Threat Intelligence - Security Ticks

LockBit Ransomware 2.0 Resurfaces

CVE-2017-0199, cybercrime, darkweb, Korea, Lockbit 3.0, LockBit Ransomware 2.0, Malware, phishing, Ransomware, Threat Actor, Threat Intelligence / SecurityTicks

LockBit Ransomware 2.0 Resurfaces 06/06/2023 at 15:02 By cybleinc Cyble Research and Intelligence Labs analyzes LockBit ransomware which uses malicious documents to specifically target users in Korea. The post LockBit Ransomware 2.0 Resurfaces appeared first on Cyble. This article is an excerpt from Cyble View Original Source React to this headline:

React to this headline:

LockBit Ransomware 2.0 Resurfaces Read More »

HelloTeacher: New Android Malware Targeting Banking Users In Vietnam

All, Android malware, Banking Trojan, HelloTeacher Malware, Kik Messenger, Malware, MB Bank, spyware, Threat Actor, Threat Intelligence, TPBank Mobile, Viber, VietinBank iPay, Vietnam / SecurityTicks

HelloTeacher: New Android Malware Targeting Banking Users In Vietnam 05/06/2023 at 17:23 By cybleinc Cyble analyzes a new malware “HelloTeacher” masquerading as popular messaging app to target banking users from Vietnam and steals sensitive data. The post HelloTeacher: New Android Malware Targeting Banking Users In Vietnam appeared first on Cyble. This article is an excerpt

React to this headline:

HelloTeacher: New Android Malware Targeting Banking Users In Vietnam Read More »

MOVEit Transfer Vulnerability Actively Exploited

All, Azure SQL, CGSI, Clop ransomware, cybercriminals, darkweb, Germany, Managed File Transfer, MFT, Microsoft SQL, Moveit Transfer, MySQL, Threat Actors, Threat Intelligence, United Kingdom, United States, vulnerability / SecurityTicks

MOVEit Transfer Vulnerability Actively Exploited 02/06/2023 at 17:04 By cybleinc Cyble analyzes MOVEit Transfer vulnerability and observes active exploitation in the Cyble Global Intelligence Sensors (CGSI). The post MOVEit Transfer Vulnerability Actively Exploited appeared first on Cyble. This article is an excerpt from Cyble View Original Source React to this headline:

React to this headline:

MOVEit Transfer Vulnerability Actively Exploited Read More »

‘NoEscape’ Ransomware-as-a-Service (RaaS)

C, ChaCha20, CIS, Commonwealth of Independent States, cybercrime, darkweb, data breach, Data leak, Malware, NoEscape, RaaS, Ransomware, Ransomware Affiliate, Russia, Safe Mode, Server Message Block, Threat Intelligence, Triple-Extortion, Windows, Windows NT 10.0 / SecurityTicks

‘NoEscape’ Ransomware-as-a-Service (RaaS) 01/06/2023 at 18:32 By cybleinc CRIL analyzes the newly advertised ‘NoEscape’ Ransomware-as-a-Service (RaaS) program that claims to facilitate sophisticated extortion operations using an advanced, indigenously developed ransomware strain. The post ‘NoEscape’ Ransomware-as-a-Service (RaaS) appeared first on Cyble. This article is an excerpt from Cyble View Original Source React to this headline:

React to this headline:

‘NoEscape’ Ransomware-as-a-Service (RaaS) Read More »

SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations

APT, Argentina, Australia, backdoor, Brazil, Canada, China, CVE-2017-11882, CVE-2018-0798, CVE-2018-0802, cyberattack, cybercrime, data breach, Data leak, DLL Downloader, Equation Editor, France, G20, G7, Germany, Hiroshima, India, Indonesia, Initial access, Italy, Japan, Malware, Microsoft Office, RTF, Saudi Arabia, SharpPanda, South Africa, South Korea, Threat Intelligence, Turkey, United Kingdom, United States, Vulnerabilities / SecurityTicks

SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations 01/06/2023 at 08:36 By cybleinc Cyble analyzes SharpPanda, a highly sophisticated APT group utilizing spear-phishing tactics to launch cyberattacks on G20 Nation officials. The post SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations appeared first on Cyble. This article is an excerpt from Cyble View

React to this headline:

SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations Read More »

Evolving Threat Landscape of Hacktivism in Colombia

#OpColombia, Berghof, Berghof Web Panel, critical infrastructure, cybercrime, darkweb, data breach, Data leak, DDoS Attack, Fueling Systems, GhostSec, GNSS, Government, Hacktivism, HMI, Human Machine Interface, Industrial Control Systems, Israel, Malware, National Critical Infrastructure, OpIsrael, OSINT, Power Supply Controllers, Radio Broadcast, Satellite Receivers, SiegedSec, Threat Intelligence, Zero-Day / SecurityTicks

Evolving Threat Landscape of Hacktivism in Colombia 31/05/2023 at 11:22 By cybleinc CRIL investigates the evolving threat landscape of hacktivism leading to cyberattacks on Colombian Critical Infrastructure and Zero-day Sales by Hacktivists. The post Evolving Threat Landscape of Hacktivism in Colombia appeared first on Cyble. This article is an excerpt from Cyble View Original Source

React to this headline:

Evolving Threat Landscape of Hacktivism in Colombia Read More »

Bl00dy Ransomware Targets Indian University: Actively Exploiting PaperCut Vulnerability

APT, Bl00dy, Bl00dy ransomware, CISA, Conti, CSA, CVE-2023-27350, cybercrime, darkweb, data breach, Data leak, ERP, Helpdesk, Lockbit 3.0, Malware, Moodle, PaperCut, PaperCut MF, PaperCut NG, Port 9191, Port 9192, Ransomware, RDP, Remote Desktop Protocol, Shodan, Telegram, Threat Intelligence, Twitter / SecurityTicks

Bl00dy Ransomware Targets Indian University: Actively Exploiting PaperCut Vulnerability 30/05/2023 at 14:46 By cybleinc CRIL analyzes Bl00dy Ransomware’s recent targeting of an Indian University via exploitation of the PaperCut vulnerability. The post Bl00dy Ransomware Targets Indian University: Actively Exploiting PaperCut Vulnerability appeared first on Cyble. This article is an excerpt from Cyble View Original Source

React to this headline:

Bl00dy Ransomware Targets Indian University: Actively Exploiting PaperCut Vulnerability Read More »

PixBankBot: New ATS-Based Malware Poses Threat to the Brazilian Banking Sector

Android, Android Banking trojan, ATS, ATS Framework, Banco Central do Brasil, Banco Itaú, Bank fraud, Banking Sector, Banking Trojan, BFSI, Brazil, C6 Bank, cybercrime, darkweb, Data leak, fake app, fraud, GoatRAT, Malware, Mercado Pago, NUBank, Nubank: conta, PagBank Banco, PasteBin, PicPay, PIX, PixBankBot, PixPirate, R$, Threat Actors, Threat Intelligence / SecurityTicks

PixBankBot: New ATS-Based Malware Poses Threat to the Brazilian Banking Sector 30/05/2023 at 12:36 By cybleinc Cyble analyzes PixBankBot, a new ATS-based malware that targets Brazilian banks through the popular Pix instant payment platform. The post PixBankBot: New ATS-Based Malware Poses Threat to the Brazilian Banking Sector appeared first on Cyble. This article is an

React to this headline:

PixBankBot: New ATS-Based Malware Poses Threat to the Brazilian Banking Sector Read More »

Invicta Stealer Spreading Through Phony GoDaddy Refund Invoices

Blisk, BraveSoftware, ChromePlus, CocCoc Browser, Coowon, cybercrime, darkweb, Epic Privacy Browser, GoDaddy, Invicta, Iridium, Malware, QIP Surf, Sleipnir, Slimjet, Stealer, Steam, Threat Intelligence / SecurityTicks

Invicta Stealer Spreading Through Phony GoDaddy Refund Invoices 25/05/2023 at 19:16 By cybleinc Cyble Research & Intelligence Labs analyzes Invicta, a new stealer that spreads via fake GoDaddy Refund invoices to infect users. The post Invicta Stealer Spreading Through Phony GoDaddy Refund Invoices appeared first on Cyble. This article is an excerpt from Cyble View

React to this headline:

Invicta Stealer Spreading Through Phony GoDaddy Refund Invoices Read More »

Security Pros: Before You Do Anything, Understand Your Threat Landscape

Incident Response, Threat Intelligence / SecurityTicks

Security Pros: Before You Do Anything, Understand Your Threat Landscape 25/05/2023 at 17:48 By Marc Solomon Regardless of the use case your security organization is focused on, you’ll likely waste time and resources and make poor decisions if you don’t start with understanding your threat landscape. The post Security Pros: Before You Do Anything, Understand

React to this headline:

Security Pros: Before You Do Anything, Understand Your Threat Landscape Read More »

European Cybersecurity Firm Sekoia.io Raises $37.5 Million

Cybersecurity Funding, funding, Threat Intelligence, XDR / SecurityTicks

European Cybersecurity Firm Sekoia.io Raises $37.5 Million 25/05/2023 at 16:03 By Ionut Arghire European XDR and threat intelligence provider Sekoia.io has raised €35 million ($37.5 million) in Series A funding. The post European Cybersecurity Firm Sekoia.io Raises $37.5 Million appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original Source

React to this headline:

European Cybersecurity Firm Sekoia.io Raises $37.5 Million Read More »

Obsidian ORB Ransomware Demands Gift Cards as Payment

AES Cryptographic Provider, All, BlackSnake, Chaos Ransomware, cybercrime, darkweb, data breach, Data leak, Gift Card, Malware, Microsoft Enhanced RSA, Obsidian ORB, Obsidian ORB Ransomware, Onyx, Payday, Paysafe, Ransomware, Steam, Threat Intelligence / SecurityTicks

Obsidian ORB Ransomware Demands Gift Cards as Payment 25/05/2023 at 09:16 By cybleinc Cyble Research & Intelligence Labs analyzes Obsidian ORB, a ransomware hybrid that demands ransom payments in the form of gift cards. The post Obsidian ORB Ransomware Demands Gift Cards as Payment appeared first on Cyble. This article is an excerpt from Cyble

React to this headline:

Obsidian ORB Ransomware Demands Gift Cards as Payment Read More »

Notable DDoS Attack Tools and Services Supporting Hacktivist Operations in 2023

Artemis C2 DDoS Botnet, cybercrime, darkweb, DDoS, DDoS Attack, DDosia Project, Hacktivism, Killnet, Killnet DDoS, Malware, Neferian Empire DDoS Botnet, RedStress.io DDoS Panel, SkyElite-Net DDoS, Stressbot.io, Tesla Botnet, Threat Intelligence, Ziyaettin DDoS Botnet / SecurityTicks

Notable DDoS Attack Tools and Services Supporting Hacktivist Operations in 2023 24/05/2023 at 18:26 By cybleinc Cyble Research & Intelligence Labs analyzes the growing use of DDoS attacks by Hacktivist groups across the world. The post Notable DDoS Attack Tools and Services Supporting Hacktivist Operations in 2023 appeared first on Cyble. This article is an

React to this headline:

Notable DDoS Attack Tools and Services Supporting Hacktivist Operations in 2023 Read More »

Virtual Event Today: Threat Detection and Incident Response Summit

Featured, Malware & Threats, Threat Intelligence, Training & Awareness / SecurityTicks

Virtual Event Today: Threat Detection and Incident Response Summit 24/05/2023 at 11:16 By Mike Lennon Join thousands of attendees as we dive into threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack. (Register Now) The post Virtual Event Today: Threat Detection and Incident Response Summit appeared first

React to this headline:

Virtual Event Today: Threat Detection and Incident Response Summit Read More »

New MDBotnet Unleashes DDoS Attacks

botnet DDoS, cybercrime, darkweb, DDoS, DDoS Attack, DDOS-as-a-Service, Hacktivism, Hacktivists, HTTPGetAttack, Malware, MDBotnet, MDBotnetUpdater, SlavaRussia, svhost.exe, SYN, SYNAttack, Threat Intelligence / SecurityTicks

New MDBotnet Unleashes DDoS Attacks 23/05/2023 at 18:03 By cybleinc Cyble Research & Intelligence Labs analyzes MDBotnet, a malware variant of Russian origin, carrying out DDoS-as-a-Service attacks. The post New MDBotnet Unleashes DDoS Attacks appeared first on Cyble. This article is an excerpt from Cyble View Original Source React to this headline:

React to this headline:

New MDBotnet Unleashes DDoS Attacks Read More »

New Ransomware Wave Engulfs over 200 Corporate Victims

8Base Ransomware, AES, cybercrime, darkweb, data breach, Data leak, Double encryption, Leak site, MalasLocker, Malware, MalwareHunterTeam, Ransomware, Rhysida, Threat Intelligence, Zscaler / SecurityTicks

New Ransomware Wave Engulfs over 200 Corporate Victims 23/05/2023 at 17:34 By cybleinc CRIL analyzes multiple new Ransomware families that have affected over 200 firms, spearheaded by Rhysida, 8Base, and MalasLocker ransomware. The post New Ransomware Wave Engulfs over 200 Corporate Victims appeared first on Cyble. This article is an excerpt from Cyble View Original

React to this headline:

New Ransomware Wave Engulfs over 200 Corporate Victims Read More »

DarkBERT could help automate dark web mining for cyber threat intelligence

Artificial Intelligence, dark web, Don't miss, Hot stuff, News, research, Threat Intelligence / SecurityTicks

DarkBERT could help automate dark web mining for cyber threat intelligence 19/05/2023 at 13:05 By Helga Labus Researchers have developed DarkBERT, a language model pretrained on dark web data, to help cybersecurity pros extract cyber threat intelligence (CTI) from the Internet’s virtual underbelly. DarkBERT pretraining process and evaluated use case scenarios (Source: KAIST/S2W) DarkBERT: A

React to this headline:

DarkBERT could help automate dark web mining for cyber threat intelligence Read More »

AndoryuBot’s DDOS Rampage

All, AndoryuBot, CGSI, CISA, cybercrime, Cyble Global Sensor Network, darkweb, data breach, Data leak, DDoS, Fortinet, HTTP GET, Malware, Ransomware, RCE, Remote Control Execution, Ruckus Wireless, Telegram, Threat Intelligence / SecurityTicks

AndoryuBot’s DDOS Rampage 17/05/2023 at 18:49 By cybleinc CRIL analyzes AndoryuBot, a new botnet exploiting a critical vulnerability to carry out large-scale DDOS attacks on Ruckus Wireless products. The post AndoryuBot’s DDOS Rampage appeared first on Cyble. This article is an excerpt from Cyble View Original Source React to this headline:

React to this headline:

AndoryuBot’s DDOS Rampage Read More »

BlackSuit Ransomware Strikes Windows and Linux Users

BlackSuit, cybercrime, Cylance, darkweb, data breach, Linux, Malware, Ransomware, Royal Ransomware, Threat Intelligence, Unit 42, VMWare, Windows / SecurityTicks

BlackSuit Ransomware Strikes Windows and Linux Users 12/05/2023 at 17:02 By cybleinc Cyble Research & Intelligence Labs analyzes a new ransomware named BlackSuit which can target Windows and Linux operating systems. The post BlackSuit Ransomware Strikes Windows and Linux Users appeared first on Cyble. This article is an excerpt from Cyble View Original Source React

React to this headline:

BlackSuit Ransomware Strikes Windows and Linux Users Read More »

Dissecting Rancoz Ransomware

@siri_urz, Avast, Avira, b95a4443bb8bff80d..., Backups, ChaChapoly, Chrome, Command Line Arguments, Common7, Comodo, cybercrime, darkweb, data breach, Data leak, Dell, Dr.Web, ESET, Install Shield Installation Information, Intel, Kaspersky Lab, Malware, McAfee, Microsoft Help, Microsoft SDKs, Microsoft Shared, Microsoft Visual Studio, Microsoft VS Code, Microsoft.NET, MingGW, MingGW (GCC), MovieMaker, NTRU, NTRU Public Key, NVIDIA Corporation, Onion, Opera, OSINT, Package Cache, Rancoz, Ransomware, RDP, Reference assemblies, Remote Access Trojans, Remote Desktop Protocol, ShadowCopy, ShellExecute, Spytechsoftware, Symantec, Symantec Client Security, System Volume Information, Threat Intelligence, Vice Society, Windows, Windows App Certification Kit, Windows Defender, Windows Mail, Windows Media Player, Windows Multimedia Platform, Windows NT, Windows Phone Silverlight Kits, Windows Photo Viewer, Windows Portable Devices, Windows Security, WindowsApps, WindowsPowerShell, Wsus, Yandex Browser / SecurityTicks

Dissecting Rancoz Ransomware 11/05/2023 at 15:46 By cybleinc CRIL analyzes Rancoz, a new ransomware variant that is leveraging Vice Society’s codebase to target a wider victim base. The post Dissecting Rancoz Ransomware appeared first on Cyble. This article is an excerpt from Cyble View Original Source React to this headline:

React to this headline:

Dissecting Rancoz Ransomware Read More »