Malware & Threats

Malware & Threats

Issued by: Security Week

In a post on a publicly accessible hacker forum, a group calling itself “Desorden” claimed to have stolen databases and other files from breached Acer India servers. The hackers shared a link to a sample of the stolen data and they promised to leak more once they have analyzed it. They also published a video…

Malware & Threats

Issued by: Security Week

Dubbed SnapMC, the hacking group attempts to exploit multiple vulnerabilities in webserver and VPN applications for initial access and typically compromises victim networks in under 30 minutes. The group then exfiltrates victim data to leverage it for extortion, but doesn’t use ransomware or other means of disrupting the victim’s operations. SnapMC threatens to publish the…

Malware & Threats

Issued by: Security Week

Botnets continue to be a major problem for cybersecurity teams. With the growth in sophisticated threats, botnets are becoming more malicious, sometimes able to create hundreds of thousands of drones that can attack a variety of machines, including Mac systems, Linux, Windows systems, edge devices, IoT devices, and so on. Examining threat trends around botnet…

Malware & Threats

Issued by: Security Week

Dubbed FontOnLake, the malware family employs a rootkit to conceal its presence and uses different command and control servers for each sample, which shows how careful its operators are to maintain a low profile. What’s more, the malware developers are constantly modifying the FontOnLake modules, and use three categories of components that have been designed…

Malware & Threats

Issued by: Security Week

Researchers have discovered a previously unknown advanced threat actor, probably of Iranian origin, using a previously undocumented RAT targeting largely aerospace and telecommunications organizations. They have named the group MalKamak, and the campaign Operation GhostShell. Cybereason first detected the threat actor engaged in cyber espionage with the unknown remote access trojan – which it called…

Malware & Threats

Issued by: Security Week

The threat group, tracked until now by Mandiant as UNC1878, has been around since at least October 2018. The UNC classification is assigned to “uncategorized” entities before the cybersecurity firm can determine with certainty if it’s a financially-motivated group (FIN) or a state-sponsored advanced persistent threat actor (APT). The threat group, tracked until now by…

Malware & Threats

Issued by: Help Net Security

Backblaze announced Instant Recovery in Any Cloud—a solution to make ransomware recovery into a VMware and Hyper-V based cloud easy for any IT team. Big ransomware payments gain a lot of attention—like the $5 million Colonial Pipeline recently paid. But few realize that ransomware victims often rely on backups to return to normal operations, not…