Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Killnet 2.0 Emerges ...

 Dark Web News

A new and formidable player has emerged on the dark web again– the Killnet 2.0 hacker group. With a similar name to the original Russian hacker group, this particular hacker collective aims to decentralize the hacking community, urging to move beyond the conventional hierarchy of hacker groups. Killnet 2.0 has been   show more ...  

linked to a series of cyberattacks, showcasing their prowess in the hacking industry. The group’s activities extend beyond mere notoriety, with a distinct focus on infiltrating systems and compromising sensitive information. The dark web has become their playground, providing the perfect cover for their illicit operations. Killnet 2.0: The Revamped Threat Actor of Dark Web Source: CyberKnow on Twitter The Russian hacker gang, known as Killnet 2.0, employs advanced techniques to breach security protocols and exploit vulnerabilities. Their modus operandi involves executing targeted cyberattacks on organizations, aiming to disrupt operations and gain unauthorized access to confidential data. The dark web serves as a hub for the Killnet hacker group, providing a cloak of anonymity that makes it challenging for authorities to trace their activities. This cyber underworld has become a breeding ground for malicious actors, where tactics like ransomware attacks and data breaches are orchestrated with impunity. With advanced features, the cybersecurity community is faced with the daunting task of countering this formidable threat.  What is the Killnet 2.0 Hacker Group? Killnet 2.0, a pro-Russia hacker group, gained infamy for its 2022 DoS and DDoS attacks during the Russian invasion of Ukraine. Emerging in March 2022, it targeted government institutions globally, prompting a Five Eyes intelligence alliance warning in April. Killnet’s attacks spanned Romania, Moldova, the Czech Republic, Italy, Lithuania, Norway, Latvia, the United States, Japan, Georgia, and Germany.  Source: CyberKnow on Twitter Notably, it attempted a DDoS attack during Eurovision 2022 and claimed responsibility for a cyber-attack on Lockheed Martin. Killnet’s actions, coupled with its threats and geopolitical motivations, highlight the new challenges posed by cyber threats on an international scale. The rise of Killnet 2.0 on the dark web signifies a new chapter in the threat actor plans. The Russian hacker gang’s activities demand a unified and proactive response from organizations and cybersecurity experts alike. The new 2.0 version only adds fuel o the fire as the threat actor is now boasting new features and capabilities to target organizations and world governments.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Alleged NoName Ranso ...

 Firewall Daily

NoName ransomware group has claimed responsibility for a series of cyberattacks that have targeted multiple websites across Ukraine, Finland, and the USA. This revelation, posted on the threat actor’s dark web channel, specifically names eight organizations as the alleged victims in what appears to be a   show more ...  

coordinated and widespread cyberattack on organizations. The organizations identified as targets in this purported NoName ransomware attack include PrivatBank 24, Credit Agricole Bank, MTB BANK, Accordbank, Matek Systems (China), Pixhawk (Switzerland), SpetsInTech, and Kvertus. NoName Ransomware Attack: Multiple Organizations Listed as Victims Source: Twitter The dark web post by the threat actor includes cryptic error messages and Check-Host links, presumably to substantiate their claims. The error messages suggest a range of disruptions, including “503 Service Unavailable,” “403 Forbidden,” and “Internal Server Error.” While these details are concerning, it is important to note that the claims made by the NoName ransomware group remain unverified as of the time of writing. Source: Twitter The Cyber Express has taken the initiative to reach out to some of the organizations mentioned in the dark web post, seeking official statements or responses. Unfortunately, as of now, no statements or confirmations have been received from any of the organizations listed as victims in this alleged NoName ransomware attack. NoName Ransomware Group: Claims Vs Reality  Despite the claims made by the NoName ransomware group, a visual examination of the targeted organizations’ websites reveals a mixed scenario. While some websites seem to be fully operational, displaying no immediate signs of a cyberattack, about half of the listed websites are experiencing issues. These issues range from displaying “403 Forbidden” errors to taking an extensive amount of time to render, suggesting a potential disruption or compromise. The situation is dynamic and continues to unfold. It is crucial to approach this information with caution, as unverified claims in the cybersecurity realm are not uncommon. The alleged NoName ransomware attack highlights the persistent threat of cyberattacks on banks and other vital entities.  As this is an ongoing story, The Cyber Express will diligently monitor and update this article with any new information regarding the alleged NoName ransomware attack or any further updates from the organizations listed by the NoName ransomware group. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for BianLian Ransomware ...

 Firewall Daily

The BianLian ransomware attack has allegedly targeted two more victims, Cislo & Thomas LLP and Image Craft. The dark web portal now showcases the compromised organizations, adding to the growing list of entities falling prey to the BianLian ransomware group.  Cislo & Thomas LLP, a full-service intellectual   show more ...  

property law firm, and Image Craft, a nationally recognized visual communications specialist, have both found themselves entangled in the web of this relentless cyber threat. BianLian Ransomware Attack: Two New Victims Added Source: Twitter The BianLian ransomware attack on these two organizations was made public through posts on the dark web portal. Cislo & Thomas LLP, known for providing patent, trademark, copyright, and trade secret legal services globally, and Image Craft, renowned for innovative visual communication methods, are now grappling with the aftermath of this sophisticated cyber assault. Source: Twitter To understand the scope of this alleged BianLian ransomware attack, The Cyber Express reached out to the affected organizations. However, at the time of writing this, no official statement or response has been recorded, leaving the claims surrounding the BianLian ransomware attack unverified at this point. The BianLian Ransomware Group Spree This incident follows a broader trend where the BianLian ransomware group has shifted its focus to target US and European healthcare and manufacturing industries. A recent report from Palo Alto Networks Inc.’s Unit 42 highlights the strategies of the BianLian hacker group, with a specific emphasis on the healthcare and manufacturing sectors in the US and Europe. BianLian, which gained notoriety in 2022 for its traditional ransomware attacks, has evolved its tactics. Initially known for encrypting files and demanding ransom payments, the group has now transitioned to stealing data and threatening to publish it if the ransom is not paid. This strategic shift aims to simplify attacks while maintaining leverage over victims through the threat of data exposure. Modus Operandi of BianLian Ransomware Group  The Unit 42 researchers discovered that BianLian employs a custom .NET tool for data extraction, also used by the Makop ransomware group, suggesting a possible collaboration or shared resources between the two groups. This tool retrieves sensitive information from compromised systems, including files, registry data, and clipboard contents, with Russian language elements in its codebase hinting at the group’s origins. Source: Twitter In a separate incident, the BianLian ransomware group has claimed three additional victims – North Star Tax and Accounting, KC Pharmaceuticals, and Martinaire, all based in the United States. Source: Twitter Despite the claims, the official websites of these companies remain functional, raising questions about the extent of the BianLian ransomware attack, data compromise, and the motives behind these cyber assults. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for The Intricacies of A ...

 Dark Web News

A new information stealer has arrived on the dark web. Known as the Atomic Stealer (AMOS), this information stealer, this information-stealing malware is designed for a phishing campaign associated with the rise of dead cookie restoration and Xehook Stealer. Cyble Research and Intelligence Labs (CRIL) recently found a   show more ...  

campaign where an updated version of AMOS Stealer was deployed through deceptive websites masquerading as legitimate Mac applications. Despite being distributed through Google Ads in the past, the newer version of the Atomic Stealer is being published through websites like Parallels Desktop, CleanMyMac, Arc Browser, and Pixelmator. The Complex World of Atomic Stealer: Recent Updates and Capabilities Source: Cyble The continuous evolution of AMOS, marked by frequent updates, highlights the developer’s commitment to refining its functionalities for malicious purposes. The malware has expanded its reach across multiple browsers, enabling it to extract auto-fills, passwords, cookies, and financial details from various wallets. Moreover, AMOS goes beyond data theft, offering additional services such as a web panel, MetaMask brute-forcing, crypto checking, and a DMG installer. Source: Cyble According to CRIL, a big development in the AMOS saga is its newfound capability to revive expired Google Chrome cookies. This marks a transformative trend in the information stealer market, providing threat actors with a powerful tool for prolonged unauthorized access. The release of a free code on a cybercrime forum for restoring expired cookies has raised concerns among researchers, as it opens the door for low-profile threat actors to incorporate this method into their malware payloads. Source: Cyble Xehook Stealer: The Quick Adaptable Information Stealer Source: Cyble On January 20, 2024, Xehook Stealer surfaced on a cybercrime forum, demonstrating a quick integration of the cookie revival feature within 2-3 days. This rapid adaptation by Xehook Stealer highlights a growing trend among InfoStealers, as threat actors leverage the revived cookies method to enhance their malicious capabilities. The analysis also uncovered a potential connection in campaigns or Threat Actors (TAs) as all AMOS stealer payloads share a common Command and Control center (C&C), identified as “5.42.65.108.” This C&C server had been previously documented in a report on Atomic Stealer by Malwarebytes, suggesting a correlation among these malware payloads. Source: Cyble To gain deeper insights, CRIL conducted a comprehensive technical analysis of AMOS, focusing on its initial infection, system information gathering, and browser data extraction. AMOS was found spreading through deceptive sites such as parallelsdesktop.pro, cleanmymac.pro, arcbrowser.pro, and pixelmator.pics. Source: Cyble Technical Details of the Information Stealers Source: Cyble The stealer employs a novel encryption method to conceal strings within the file, dynamically decrypting and retrieving actual strings at runtime. Furthermore, it utilizes the system_profiler tool to gather extensive information about the victim’s Mac computer, including software, hardware, and display details. Source: Cyble AMOS targets a variety of Chromium-based browsers, including Safari, Chrome, Brave, Edge, Opera, OperaGX, and Vivaldi. The malware extracts sensitive data from specific directories, such as Cookies, Network/Cookies, Login Data, and Web Data. Additionally, it retrieves Mozilla Firefox data, including information from files like cookies.sqlite, formhistory.sqlite, key4.db, and logins.json. Source: Cyble The stealer initiates the extraction of information related to crypto wallets, targeting wallets such as Electrum, Binance, Exodus, Atomic, and Coinomi. Additionally, it fetches the password linked to the label ‘Chrome’ from the macOS keychain, specifically targeting the Google Chrome application. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Breaches and Incidents

SentinelLabs observed a campaign by ScarCruft actors targeting media organizations and high-profile experts in North Korean affairs. As part of the attack, the group impersonated a North Korea Research Institute member, used the RokRAT backdoor, and harvested threat intelligence from their targets. A modern-day   show more ...  

TIP providing contextual and operational intelligence by automatically enriching, and correlating the IOCs, shall help organizations protect their network proactively.

 Malware and Vulnerabilities

The FAUST ransomware, a Phobos variant, employs a fileless attack to deploy shellcode, injects the final payload, and creates multiple threads for efficient execution while maintaining exclusion lists to avoid damaging the system.

 Govt., Critical Infrastructure

The railway network, spanning 4,500 kilometers in Saudi Arabia, faces challenges in securing its legacy and modern technologies, especially with the introduction of IoT signaling and communication systems.

 Threat Actors

Aleksandr Ermakov, a Russian cybercriminal, has been sanctioned by Australia, the UK, and the US for his alleged involvement in the Medibank data breach and his ties to the REvil ransomware group.

 Expert Blogs and Opinion

Despite Google's efforts to enforce abuse policies and remove malicious ads, cybercrooks are finding new ways to evade detection and continue to lead users to malware-infected websites.

 Trends, Reports, Analysis

Ransomware attacks have affected schools like Ohio’s Groveport Madison Schools, causing disruptions to internet access and damage to devices, but efforts to restore systems and minimize data theft have been successful.

 Incident Response, Learnings

Vladimir Dunaev was extradited to the US in October 2021 and pleaded guilty to charges related to computer fraud and identity theft. He developed malicious tools that aided in data theft and fraud, resulting in millions of dollars in losses.

 Feed

Debian Linux Security Advisory 5609-1 - Several vulnerabilities were discovered in the Slurm Workload Manager, a cluster resource management and job scheduling system, which may result in privilege escalation, denial of service, bypass of message hash checks or opening files with an incorrect set of extended groups.

 Feed

Ubuntu Security Notice 6610-1 - Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. Cornel Ionce discovered   show more ...  

that Firefox did not properly manage memory when opening the print preview dialog. An attacker could potentially exploit this issue to cause a denial of service.

 Feed

Debian Linux Security Advisory 5608-1 - A heap-based buffer overflow during tile list parsing was discovered in the AV1 video codec parser for the GStreamer media framework, which may result in denial of service or potentially the execution of arbitrary code if a malformed media file is opened.

 Feed

Ubuntu Security Notice 6611-1 - It was discovered that Exim incorrectly handled certain requests. A remote attacker could possibly use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism.

 Feed

The U.S. National Security Agency (NSA) has admitted to buying internet browsing records from data brokers to identify the websites and apps Americans use that would otherwise require a court order, U.S. Senator Ron Wyden said last week. "The U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans' privacy are not just unethical, but illegal

 Feed

Cybersecurity researchers have identified malicious packages on the open-source Python Package Index (PyPI) repository that deliver an information stealing malware called WhiteSnake Stealer on Windows systems. The malware-laced packages are named nigpal, figflix, telerer, seGMM, fbdebug, sGMM, myGens, NewGends, and TestLibs111. They have been uploaded by a threat actor named "WS." "These

 Feed

A now-patched security flaw in Microsoft Outlook could be exploited by threat actors to access NT LAN Manager (NTLM) v2 hashed passwords when opening a specially crafted file. The issue, tracked as CVE-2023-35636 (CVSS score: 6.5), was addressed by the tech giant as part of its Patch Tuesday updates for December 2023. "In an email attack scenario, an attacker could exploit the

 Feed

In today's digital world, security risks are more prevalent than ever, especially when it comes to Software as a Service (SaaS) applications. Did you know that an alarming 97% of companies face serious risks from unsecured SaaS applications?Moreover, about 20% of these organizations are struggling with internal data threats. These statistics aren't just numbers; they're a wake-up call. We're

 Feed

In nearly every segment of our lives, AI (artificial intelligence) now makes a significant impact: It can deliver better healthcare diagnoses and treatments; detect and reduce the risk of financial fraud; improve inventory management; and serve up the right recommendation for a streaming movie on Friday night. However, one can also make a strong case that some of AI’s most significant impacts

 Feed

Cybersecurity researchers have detected in the wild yet another variant of the Phobos ransomware family known as Faust. Fortinet FortiGuard Labs, which detailed the latest iteration of the ransomware, said it's being propagated by means of an infection that delivers a Microsoft Excel document (.XLAM) containing a VBA script. "The attackers utilized the Gitea service to store several files

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Cynet. Thanks to the team there for their support. As Cynet’s COO, my team and I get to work closely with risk management executives at small-to-medium enterprises (SMEs) around the world. In this piece, I’ll distill insights from our   show more ...  

collaboration into three salient … Continue reading "Top 3 Cybersecurity Trends for SME Business Leaders"

 Guest blog

A 40-year-old Russian man has been sentenced to five years and four months in prison by a US court, for his involvement in the Trickbot gang that deployed ransomware and stole money and sensitive information from businesses around the world. Read more in my article on the Hot for Security blog.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Asia In Brief Indian infosec firm CloudSEK last week claimed it found records describing 750 million Indian mobile network subscribers on the dark web, with two crime gangs offering the trove of data for just $3,000. CloudSEK named CYBO CREW affiliates   show more ...  

CyboDevil and UNIT8200 as the vendors of a […] La entrada 750 million Indian mobile subscribers’ info for sale on dark web – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: grahamcluley.com – Author: Graham Cluley Graham Cluley Security News is sponsored this week by the folks at Cynet. Thanks to the team there for their support. Netanel Amar, Co-founder & COO, Cynet As Cynet’s COO, my team and I get to work closely with risk management executives at small-to-medium   show more ...  

enterprises (SMEs) around the world. […] La entrada Top 3 Cybersecurity Trends for SME Business Leaders – Source: grahamcluley.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas Multiple proof-of-concept (PoC) exploits for a critical Jenkins vulnerability allowing unauthenticated attackers to read arbitrary files have been made publicly available, with some researchers reporting attackers actively exploiting the flaws in attacks.   show more ...  

Jenkins is an open-source automation server widely used in software development, particularly for Continuous Integration (CI) and […] La entrada Exploits released for critical Jenkins RCE flaw, patch now – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas The Kansas City Area Transportation Authority (KCATA) announced it was targeted by a ransomware attack on Tuesday, January 23. KCATA is a bi-state public transit agency serving seven counties of Missouri and Kansas, operating 78 bus routes and 6 MetroFlex   show more ...  

routes using a fleet of 300 buses. The company […] La entrada Kansas City public transportation authority hit by ransomware – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Lohrmann on Cybersecurity Every January, NASCIO and PTI release their forecasts for the coming year based on what government leaders are saying. So what’s coming in 2024? Here’s a roundup of top CIO priorities. January 28, 2024 •  Dan Lohrmann Adobe Stock/OleCNX   show more ...  

When Doug Robinson speaks, the government technology community listens. He […] La entrada NASCIO, PTI on What’s Coming in 2024 for State and Local IT – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 articles

Source: securityboulevard.com – Author: Esther Han As technology continues to evolve at an unprecedented pace, the field of DevOps is no exception. DevOps, the cultural and professional movement that aims to improve collaboration between software development and IT operations, is predicted to transform, expand,   show more ...  

and evolve significantly in 2024. In this blog post, we explore […] La entrada Navigating the Future: DevOps Predictions for 2024 – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Leigh Dow Safeguarding our online accounts has never been more crucial. One of the most effective tools at our disposal is Two-Factor Authentication (2FA). Let’s discuss how 2FA adds an essential layer of protection to your digital life. Two-Factor Authentication is a   show more ...  

security process in which users provide two different authentication […] La entrada Doubling Down on Security: The Critical Role of Two-Factor Authentication – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Contrast Protect

Source: securityboulevard.com – Author: Joseph Beeton, Senior Application Security Researcher, Contrast Security Security Bloggers Network  Home » Security Bloggers Network » Zero-day Confluence RCE Vulnerability Blocked by Contrast Runtime Security | CVE-2023-22527 | Contrast Security by Joseph   show more ...  

Beeton, Senior Application Security Researcher, Contrast Security on January 26, 2024 If your organization is running an older […] La entrada Zero-day Confluence RCE Vulnerability Blocked by Contrast Runtime Security | CVE-2023-22527 | Contrast Security – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 admits

Source: thehackernews.com – Author: . Jan 29, 2024NewsroomSurveillance / Data Privacy The U.S. National Security Agency (NSA) has admitted to buying internet browsing records from data brokers to identify the websites and apps Americans use that would otherwise require a court order, U.S. Senator Ron   show more ...  

Wyden said last week. “The U.S. government should not be […] La entrada NSA Admits Secretly Buying Your Internet Browsing Data without Warrants – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . Jan 29, 2024NewsroomPyPI Repository / Malware Cybersecurity researchers have identified malicious packages on the open-source Python Package Index (PyPI) repository that deliver an information stealing malware called WhiteSnake Stealer on Windows systems. The   show more ...  

malware-laced packages are named nigpal, figflix, telerer, seGMM, fbdebug, sGMM, myGens, NewGends, and TestLibs111. They have been […] La entrada Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-01
Aggregator history
Monday, January 29
MON
TUE
WED
THU
FRI
SAT
SUN
JanuaryFebruaryMarch