 2022
Security Affairs newsletter Round 355

A new round of the weekly Security Affairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. If you want to also receive for free the newsletter with the international press subscribe here. Anonymous breached the internal network of Belarusian railways Feb 7- Feb 27 Ukraine – […]

Pierluigi Paganini February 28, 2022
Iran-linked UNC3313 APT employed two custom backdoors against a Middle East gov entity

An Iran-linked threat actor, tracked as UNC3313, was observed using two custom backdoor against an unnamed Middle East government entity. UNC3313 is an Iran-linked threat actor that was linked with “moderate confidence” to the MuddyWater nation-state actor (aka Static Kitten, Seedworm, TEMP.Zagros, or Mercury) by cybersecurity firm Mandiant. UNC3313 was observed deploying two new custom […]

Pierluigi Paganini February 27, 2022
Feb 7- Feb 27 Ukraine – Russia the silent cyber conflict

This post provides a timeline of the events related to the Russia invasion of Ukraine from the cyber security perspective. Below is the timeline of Russia – Ukraine cyber dispute February 27 – Ukraine: Volunteer IT Army is going to hit tens of Russian targets from this list Ukraine is recruiting a volunteer IT army […]

Pierluigi Paganini February 25, 2022
Ukraine calls on independent hackers to defend against Russia, Russian underground responds

While Ukraine calls for hacker underground to defend against Russia, ransomware gangs make their moves. Ukraine’s government is asking for volunteers from the hacker underground to provide their support in protecting critical infrastructure and carry out offensive operations against Russian state-sponsored hackers, reported Reuters which cited two e experts involved in the project. The call […]

Pierluigi Paganini February 24, 2022
Deadbolt Ransomware targets Asustor and QNap NAS Devices

Deadbolt ransomware operators are targeting Asustor NAS (network-attached storage) appliances. Storage solutions provider Asustor is warning its customers of a wave of Deadbolt ransomware attacks targeting its NAS devices. Since January, DeadBolt ransomware operators are targeting QNAP NAS devices worldwide, its operators claim the availability of a zero-day exploit that allows them to encrypt the […]

Pierluigi Paganini February 24, 2022
New Wiper Malware HermeticWiper targets Ukrainian systems

Cybersecurity experts discovered a new data wiper malware that was used in attacks against hundreds of machines in Ukraine. The threat of hybrid warfare is reality, Russia-linked APT group have supported the operations of the Russian army while preparing for the invasion. Researchers from cybersecurity firms ESET and Broadcom’s Symantec discovered a new data wiper malware that was employed in […]

Pierluigi Paganini February 24, 2022
US and UK link new Cyclops Blink malware to Russian state hackers

UK and US cybersecurity agencies linked Cyclops Blink malware to Russia’s Sandworm APT US and UK cybersecurity and law enforcement agencies published a joint security advisory about a new malware, dubbed Cyclops Blink, that has been linked to the Russian-backed Sandworm APT group. Sandworm (aka BlackEnergy and TeleBots) has been active since 2000, it operates under the […]

Pierluigi Paganini February 22, 2022
Threat actors target poorly protected Microsoft SQL Servers

Threat actors install Cobalt Strike beacons on vulnerable Microsoft SQL Servers to achieve a foothold in the target network. Researchers from Ahn Lab’s ASEC spotted a new wave of attacks deploying Cobalt Strike beacons on vulnerable Microsoft SQL Servers to achieve initial access to target networks and deploy malicious payloads. The threat actors behind the […]