Category: Securelist

FakeSG campaign, Akira ransomware and AMOS macOS stealer

In this report, we share our latest crimeware findings: FakeSG malware distribution campaign delivering NetSupport RAT, new Conti-like Akira ransomware and AMOS stealer for macOS. This article has been indexed from Securelist Read the original article: FakeSG campaign, Akira ransomware…

Story of the year: the impact of AI on cybersecurity

Generative AI has become the trendiest technology of 2023. Kaspersky reviews AI-related security concerns, and implementations of this technology in cyberdefense and red teaming, and provides predictions for 2024. This article has been indexed from Securelist Read the original article:…

New macOS Trojan-Proxy piggybacking on cracked software

A new macOS Trojan-Proxy is riding on cracked versions of legitimate software; it relies on DNS-over-HTTPS to obtain a C&C (command and control) address. This article has been indexed from Securelist Read the original article: New macOS Trojan-Proxy piggybacking on…

BlueNoroff: new Trojan attacking macOS users

BlueNoroff has been attacking macOS users with a new loader that delivers unknown malware to the system. This article has been indexed from Securelist Read the original article: BlueNoroff: new Trojan attacking macOS users

Kaspersky Security Bulletin 2023. Statistics

Key statistics for 2023: ransomware, trojan bankers, miners and other financial malware, zero-day vulnerabilities and exploits, web attacks, threats for macOS and IoT. This article has been indexed from Securelist Read the original article: Kaspersky Security Bulletin 2023. Statistics

IT threat evolution in Q3 2023. Mobile statistics

Mobile threat statistics for Q3 2023 include data on malware, adware, banking Trojans and ransomware for Android devices. This article has been indexed from Securelist Read the original article: IT threat evolution in Q3 2023. Mobile statistics

IT threat evolution in Q3 2023. Non-mobile statistics

PC malware statistics for Q3 2023 include data on miners, ransomware, banking Trojans and other threats to Windows, macOS and IoT equipment. This article has been indexed from Securelist Read the original article: IT threat evolution in Q3 2023. Non-mobile…

IT threat evolution Q3 2023

Attacks on a critical infrastructure target in South Africa, supply-chain attack on Linux machines, Telegram doppelganger used to target people in China. This article has been indexed from Securelist Read the original article: IT threat evolution Q3 2023

Consumer cyberthreats: predictions for 2024

Kaspersky experts review last year’s predictions on consumer cyberthreats and try to anticipate the trends for 2024. This article has been indexed from Securelist Read the original article: Consumer cyberthreats: predictions for 2024

Crimeware and financial cyberthreats in 2024

Kaspersky assesses last year’s predictions for the financial threat landscape, and tries to anticipate crimeware trends for the coming year 2024. This article has been indexed from Securelist Read the original article: Crimeware and financial cyberthreats in 2024

Advanced threat predictions for 2024

Kaspersky researchers review APT predictions for 2023 and current trends in the advanced threat landscape, and try to predict how it will develop in 2024. This article has been indexed from Securelist Read the original article: Advanced threat predictions for…

Advanced threat predictions for 2024

Kaspersky researchers review APT predictions for 2023 and current trends in the advanced threat landscape, and try to predict how it will develop in 2024. This article has been indexed from Securelist Read the original article: Advanced threat predictions for…

Ducktail fashion week

The Ducktail malware, designed to hijack Facebook business and ads accounts, sends marketing professionals fake ads for jobs with major clothing manufacturers. This article has been indexed from Securelist Read the original article: Ducktail fashion week

Gaming-related cyberthreats in 2023: Minecrafters targeted the most

Gaming-related threat landscape in 2023: desktop and mobile malware disguised as Minecraft, Roblox and other popular games, and the most widespread phishing schemes. This article has been indexed from Securelist Read the original article: Gaming-related cyberthreats in 2023: Minecrafters targeted…

How to catch a wild triangle

How Kaspersky researchers obtained all stages of the Operation Triangulation campaign targeting iPhones and iPads, including zero-day exploits, validators, TriangleDB implant and additional modules. This article has been indexed from Securelist Read the original article: How to catch a wild…

StripedFly: Perennially flying under the radar

Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows. The amount of effort that went into creating the framework is truly remarkable, and its disclosure was…

The outstanding stealth of Operation Triangulation

In this report Kaspersky shares insights into the validation components used in Operation Triangulation, TriangleDB implant post-compromise activity, as well as details of some additional modules. This article has been indexed from Securelist Read the original article: The outstanding stealth…

Money-making scripts attack organizations

Cybercriminals attack government, law enforcement, non-profit organizations, agricultural and commercial companies by slipping a cryptominer, keylogger, and backdoor into their systems. This article has been indexed from Securelist Read the original article: Money-making scripts attack organizations

APT trends report Q3 2023

TetrisPhantom targets government entities in APAC, APT BadRory attacks multiple entities in Russia, new malicious campaign uses well-known Owowa, IIS backdoor and other significant events during Q3 2023 This article has been indexed from Securelist Read the original article: APT…

A hack in hand is worth two in the bush

We analyzed the data published by Cyber Av3ngers and found it to be sourced from older leaks by another hacktivist group called Moses Staff. This article has been indexed from Securelist Read the original article: A hack in hand is…

ToddyCat: Keep calm and check logs

In this article, we’ll describe ToddyCat new toolset, the malware used to steal and exfiltrate data, and the techniques used by this group to move laterally and conduct espionage operations. This article has been indexed from Securelist Read the original…

A cryptor, a stealer and a banking trojan

In this report, we share our latest crimeware findings: the ASMCrypt cryptor/loader related to DoubleFinger, a new Lumma stealer and a new version of Zanubis Android banking trojan. This article has been indexed from Securelist Read the original article: A…

QR codes in email phishing

Scammers are camouflaging phishing links with QR codes and distributing them through email. This article has been indexed from Securelist Read the original article: QR codes in email phishing

Overview of IoT threats in 2023

IoT threats: how devices get hacked, what malware is uploaded, and what services are on offer on the dark web in 2023. This article has been indexed from Securelist Read the original article: Overview of IoT threats in 2023

Evil Telegram doppelganger attacks Chinese users

Spyware Telegram mod in Uighur and Chinese spreads through Google Play stealing messages and other user data. This article has been indexed from Securelist Read the original article: Evil Telegram doppelganger attacks Chinese users

IT threat evolution in Q2 2023

Q2 2023 overview: targeted attacks such as Operation Triangulation, CloudWizard and Lazarus activity, Nokoyawa ransomware, and others. This article has been indexed from Securelist Read the original article: IT threat evolution in Q2 2023

IT threat evolution in Q2 2023. Mobile statistics

The smartphone malware statistics for Q2 2023 includes data for Android malware, adware, banking Trojans and ransomware. This article has been indexed from Securelist Read the original article: IT threat evolution in Q2 2023. Mobile statistics

IT threat evolution in Q2 2023. Non-mobile statistics

PC malware statistics for Q2 2022 includes data on miners, ransomware, banking Trojans, and other threats to Windows, macOS and IoT devices. This article has been indexed from Securelist Read the original article: IT threat evolution in Q2 2023. Non-mobile…

Phishing with hacked sites

Scammers are hacking websites powered by WordPress and placing phishing pages inside hidden directories. We share some statistics and tips on recognizing a hacked site. This article has been indexed from Securelist Read the original article: Phishing with hacked sites

Focus on DroxiDat/SystemBC

An unknown actor targeted an electric utility in southern Africa with Cobalt Strike beacons and DroxiDat, a new variant of the SystemBC payload. We speculate that this incident was in the initial stages of a ransomware attack. This article has…

Common TTPs of attacks against industrial organizations

In 2022 we investigated a series of attacks against industrial organizations in Eastern Europe. In the campaigns, the attackers aimed to establish a permanent channel for data exfiltration, including data stored on air-gapped systems. This article has been indexed from…

Anomaly detection in certificate-based TGT requests

I identified several signs of attacks that use forged certificates inside the network and developed a Proof-of-Concept utility capable of finding artifacts in AD, as well as a number of detection logic rules that can be added to SIEM. This…

APT trends report Q2 2023

This is our latest summary of the significant events and findings, focusing on activities that we observed during Q2 2023. This article has been indexed from Securelist Read the original article: APT trends report Q2 2023

Andariel’s silly mistakes and a new malware family

In this crimeware report, Kaspersky researchers provide insights into Andariel’s activity targeting organizations: clumsy commands executed manually, off-the-shelf tools and EasyRat malware. This article has been indexed from Securelist Read the original article: Andariel’s silly mistakes and a new malware…

How cybercrime is impacting SMBs in 2023

This report contains statistics on cybersecurity threats to small and medium-sized businesses in 2023, and examples of cyberattacks on SMBs. This article has been indexed from Securelist Read the original article: How cybercrime is impacting SMBs in 2023

LockBit Green and phishing that targets organizations

In this crimeware report, Kaspersky researchers provide insights into the Conti-based LockBit Green variant, ransomware samples for macOS, FreeBSD, etc. and phishing campaigns targeting organizations. This article has been indexed from Securelist Read the original article: LockBit Green and phishing…

Understanding Malware-as-a-Service

What Malware-as-a-Service includes, on what terms cybercriminals offer it, and what malware they most often distribute under this model This article has been indexed from Securelist Read the original article: Understanding Malware-as-a-Service

IT threat evolution Q1 2023. Mobile statistics

The smartphone threat statistics for Q1 2023 includes data for Android malware, adware, banking Trojans and ransomware. This article has been indexed from Securelist Read the original article: IT threat evolution Q1 2023. Mobile statistics

IT threat evolution Q1 2023

Recent BlueNoroff and Roaming Mantis activities, new APT related to the Russo-Ukrainian conflict, ChatGPT and threat intelligence, malvertising through search engines, cryptocurrency theft campaign and fake Tor browser This article has been indexed from Securelist Read the original article: IT…

IT threat evolution in Q1 2023. Non-mobile statistics

PC malware statistics for the Q1 2023 includes data on miners, ransomware, banking Trojans, and other threats to Windows, macOS and IoT devices. This article has been indexed from Securelist Read the original article: IT threat evolution in Q1 2023.…

Satacom delivers browser extension that steals cryptocurrency

A recent campaign by Satacom downloader is delivering a cryptocurrency-stealing extension for Chromium-based browsers, such as Chrome, Brave and Opera. This article has been indexed from Securelist Read the original article: Satacom delivers browser extension that steals cryptocurrency

In search of the Triangulation: triangle_check utility

We developed a dedicated utility to scan the iOS backups and run all the checks for Operation Triangulation indicators. This article has been indexed from Securelist Read the original article: In search of the Triangulation: triangle_check utility

Meet the GoldenJackal APT group. Don’t expect any howls

GoldenJackal is an APT group, active since 2019, that usually targets government and diplomatic entities in the Middle East and South Asia. The main feature of this group is a specific toolset of .NET malware, JackalControl, JackalWorm, JackalSteal, JackalPerInfo and…

CloudWizard APT: the bad magic story goes on

Kaspersky analysis of the CloudWizard APT framework used in a campaign in the region of the Russo-Ukrainian conflict. This article has been indexed from Securelist Read the original article: CloudWizard APT: the bad magic story goes on

Minas – on the way to complexity

Kaspersky analysis of a complicated multi-stage attack dubbed Minas that features a number of detection evasion and persistence techniques and results in a cryptocurrency miner infection. This article has been indexed from Securelist Read the original article: Minas – on…

The nature of cyberincidents in 2022

Kaspersky Incident Response report for 2022: incident response statistics, key trends and conclusions, expert recommendations. This article has been indexed from Securelist Read the original article: The nature of cyberincidents in 2022

New ransomware trends in 2023

On the eve of the global Anti-Ransomware Day, Kaspersky researchers share an overview of the key trends observed among ransomware groups. This article has been indexed from Securelist Read the original article: New ransomware trends in 2023

Managed Detection and Response in 2022

Managed Detection and Response in 2022: number and severity of incidents, detection rate, breakdown by country and industry, data on cyberattacks in different regions. This article has been indexed from Securelist Read the original article: Managed Detection and Response in…

What does ChatGPT know about phishing?

Kaspersky research on ChatGPT capabilities to tell a phishing link from a legitimate one by analyzing the URL, as well as extract target organization name. This article has been indexed from Securelist Read the original article: What does ChatGPT know…

APT trends report Q1 2023

For more than five years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. These summaries are based on our threat intelligence research; and they provide a representative snapshot…

QBot banker delivered through business correspondence

In early April, we detected a significant increase in attacks that use banking Trojans of the QBot family (aka QakBot, QuackBot, and Pinkslipbot). The malware would be delivered through e-mails that were based on real business letters the attackers had…

Uncommon infection methods—part 2

Kaspersky researchers discuss infection methods used by Mirai-based RapperBot, Rhadamantys stealer, and CUEMiner: smart brute forcing, malvertising, and distribution through BitTorrent and OneDrive. This article has been indexed from Securelist Read the original article: Uncommon infection methods—part 2

Following the Lazarus group by tracking DeathNote campaign

The Lazarus group is a high-profile Korean-speaking threat actor with multiple sub-campaigns. In this blog, we’ll focus on an active cluster that we dubbed DeathNote. This article has been indexed from Securelist Read the original article: Following the Lazarus group…

Nokoyawa ransomware attacks with Windows zero-day

In February 2023, we found a zero-day exploit, supporting different versions and builds of Windows, including Windows 11. This particular zero-day was used by a sophisticated cybercrime group that carries out ransomware attacks. This article has been indexed from Securelist…

Overview of Google Play threats sold on the dark web

Kaspersky research into dark web offers related to Android malware and its distribution via Google Play: hacked app developer accounts, malicious loaders, etc. This article has been indexed from Securelist Read the original article: Overview of Google Play threats sold…

The Telegram phishing market

Phishing bots and services on Telegram: how malicious actors use the messaging app to automate the process of generating phishing pages, and sell phishing kits and data. This article has been indexed from Securelist Read the original article: The Telegram…

Financial cyberthreats in 2022

This report shines a spotlight on the financial cyberthreat landscape in 2022. We look at phishing threats commonly encountered by users and companies, as well as the dynamics of various Windows and Android-based financial malware. This article has been indexed…

Copy-paste heist or clipboard-injector attacks on cryptousers

Clipboard injector malware targeting cryptocurrencies such as Bitcoin, Ethereum, Litecoin, Dogecoin and Monero, is distributed under the guise of Tor Browser. This article has been indexed from Securelist Read the original article: Copy-paste heist or clipboard-injector attacks on cryptousers

How scammers employ IPFS for email phishing

Attackers put phishing HTML files in IPFS thus cutting back on web hosting costs. IPFS is used in both mass phishing and targeted (spearphishing) campaigns. This article has been indexed from Securelist Read the original article: How scammers employ IPFS…

Understanding metrics to measure SOC effectiveness

How do we ensure the services being provided by SOCs are meeting expectations? How do we know continuous improvement is being incorporated in daily operations? The answer lies in the measurement of SOC internal processes and services. This article has…

Developing an incident response playbook

Incident response playbooks help optimize the SOC processes, and are a major step forward to SOC maturity, but can be challenging for a company to develop. In this article, I want to share some insights on how to create the…

Malvertising through search engines

Kaspersky observes a growth in malvertising activity that exploits Google search ads to promote fake software websites that deliver stealers, such as RedLine and Rhadamantys. This article has been indexed from Securelist Read the original article: Malvertising through search engines

The state of stalkerware in 2022

In 2022, Kaspersky data shows that 29,312 unique individuals around the world were affected by stalkerware. We detected 182 different stalkerware apps, the most popular one was Reptilicus. This article has been indexed from Securelist Read the original article: The…

The mobile malware threat landscape in 2022

Android threat report by Kaspersky for 2022: malware on Google Play and inside the Vidmate in-app store, mobile malware statistics. This article has been indexed from Securelist Read the original article: The mobile malware threat landscape in 2022

IoC detection experiments with ChatGPT

We decided to check what ChatGPT already knows about threat research and whether it can help with identifying simple adversary tools and classic indicators of compromise, such as well-known malicious hashes and domains. This article has been indexed from Securelist…

Spam and phishing in 2022

Statistics on spam and phishing with the key trends in 2022: two-stage spear phishing, hijacking of social network and instant messaging accounts, import substitution, and survey phishing. This article has been indexed from Securelist Read the original article: Spam and…

IoC detection experiments with ChatGPT

We decided to check what ChatGPT already knows about threat research and whether it can help with identifying simple adversary tools and classic indicators of compromise, such as well-known malicious hashes and domains. This article has been indexed from Securelist…

Web beacons on websites and in e-mail

Explaining web beacons (web bugs, spy or tracking pixels), what companies use these on websites and in e-mail, how and why. This article has been indexed from Securelist Read the original article: Web beacons on websites and in e-mail

Web beacons on websites and in e-mail

Explaining web beacons (web bugs, spy or tracking pixels), what companies use these on websites and in e-mail, how and why. This article has been indexed from Securelist Read the original article: Web beacons on websites and in e-mail