Category: Heimdal Security Blog

Warning: Lazarus Targets Windows IIS Web Servers For Initial Access

The notorious Lazarus Group of North Korean state-sponsored threat actors is currently targeting vulnerable Windows Internet Information Services (IIS) web servers to obtain first access to business networks. Lazarus’ primary motivation is financial, and many observers think that the hackers’…

RaidForums Members Data Leaked on New Hacking Forum

Threat actors and security researchers now have access to a database for the notorious RaidForums hacking forums, giving them insight into the forum’s regulars. RaidForums was a very popular hacking and data leak forum known for hosting, leaking, and selling…

New Phishing Kit: File Archivers in the Browser

A new phishing kit, “File Archivers in the Browser” abuses ZIP domains. The kit displays bogus WinRAR or Windows File Explorer windows in the browser. The goal is to convince users to launch malicious processes. Google just enabled this month…

What Is ZTNA? Zero Trust Network Access Explained.

In today’s fast-changing digital landscape, ensuring strong network security has become a top priority for companies of all sizes. Given the rise of remote work, cloud computing, and increasingly complex cyber threats, conventional network architectures and perimeter-based security measures are…

The Royal Gang Is Developing Its Own Malware Loader

It has been reported that the Royal ransomware group is enhancing its arsenal with new malware. This group is said to have surfaced following the dismantling of the notorious Conti group. Several other Conti-related groups have been observed using commercial…

Privileged Access Management (PAM) Best Practices

Privileged access management, PAM in short, is a crucial set of tools and technologies allowing organizations to maintain steadfast control and monitorization over the access to critical information and resources, as well as users, accounts and processes. Precisely because it is…

Three New Zero-Day Vulnerabilities Fixed By Apple

Apple resolves three new zero-day vulnerabilities used to compromise iPhones and Macs. The flaws were all found in the multi-platform WebKit browser engine, as the company revealed in security advisories released to inform its clients about the active exploitation of…

Lemon Gang Pre-Infects 9 Million Android Devices With Malware

Nearly 9 million Android-based smartphones, watches, TVs, and TV boxes have been infected with the “Guerrilla” malware, pre-installed on the devices by Lemon Group. The threat actors use the malware to load additional payloads, intercept one-time passwords from SMS, set…

State-Sponsored Cybercrime Group`s Infrastructure Revealed

Researchers have uncovered previously unknown attack infrastructure used by Pakistani and Chinese entities operated by the state-sponsored group SideWinder. In a joint report, cybersecurity companies Group-IB and Bridewell say the threat actor uses 55 domains and IP addresses. At least since…

Ransomware in the Name of Charity: MalasLocker Targets Zimbra

A new ransomware operation has been observed hacking Zimbra servers to steal emails and encrypt files. Instead of demanding a ransom payment, the threat actors claim to require a donation to charity. In March 2023, a ransomware operation dubbed MalasLocker began encrypting…

PharMerica Cyber Incident Exposes 5.8 M People’s Data

PharMerica, the second largest provider of institutional pharmacy services in the United States, confirmed that it suffered a data breach that exposed the personal information of 5,815,591 people. The company started sending notices to the impacted individuals on the 12th…

Discord Announces a Data Breach Involving a Support Agent

Discord messaging platform announced a data breach. The incident involved a third-party support agent whose account has been compromised. The notification warned customers about unauthorized access to the agent’s support ticket queue. The Exposed Data & Security Measures This incident…

What Is Endpoint Privilege Management?

While this article aims to define what is endpoint privilege management, I will first begin to explain the circumstances of this process. Within any organization, privileges are usually split between two levels of hierarchy: standard users and administrators. The highest…

Toyota Disclosed a Ten-Year Long Data Breach

Toyota Motor Corporation issued a notice on the company’s Japanese newsroom disclosing a data breach of ten years. A database misconfiguration in its cloud environment leads to exposing of the car-location data of 2,150,000 customers. Details from the Data Breach…

Third-Party Patch Management: A Comprehensive Guide

In today’s digital age, software vulnerabilities are on the rise, and cyber threats are becoming more sophisticated. As a result, businesses must be proactive in their approach to cybersecurity to minimize the risk of a data breach. One way to…

Black Basta Ransomware Attacks Global Technology Company ABB

ABB, a leading provider of electrification and automation technology, has been hit by a Black Basta ransomware attack, which has reportedly affected business operations. As part of its services, ABB develops industrial control systems (ICS) and SCADA systems for manufacturers…

What Is Privileged Identity Management (PIM)?

When we talk about Privileged Access Management (PAM), Privileged Identity Management (PIM), Identity and Access Management (IAM), and other access management terms, we think of technologies for protecting a company’s critical assets. These phrases refer to maintaining the security of…

XDR vs SIEM vs SOAR: A Comparison

With the “detect early” and “respond fast” capabilities in your mind, you may wonder what to choose from the XDR vs SIEM vs SOAR options. A good Detection and Response (D&R) solution is essential for your company’s cybersecurity posture. As…

Fake Windows Update Used to Push Aurora Info-Stealer

The Aurora information-stealing malware was delivered through an in-browser Windows update simulation in a recent malvertising campaign. For more than a year, Aurora has been advertised on various hacker forums as an info stealer with extensive capabilities and low antivirus…

Cactus Ransomware Infiltrates Networks by Exploiting VPN Flaws

Researchers warn Cactus Ransomware exploits VPN Flaws to compromise networks and encrypts itself to avoid detection. The new ransomware strain targets large commercial entities that use remote access services and scans after unpatched vulnerabilities for initial access. How Is Cactus…

A New Ransomware Operation Threatens Your Business: Akira

Researchers spotted a new ransomware operation in March 2023. It is called Akira and targets businesses worldwide, breaching corporate networks, stealing and encrypting data. Threat actors claim to already have sixteen companies in their portfolio of victims from areas like…

Identity and Access Management Best Practices

Identity and Access Management is a critical component of modern-day cybersecurity. Often abbreviated as IAM, it refers to a collection of technologies, policies, and procedures that assist organizations in managing and verifying the identities of individuals and devices, granting access…

ReconShark – Kimsuky’s Newest Recon Tool

Kimsuky, a North Korean hacking group, has been observed employing a new version of its reconnaissance malware called “ReconShark” in a cyberespionage campaign with global reach. According to security analysts, the threat actor has broadened the range of targets it…

What Is IPAM in Networking and Cybersecurity?

Managing thousands of IP-connected devices can become a great challenge for many organizations. But imagine trying to keep track of which IP Address is assigned to each device, which DHCP lease is up, or when the IP has changed? In this…

New Decoy Dog Malware Toolkit Targets Enterprise Networks

A new, sophisticated malware toolkit called Decoy Dog was discovered after cybersecurity researchers analyzed more than 70 billion DNS records belonging to enterprise networks. To avoid detection, Decoy Dog uses stealthy methods like strategic domain aging and DNS query dribbling,…

What Is Privilege Escalation?

Privilege escalation might be a confusing cybersecurity term for many. That’s why in this article we’re going to shed a little bit more light on this topic. Keep reading to find out more about what is privilege escalation, how many…

RTM Locker Ransomware Gang Targets VMware ESXi Servers

RTM Locker is now the most recent enterprise-targeting ransomware operation found to be using a Linux encryptor to target virtual machines on VMware ESXi systems. The RTM (Read The Manual) cybercrime group, which is well-known for disseminating a unique banking…

What Is a Ping Flood and How to Prevent It?

Imagine sitting at your computer, ready to work or browse the internet, only to find that your connection is suddenly sluggish or completely non-existent. You may have fallen victim to a ping flood attack – one of the most common…

TP-Link High-Severity Flaw Added to Mirai Botnet Arsenal

A TP-Link Archer A21 (AX1800) consumer-grade WiFi router vulnerability has been used by Mirai botnet to launch DDoS attacks against IoT devices. The flaw in the TP-Link Archer AX21 firmware was discovered back in December 2022, and the company released a patch in…

New LOBSHOT Malware Deployed Via Google Ads

Google advertisements have been exploited to distribute various types of malware over the past few months. To trick unsuspecting users into downloading malware onto their systems, threat actors often used the platform to promote fake websites on legit software and…

7,413 People Were Impacted by Alaska Railroad Data Breach

Alaska Railroad Corporation reported a data breach incident that occurred in December 2022 and they discovered it on March 18th, 2023. According to ARCC, a third party gained unauthorized access to the internal network system. Further on, threat actors accessed…

Yellow Pages Canada Suffered a Cyberattack

Yellow Pages Group, a Canadian entity that specializes in directory publishing, has officially confirmed that it has fallen victim to a cyberattack. Black Basta, a group known for spreading ransomware and engaging in extortion, has taken credit for the attack…

PaperCut Flaw Exploited to Hijack Servers, Fix Released

Attackers are taking advantage of critical flaws in the widely used PaperCut MF/NG print management software to install Atera remote management software and take control of servers. The software is used by more than 100 million people from over 70,000…

What Is Privileged Account and Session Management (PASM)?

Privileged Account and Session Management (PASM) is a new PAM (Privileged Access Management) that focuses on privileged account monitoring and management for compliance, security, and data integrity purposes. Whereas PAM covers user account, on rights escalation demands, PASM and PEDM…

Stay Ahead of Cyberthreats with Proactive Threat Hunting

In today’s digital age, cyber threats are an ever-present danger to organizations of all sizes. From ransomware attacks to data breaches, the consequences of a successful cyberattack can be devastating. That’s why it’s essential for businesses to adopt a proactive…

US Medical Service Data Breach Impacts 2.3M People

Shields Health Care Group (SHCG), a medical service provider in the United States, announced a data breach that compromised the personal information of more than 2.3 million people. Shields reported the breach to the Maine Attorney General on April 19,…

Millions of Records With Sensitive Data Leaked by ICICI Bank

ICICI Bank, an Indian multinational valued at more than $76 billion, with over 5,000 branches operating across India and 15 other countries worldwide has leaked millions of records with sensitive data, including financial information and personal documents of the bank’s…

Companies Affected by Ransomware [2022-2023]

The increasing frequency and size of ransomware attacks are becoming a huge concern for thousands of organizations globally. All over the world, threat actors take advantage of security vulnerabilities and encrypt data belonging to all sorts of organizations: from private…

Iranian Hackers Target U.S. Energy and Transit Systems

Mint Sandstorm, an Iranian government-backed actor, has been linked to attacks on critical infrastructure in the United States between late 2021 and mid-2022. The entities that were targeted include seaports, energy companies, transit systems, and a major U.S. utility and…

US Company CommScope Hit by Ransomware

Following a ransomware attack back in March, sensitive employee data was compromised at CommScope, a major US telecommunications and IT infrastructure company. The Vice Society ransom gang claims to have published CommScope employee data on its dark web leak site. The…

New ”Domino” Malware Strain Targets Corporate Networks

Researchers recently discovered a new malware family named “Domino”, allegedly created by ITG14, also known as the FIN7 threat group. Reportedly, ex-Conti hackers have been using it since at least February 2023 to spread Project Nemesis info stealer or Cobalt…

Balada Injector Infects Nearly 1 Million WordPress Sites

A malware distribution operation known as Balada Injector has been active since 2017, and it is believed that it has infected over a million WordPress sites. According to GoDaddy’s Sucuri, the massive campaign “leverages all known and recently discovered theme…

Two New Emergency Patches from Apple

Apple is backporting two security patches released on Friday. The updated patches address zero-day vulnerabilities on iPhones, iPads, and Macs. Details About the Vulnerabilities The first flaw, tracked as CVE-2023-28206, is an out-of-bounds write issue. This bug may permit threat…

Round-Robin DNS Explained. What It Is and How It Works

The Round-robin DNS is a load-balancing technique that helps manage traffic and avoid overloading servers. Multiple IP addresses are assigned to a single domain name; each time the domain name is resolved, the returned IP address is picked in a…

Cyber Incident Cripples UK Criminal Records Office

After weeks of silence, the UK’s Criminal Records Office (ACRO) has issued a statement saying that the issues with the website that have been ongoing since January 17 were caused by a “cyber security incident.” ACRO manages criminal record information,…

MSI Breach Claimed By Money Message Ransomware Gang

A recent data breach affecting Taiwanese PC parts maker MSI (Micro-Star International) has been listed on the extortion portal of a new ransomware gang known as ‘Money Message’. The threat actors claim to have stolen source code from the company’s…