Sign in Subscribe

Latest

SLOW#TEMPEST Campaign Targets Chinese Users with Cobalt Strike and Mimikatz Attacks

SLOW#TEMPEST Campaign Targets Chinese Users with Cobalt Strike and Mimikatz Attacks

This campaign, targeting Chinese-speaking users, employed a combination of Cobalt Strike and Mimikatz to infiltrate and persist within compromised systems. The attack appears to have been conducted through phishing emails containing malicious ZIP files

Transport for London Faces Ongoing Cybersecurity Incident

Transport for London Faces Ongoing Cybersecurity Incident

Transport for London (TfL) provided notice that its computer systems are currently under attack in an ongoing cybersecurity incident. Despite the breach, TfL assures the public that there is no evidence of customer data being compromised and that their transportation services remain unaffected.

North Korean Threat Actor Citrine Sleet Exploits Chromium Zero-Day Vulnerability

North Korean Threat Actor Citrine Sleet Exploits Chromium Zero-Day Vulnerability

Citrine Sleet, a North Korean threat actor tracked by Microsoft, has been involved in various cyber operations targeting the financial sector. The group is notorious for its sophisticated social engineering tactics

Suspected Espionage Campaign Delivers "Voldemort" Malware Impersonating Tax Authorities

Suspected Espionage Campaign Delivers "Voldemort" Malware Impersonating Tax Authorities

Proofpoint released a threat insight report detailing an unusual campaign delivering custom malware named "Voldemort". Researchers assess with moderate confidence that the goal of this activity is espionage.

Godzilla Fileless Backdoor Exploits CVE-2023-22527 in Atlassian Confluence

Godzilla Fileless Backdoor Exploits CVE-2023-22527 in Atlassian Confluence

The Godzilla webshell, a Chinese-language malware, leverages AES encryption to evade detection and remains memory-resident, making it particularly challenging for legacy anti-virus solutions to detect.

State-backed attackers and commercial surveillance vendors repeatedly use the same exploits

State-backed attackers and commercial surveillance vendors repeatedly use the same exploits

These campaigns, targeting Mongolian government websites, involved the reuse of n-day exploits previously linked to commercial surveillance vendors (CSVs) Intellexa and NSO Group. The attackers, suspected to be Russian government-backed APT29.

Threat Actors Target Middle Eastern Organizations with Fake Palo Alto GlobalProtect Tool

Threat Actors Target Middle Eastern Organizations with Fake Palo Alto GlobalProtect Tool

The malware, disguised as the Palo Alto GlobalProtect tool, employs a multi-stage infection process and advanced command-and-control (C&C) infrastructure, posing significant risks to the affected entities.