Pierluigi Paganini
March 07, 2017
The experts spotted a new sophisticated strain of malware dubbed StoneDrill that is linked to Shamoon 2 and Charming Kitten. Researchers at Kaspersky Lab have discovered further information about the dreaded Shamoon 2 malware. The experts spotted a new sophisticated strain of malware dubbed StoneDrill that is linked to Shamoon 2 and Charming Kitten (aka Newscaster and […]
Pierluigi Paganini
February 16, 2017
Security experts at IBM published a report that includes precious details on the attack chain of the dreader Shamoon cyberweapon. The dreaded Shamoon malware, aka Disttrack, has resurrected and government agencies and threat intelligence firms are investigating the recent strings of attacks leveraging the dangerous disk wiper. We detected the Shamoon malware for the first time in August 15th, […]
Pierluigi Paganini
February 08, 2017
An Iranian espionage group has been using an unsophisticated strain of malware, dubbed MacDownloader, to steal credentials and other data from Mac users. A cyber espionage group linked to the Iranian Government has been using an unsophisticated strain of malware, dubbed MacDownloader, to steal credentials and other data from Mac computers. The researchers Claudio Guarnieri and […]
Pierluigi Paganini
January 26, 2017
The dreaded Shamoon has resurrected, which are possible political and technological scenarios behind the recent wave of attacks? The dreaded Shamoon has resurrected, a new version called Shamoon 2 was spotted by the security experts at Palo Alto Networks. Saudi Arabia Computer Emergency Response Team (CERT)’s Abdulrahman al-Friah confirmed to Al Arabiya that at least 22 […]
Pierluigi Paganini
October 08, 2016
OilRig campaign – An Iran-linked hacker group which previously targeted organizations in Saudi Arabia has now set its sights on other countries. Iranian hackers which previously targeted organizations in Saudi Arabia are now targeting organizations in other countries, including the US, as part of a campaign identified as OilRig campaign. In addition to expanding its reach, the group has been enhancing its malware tools. Researchers at Palo Alto Networks have been monitoring the group for some time and have reported observing attacks launched by a threat actor against financial institutions and technology companies in Saudi Arabia and on the Saudi defense industry. This campaign referred to as “OilRig,” by Palo Alto Networks, entails weaponized Microsoft Excel spreadsheets tracked as “Clayslide” and a backdoor called “Helminth.” Bank attacks by the Iran-linked group were analyzed and documented by FireEye in May. Security Week reports that Palo Alto Networks, “discovered that it has also targeted a company in Qatar and government organizations in the United States, Israel and Turkey.” Helminth is delivered, by the threat actors behind OilRig, by way of spear-phishing emails and malicious macro-enabled Excel documents. For instance, in the caseof a Turkish government organization, the Excel file was designed to replicate a login portal for an airline. There are four variants of the Helminth malware and the threat, capable of communicating with its command and control (C&C) server over both HTTP and DNS, can gain information on the infected device and download additional files via a remote server. One type of Helminth malware relies on VBScript and PowerShell scripts. Another is deployed as an executable file. Delivered by […]
Pierluigi Paganini
August 29, 2016
The head of Iran’s civilian defense confirmed that a malware was found in petrochemical complexes, but it hasn’t caused the fires under investigation. Last week, I reported the news related to a series of fires at Iranian petrochemical plants. The Iran’s Supreme National Cyberspace Council started an investigation to discover if the incidents at oil and petrochemical […]
Pierluigi Paganini
August 19, 2016
Iran ’s cyberspace security authorities are investigating a string of fires in the country oil and gas facilities. Incidents or cyber sabotage? Once again, something of strange is happening in Iran, the Government of Teheran is investigating a recent string of incidents occurred in critical infrastructure in the country. The Iran’s Supreme National Cyberspace Council […]
Pierluigi Paganini
August 04, 2016
Hackers accessed Telegram accounts in Iran, a security duo investigated the security breach and will present its findings at the Black Hat Conference. 15 million Iranian Telegram accounts have been compromised, users have reportedly had their personal information exposed (phone number, Telegram ID). The security researchers Collin Anderson and Claudio Guarnieri have investigated the case, more […]
Pierluigi Paganini
June 01, 2016
Iran orders foreign social media and instant messaging companies to use servers in the country to store all data related to the Iranian citizens. The Iranian Government spends a significant effort for the Internet monitoring and control, its activities often lead to a concrete censorship. Last year the Government of Teheran has blocked Telegram and many other social networking companies due to […]
Pierluigi Paganini
January 18, 2016
A collection of interesting info about the Stuxnet attack published years ago by The New York Times, a must-read for experts. The popular cyber security expert Mikko Hypponen has retwitted an old blog post on the Stuxnet malware, a good opportunity to summarize the events and understand what is happened behind the scene. In 2011, The […]
Hacking / November 23, 2024
