CVE-2012-0158

Introduction DLL Hijacking — a technique for forcing legitimate applications to run malicious code — has been in use for about a decade at least. In this write-up we give a short introduction to the technique of DLL Hijacking, followed by a digest of several dozen documented uses of that technique over the past decade […]

A recently flagged phishing campaign aimed at delivering the Agent Tesla RAT to unsuspecting users takes advantage of old vulnerabilities in Microsoft Office that allow remote code execution. “Despite fixes for CVE-2017-11882/CVE-2018-0802 being released by Microsoft in November, 2017 and January, 2018, this vulnerability remains popular amongst threat actors, suggesting there are still unpatched devices in the wild, even after over five years,” says Fortinet researcher Xiaopeng Zhang. “We are observing and mitigating 3000 attacks … More →

SentinelOne security researchers have analyzed the operations of a Chinese cyberespionage group that has been actively targeting education, government, and telecommunication organizations in Australia and Southeast Asia since at least 2013.

Researchers spotted a previously undocumented Chinese-speaking APT, tracked as Aoqin Dragon, targeting entities in Southeast Asia and Australia. SentinelOne documented a series of attacks aimed at government, education, and telecom entities in Southeast Asia and Australia carried out by a previously undocumented Chinese-speaking APT tracked as Aoqin Dragon. The APT primary focus on cyberespionage against targets […]

For roughly a decade, a previously unknown advanced persistent threat (APT) actor has been engaging in long-term surveillance operations against academics, activists, journalists, human rights defenders, and law professionals, SentinelOne reports.

Trend Micro released a research urging organizations to focus patching efforts on the vulnerabilities that pose the greatest risk to their organization, even if they are years old. Older exploits for sale more popular with criminals The research found that 22% of exploits for sale in underground forums are more than three years old. “Criminals know that organizations are struggling to prioritize and patch promptly, and our research shows that patch delays are frequently taken … More →

For the latest discoveries in cyber research for the week of 14th June, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Audi and Volkswagen have experienced data breaches that affected 3.3 million customers. Between August 2019 and May 2021, unsecured data was left exposed on the internet by a mutual vendor. During that […]

The biggest security trend for 2020 has been the increase of COVID-19-related phishing and other attacks targeting remote workers. New York City, for example, has gone from having to protect 80,000 endpoints to around 750,000 endpoints in its threat management since work-from-home edicts took place. As noted in a recent Check Point Software Technologies mid-year […]

The typical timing of patch releases, exploits and CVE publication underscores the need for timely patching and effective vulnerability management.

For years, a China-linked threat actor named Cycldek has been exfiltrating data from air-gapped systems using a previously unreported, custom USB malware family, Kaspersky reports.

In addition to protecting the desktop, you should also pay close attention to the Office suite–in particular, Microsoft’s Object Linking and Embedding (OLE) platform. OLE allows you to make linked connections between applications and other documents, but it also provides a toehold for attackers to gain access into our systems. As a recently National Cyber […]

Several Microsoft Office vulnerabilities that were patched years ago continue to be among the security flaws most exploited in attacks, the U.S. government warns.

The US Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to patch a slew of old and new software vulnerabilities that are routinely exploited by foreign cyber actors and cyber criminals. “Foreign cyber actors continue to exploit publicly known—and often dated—software vulnerabilities against broad target sets, including public and private sector organizations. Exploitation of these vulnerabilities often requires fewer resources as compared with zero-day exploits for which no patches are available,” the agency noted. … More →

We identified 300+ COVID-19 themed malware samples that communicated with 20 unique IP addresses and domain IOCs.

PaloAlto Networks experts warn of malicious Coronavirus themed phishing campaigns targeting government and medical organizations. Experts from Paloalto Unit 42 published a report that analyzes the cross-section between the various types of Coronavirus-themed attacks aimed at organizations in different industries. Recently organizations in healthcare, research, and government facilities have been hit by Coronavirus-themed attacks that […]

New research shows COVID-19 themed phishing campaigns are targeting healthcare organizations and medical research facilities around the world.

Researchers spotted a campaign using Excel files to spread LimeRAT malware using the 8-year-old and well-known VelvetSweatshop bug. Researchers at the Mimecast Threat Center spotted a new campaign using Excel files to spread LimeRAT malware using the 8-year-old VelvetSweatshop bug. LimeRAT is a powerful Remote Administration Tool publicly available as an open-source project on Github, it […]

Threat actors are taking advantage of COVID-19 with new cyber threats so we've outlined how to protect yourself and your organization.

Which ten software vulnerabilities should you patch as soon as possible (if you haven’t already)? Table of top exploited CVEs between 2016 and 2019 (repeats are noted by color) Recorded Future researchers have analyzed code repositories, underground forum postings, dark web sites, closed source reports and data sets comprising of submissions to popular malware repositories to compile a list of the ten most exploited vulnerabilities by cybercriminals in 2019. The list The list is comprised … More →

Analyzing how tactics, techniques and procedures of the Russia-linked APT28 cyberespionage group evolve over the time. APT28 is a well known Russian cyber espionage group attributed, with a medium level of confidence, to Russian military intelligence agency GRU (by CrowdStrike). It is also known as Sofacy Group (by Kaspersky) or STRONTIUM (by Microsoft) and it’s used to target Aereospace, Defence, Governmente Agencies, International […]

For three years, Unit 42 has tracked a set of cyber espionage attack campaigns across Asia, which used a mix of publicly available and custom malware. Unit 42 created the moniker “PKPLUG” for the threat actor group, or groups, behind these and other documented attacks referenced later in this report. We say group or groups as our current visibility doesn’t allow us to determine with high confidence if this is the work of one group, or more than one group which uses the same tools and has the same tasking. The name comes from the tactic of delivering PlugX malware inside ZIP archive files as part of a DLL side-loading package. The ZIP file format contains the ASCII magic-bytes “PK” in its header, hence PKPLUG.

Experts at Trend Micro discovered a new variant of the Asruex Trojan that exploits old Microsoft Office and Adobe vulnerabilities to infect systems. Malware researchers at Trend Micro discovered a new variant of the Asruex Trojan that exploits old Microsoft Office and Adobe vulnerabilities to infect Windows and Mac systems. Asruex first appeared in the […]

A recently observed variant of the Asruex backdoor acts as an infector by targeting old vulnerabilities in Microsoft Office and Adobe Reader and Acrobat 9.x, Trend Micro reports.

A cyber-espionage group, tracked as APT40, apparently linked to the Chinese government is focused on targeting countries important to the country’s Belt and Road Initiative. The cyber-espionage group tracked as APT40 (aka TEMP.Periscope, TEMP.Jumper, and Leviathan), apparently linked to the Chinese government, is focused on targeting countries important to the country’s Belt and Road Initiative […]

APT40 Hackers Appear to be Supporting China’s Belt and Road Initiative

A previously undisclosed threat actor is targeting nuclear-armed government and military in Pakistan as part of a new, unusually complex espionage campaign, Cylance security researchers warn.

Researchers from security firm CrowdStrike have observed a new campaign associated with the GOBLIN PANDA APT group. Experts from security firm CrowdStrike have uncovered a new campaign associated with the GOBLIN PANDA APT group. The group also knows as Cycldek was first spotted in September 2013, it was mainly targeting entities in Southeast Asia using different malware variants mainly PlugX and […]

CrowdStrike security researchers have observed renewed activity associated with GOBLIN PANDA, a threat actor mainly targeting entities in Southeast Asia.

If the infamous bank robber, Willie Sutton , were alive today and honed his cyber skills, he might turn his attention to corporate espionage. Why? Because, as he once said about banks, “that’s where the money is.”

Cybercriminals and nation state groups were quick to adopt the most effective exploits last year, a new AlienVault report reveals.

Unit 42 tracks Subaat: a small phishing campaign targeting government organizations.

Unit 42 examines the BadPatch campaign consisting of 4 types of malware and new attack methods.

Researchers at Trend Micro and Cisco’s Talos have identified a new wave of phishing attacks leveraging CVE-2017-0199, a previously patched remote code execution vulnerability in the OLE (Windows Object Linking and Embedding) interface of Microsoft Office. These latest attacks have paired the vulnerability with others in an attempt to bypass warning messages, but the results […]

Researchers at Cisco Talos have come across an attack that combines two Microsoft Office exploits, one old and one new, likely in an effort to avoid detection.

A report published by Kaspersky Lab on Thursday shows that the number of attacks involving exploits increased significantly in 2016 compared to the previous year, but the number of attacked users actually dropped.

One doesn’t have to be a great coder to become a successful cybercriminal, as underground markets are filled with offerings that automate one or another step of an attack chain. Take for example the AKBuilder, a builder for Word documents that carry exploits for several vulnerabilities and a malicious, encrypted payload. The evolution of AKBuilder According to SophosLabs principal researcher Gábor Szappanos, two versions of the builder have, at one time or another, found their … More →

According to the firm ProofPoint, Chinese state-sponsored actors continues to spy on military and aerospace organizations in Russia and Belarus. Chinese state-sponsored actors are spying on military and aerospace interests in Russia and Belarus. According to the experts from Proofpoint, the attacks began in the summer of 2016, the Chinese hackers launched a spear-phishing campaign leveraging […]

Taiwan has been a regular target of cyber espionage threat actors for a number of years. Reasons for Taiwan being targeted range from being one of the sovereign states of the disputed South China Sea region to its emerging economy and growth with Taiwan being one of the most innovative countries in the High-Tech industry

A cyber espionage group that has been targeting organizations in Southeast Asia for years is misusing a legitimate conference invite as a phishing lure to trigger the download of backdoor malware. The APT in question is Lotus Blossom, and the security conference is Palo Alto Networks’ CyberSecurity Summit that is scheduled to take place in Jakarta, Indonesia, on November 3. About Lotus Blossom Lotus Blossom is a group that has been operating at least since … More →

The Chinese APT Lotus Blossom is trying to lure victims with fake invitations to Palo Alto Networks’ upcoming Cybersecurity Summit. The Chinese APT Lotus Blossom, also known as Elise and Esile, is behind a new cyber espionage campaign that is trying to lure victims with fake invitations to Palo Alto Networks’ upcoming Cybersecurity Summit. With this […]

A China-linked cyber espionage group known as Lotus Blossom, Elise and Esile has used fake invitations to Palo Alto Networks’ upcoming Cybersecurity Summit to trick users into installing a piece of malware on their systems.

Actors related to the Operation Lotus Blossom campaign continue their attack campaigns in the Asia Pacific region. It appears that these threat actors have begun using Palo Alto Networks upcoming Cyber Security Summit hosted on November 3, 2016 in Jakarta, Indonesia as a lure to compromise targeted individuals. The payload installed in attacks using this

A cyber-espionage campaign operating for more than eight months has been linked to an Indian Advanced Persistent Threat (APT) group known as Patchwork, which might be the same attackers behind Operation Hangover, Forcepoint researchers warn.

Researchers have come across a document exploit generator that has been used over the past few years by several threat actors to deliver malware in cyber espionage campaigns.

Threat actors tend to reuse certain tools, a trend we observed during recent Unit 42 research published on MNKit. In this post, we will discuss a fresh toolkit, which on the surface, appeared similar to MNKit, but functionally was found to be quite different. This toolkit, which we named “HOMEKit”, is similar to MNKit in

Adobe’s Flash Player might be the most targeted product when criminal exploit kits are involved, but Microsoft products such as Office, Windows and Internet Explorer take center stage when Russian advanced persistent threat (APT) groups are involved.

Security experts at Symantec revealed that the Patchwork hacker crew is now expanding espionage activities on companies in a wide range of industries. Security experts from Symantec have spotted a new cyber espionage campaign managed by the Patchwork group targeting organizations in multiple industries. The hacker crew is a well-known group, its activities are focused on diplomatic […]

A cyberespionage group known for targeting diplomatic and government institutions has branched out into many other industries, including aviation, broadcasting, and finance, researchers warn. Known as Patchwork, or Dropping Elephant, the group stands out not only through its use of simple scripts and ready-made attack tools, but also through its interest in Chinese foreign relations. […]

The India-linked threat actor known as Patchwork or Dropping Elephant is targeting more than just government-associated organizations, Symantec researchers say.

Most attacks that are targeting vulnerabilities in Microsoft Office to compromise victims’ systems are currently leveraging two security issues that were discovered last year, SophosLabs researchers warn.

Kaspersky Lab researchers investigated a threat actor that was undertaking aggressive cyber espionage activity in the Asian region, targeting multiple diplomatic and government entities with a particular focus on China and its international affairs. This group, named Dropping Elephant (also known as “Chinastrats”), used their unsophisticated tools to attack some high profile Western targets as well. In February 2016, following an alert from a partner, Kaspersky Lab’s Global Research and Analysis Team began its investigation … More →

Security experts from ProofPoint have spotted a new campaign operated by the APT Group NetTraveler that is targeting Russian and European organizations. NetTraveler is an ATP group first spotted by Kaspersky in 2013, when researchers discovered an espionage activity against over 350 high profile victims from 40 countries. The name of the operation derives from the malicious […]

Kaspersky Lab is monitoring a new cyber espionage group that it calls Dropping Elephant. A surprising — and somewhat worrying — feature is that this group achieves a high success rate with only low tech attacks. In fact, it has been so successful that it seems to have expanded it group membership from (probably) just India to include new members on the Pacific West Coast of America.

APT Group Uses NetTraveler to Spy on Russian, European Victims

An Office vulnerability patched by Microsoft more than four years ago continues to be exploited in many attacks where malicious actors attempt to deliver malware using specially crafted documents.

An analysis of malicious documents created with a Microsoft Office exploit generator has allowed researchers to find connections between several malware families known to be used by different threat groups supposedly located in China.

Unit 42 recently identified a variant of MNKit-weaponized documents being used to deliver LURK0 Gh0st, NetTraveler, and Saker payloads. The documents were delivered to targets involved with universities, NGOs, and political/human rights groups concerning Islam and South Asia. Reuse of this MNKit variant, sender email addresses, email subject lines, attachment filenames, command and control domains,

An advanced persistent threat (APT) group believed to be based in Pakistan has been observed targeting government and military personnel in India using spear phishing emails and watering hole attacks.

Malicious actors have abused PowerShell and Google Docs to deliver a Trojan known as Laziok, FireEye reported on Thursday.

Experts analyzed a dozen attacks that leveraged on malicious RTF documents created using the same Four Element Sword builder. Security experts at Arbor Networks’ Security Engineering and Response Team (ASERT) have spotted a tool used in advanced persistent threat (APT) attacks against organizations in East Asia. The researchers have analyzed a dozen attacks that leveraged on malicious Rich […]

Researchers at Arbor Networks’ Security Engineering and Response Team (ASERT) have identified what they believe to be a tool used in advanced persistent threat (APT) attacks aimed at various entities in East Asia.

Be the first to receive the latest news, cyber threat intelligence and research from Unit 42. Subscribe Now. Unit 42 is currently researching an attack campaign that targets government and military personnel of India. This attack appears to overlap with the Operation Transparent Tribe and Operation C-Major campaigns that targeted Indian embassies in Saudi Arabia

Unit 42 has collected multiple spear phishing emails, weaponized document files, and payloads that targeted various offices of the Mongolian government during the time period of August 2015 and February 2016. The phishing emails and document files leveraged a variety of geopolitically sensitive subject matters as attractive lures, such as events in Beijing, the Dalai

ProofPoint uncovered a new cyber espionage campaign dubbed Operation Transparent Tribe targeting Indian diplomatic and military entities. A new cyber espionage campaign dubbed Operation Transparent Tribe is targeting diplomats and military personnel in India. The researchers at Proofpoint who have uncovered the hacking campaign confirmed that threat actors used a number of hacking techniques to hit the […]

Executive Summary Over the past seven months, Unit 42 has been investigating a series of attacks we attribute to a group we have code named “Scarlet Mimic.” The attacks began over four years ago and their targeting pattern suggests that this adversary’s primary mission is to gather information about minority rights activists. We do not

Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China. A spear-phishing email was sent to a diplomat of the Embassy of Uzbekistan who is likely based in Beijing, China. In this report, we’ll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan.

The holiday season is a time for friends and family, as well as for heightened levels of consumer shopping. It’s also a time of year when threat actors get especially opportunistic, and the 2015 holiday season was no different. Let’s take a closer look at recent holiday season-themed attacks. Happy Festivus! Unit 42 examined the

Security researchers from ESET uncovered the Roaming Tiger hacking campaign, bad actors in the wild are targeting Russian organizations. Roaming Tiger is the name of a cyber espionage campaign targeting high profile organizations in Russia and former Soviet Union countries, including Belarus, Kazakhstan, Kyrgyzstan, Tajikistan, Ukraine, and Uzbekistan. The Roaming Tiger campaign was discovered by experts at […]

A threat group known for targeting Russian organizations has recently started using a new tool in its cyber espionage operations, Palo Alto Networks reported on Tuesday.

In late 2014, ESET presented an attack campaign that had been observed over a period of time targeting Russia and other Russian speaking nations, dubbed “Roaming Tiger”. The attack was found to heavily rely on RTF exploits and at the time, thought to make use of the PlugX malware family. ESET did not attribute the

Security experts at FireEye have uncovered an ongoing phishing campaign leveraging Dropbox account linked to “admin@338” as Command and Control platform. Experts at FireEye have discovered an ongoing phishing campaign using a Dropbox account linked to “admin@338” as the delivery platform. The account ” admin@338 ” was also used in the past to deliver malware, but […]

According to a new report the popular Naikon APT group is actually backed by China’s PLA Unit 78020, a firm traced it through online activity. Ge Xing, also known as “GreenSky27,” is the name of an alleged member of the People’s Liberation Army unit 78020, a group of Chinese state-sponsored hackers. The man was identified […]

On May 6 and May 11, 2015, Unit 42 observed two targeted attacks, the first against the U.S. government and the second on a European media company. Threat actors delivered the same document via spear-phishing emails to both organizations. The actors weaponized the delivery document to install a variant of the ‘9002’ Trojan called ‘3102’

Researchers at Palo Alto Networks have identified a cyber-espionage operation targeting government and military organizations in Southeast Asia.

On May 12, 2015, Unit 42 observed an apparent watering hole attack, also known as a strategic website compromise (SWC), involving the President of Myanmar's website. Visiting the main page hosted at "www.president-office.gov[.]mm" triggered the malicious content, as the threat actors injected an inline frame (IFRAME) into a JavaScript file used by Drupal for the

In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks. This specific downloader, Cmstar, is associated with the Lurid downloader also known as ‘Enfal’. Cmstar was named for the log message ‘CM**’ used by the downloader. Unit 42 is aware of

A three-year-old cyber operation is using a mix of social engineering, Microsoft Windows vulnerabilities and basic stenography to target government, military and industry officials in Taiwan and the Philippines, according to Trend Micro.

Cybercriminals are increasingly copying cyberespionage groups in using targeted attacks against their victims instead of large-scale, indiscriminate infection campaigns. This change in tactics has been observed among those who launch attacks, as well as those who create and sell attack tools on the underground market. A recent example of such behavior was seen in a […]

Summary While threat actors using the PlugX Trojan typically leverage legitimate executables to load their malicious DLLs through a technique called DLL side-loading, Unit 42 has observed a new executable in use for this purpose. Threat actors are now using this previously unseen executable, created by Samsung, to load variants of the PlugX Trojan. Using

Researchers at Proofpoint recently discovered a Phishing campaign that originated form select job postings on CareerBuilder. Taking advantage of the notification system the job portal uses, the attacker uploaded malicious attachments instead of résumés, which in turn forced CareerBuilder to act as a delivery vehicle for Phishing emails. The scam is both simple and complex. […]

As user habits evolve, so do the tactics of attackers . It should come as little surprise then that as enterprises upgraded to newer versions of Windows in 2014, the amount of 64-bit Windows malware being used in attack campaigns increased as well.

ESET has discovered a new hacking campaign dubbed Operation Buhtrap based on a family of spyware targeting vulnerabilities within the Russian Windows System. Late in 2014 analysts at ESET uncovered CVE-2012-0158, a buffer overflow vulnerability in the ListView / TreeView ActiveX controls in the MSCOMCTL.OCX library. This particular malicious code can be activated by a […]

Symantec has discovered a cyber espionage campaign targeting energy companies around the world by infecting them with a new malware dubbed Laziok trojan. Security experts at Symantec have uncovered a new cyber espionage campaign that targeted the energy industry. The threat actors behind the campaign used uses a custom-developed malware dubbed Laziok trojan to exfiltrate sensitive data from […]

Researchers at Symantec have observed a sophisticated, multi-stage attack campaign focused on energy companies in the Middle East.

An email spam campaign targeting companies in the petroleum, gas and helium industries has been spotted by Symantec researchers. Most of them are in the so-called Middle East (UAE, Saudi Arabia, Qatar, Kuwait and Oman), but UK, US, African, Asian, and Latin American companies have also been targeted. “The initial infection vector involves the use of spam emails coming from the moneytrans[.]eu domain, which acts as an open relay Simple Mail Transfer Protocol (SMTP) server. … More →

The minds behind PlugX have added a new twist to the malware to make it stealthier.

Researchers at Symantec have identified a group of attackers targeting Russian-speaking individuals since at least January 2012.

Nearly two years after the Red October cyber espionage operation was exposed, researchers have spotted a new advanced persistent threat (APT) campaign that appears to represent the return of the Red October group.

Kaspersky Lab suspects that the bad actor who is managing a new campaign dubbed CloudAtlas is the same that run the Operation Red October two years ago. Red October is the name of a cyber espionage campaign discovered by security experts at Kaspersky Lab in late 2012 and disclosed in January 2013. The threat actors behind the […]

APT actors trying to use the G20 2014 summit as a lure to compromise Tibetan nongovernmental organizations (NGOs) with Gh0st RAT. Security experts at ESET uncovered a new series of cyber attacks that targeted Tibetan nongovernmental organizations (NGOs) concurrently with the G20 2014 summit in Brisbane, Australia. The experts discovered that APTs behind the attacks used a strain of the Gh0st RAT characterized […]

The notorious remote access Trojan (RAT) known as PlugX (Korplug) has been used by a threat group to target users in Afghanistan, Russia, Tajikistan, Kazakhstan and Kyrgyzstan. PlugX has been observed in numerous targeted attacks since 2012, particularly in campaigns launched by Chinese advanced persistent threat (APT) actors.

Sometimes “Patch Tuesday” comes and goes with little excitement or fanfare; yesterday was not one of those days. In just one day, Oracle released patches for 154 new vulnerabilities, Adobe issued updates for Flash and ColdFusion, and Microsoft released 24 patches of their own. On top of the sheer volume of patches, we learned that

It was 2010 when the Stuxnet malware first appeared in the public consciousness. Though the years have passed however, there is no shortage of machines still vulnerable to attacks on one of the vulnerabilities the malware exploited as it trotted across the globe.

Researchers at FireEye have analyzed the operations of the advanced persistent threat (APT) group dubbed “Pitty Tiger,” and determined that it might have been active since as far back as 2008.

Zero-day vulnerabilities garner well-deserved attention, but often it is older vulnerabilities that are at the center of targeted attacks.

Security experts at McAfee Labs have discovered a new cyber espionage based on the malware digitally signed with stolel certificates. A recent research of McAfee Labs has identified a series of spear phishing attacks against non governmental entities and activists, the offensives which interested mainly organizations in China were conducted using malicious code signed with stolen digital […]

NBC News seems to think that “regular” users visiting the Sochi Winter Olympics go out of their way to ignore software updates, disregard security patches, and actively engage in unsafe online behavior. Some users may be slower to patch, or to allow software to update, but they would first have had to actively choose different […]

A malware campaign targeting online banking customers in Eastern Europe uses a mix of the old and the new as it swipes data from unsuspecting victims.

An Advanced Persistent Threat (APT) called NetTraveler has been spotted making mischief again, but it appears to have learned a few new tricks since it was last spotted in June. The malware is now attacking a known Java vulnerability, CVE-2013-2465, and added water holing to its propagation strategy, according to new research from Kaspersky Lab. […]

Experts at Kaspersky firm provided evidences that the hackers behind cyber espionage campaign NetTraveler are still active and improved their attack methods. Last June Kaspersky firm uncovered a new global cyber espionage campaign dubbed NetTraveler. Kaspersky’s team discovered that NetTraveler targeted over 350 high profile victims from 40 countries. The name of the operation derives from […]

Researchers at Kaspersky Lab revealed that they have discovered a new attack vector for NetTraveler – an attack campaign that has infected hundreds of victims across more than 40 countries.

Recently, I posted a blog about analyzing PDF files. In that post, we covered some basics of the PDF format and…

Trend Micro uncovered targeted attack against European and Asian government agencies to steal login credentials from IE and Microsoft Outlook products. A new targeted attack has been uncovered by Trend Micro security experts, the hackers hit European government agencies trying to steal login credentials from Internet Explorer (IE) and Microsoft Outlook. The attackers trying to […]

Trend Micro says it detected a targeted attack that sent malware-laden emails to representatives of 16 European countries and some Asian governments. The bogus emails purported to come from China’s defense ministry and contained a malicious attachment that exploited a now-patched vulnerability in Microsoft Office versions 2003 to 2010, wrote Jonathan Leopando, a technical communications specialist […]

Security researchers from Trend Micro have shared details on an attack targeting personnel at government agencies in Europe and Asia, the latest of many attacks that have exploited CVE-2012-0158, a vulnerability in Microsoft Office.

Researchers at Symantec spotted a Java remote access tool being used as part of a campaign targeting government agencies by sending phishing emails with malicious attachments. The phishing emails are using recent news coverage about the NSA PRISM surveillance program as a lure. So far, the majority of the targets are located in the United States.

Researchers at FireEye have spotted a malware campaign using Google Docs to redirect victims and evade callback detection mechanisms. Connecting the malicious server via Google Docs, offers the malicious communication the protection provided by the legitimate SSL offered by Google, explained FireEye researcher Chong Rong Hwa.

RARSTONE is the name of the RAT (REMOTE ACCESS TOOL) used in a cyber espionage campaign dubbed “Naikon” uncovered by security experts at TrendMicro. Security experts at TrendMicro revealed to have detected the RARSTONE RAT studying targeted attacks across Asia (e.g. India, Malaysia, Singapore, and Vietnam) conducted against various companies belonging to different sectors such […]

Trend Micro researchers have found evidence of the Rarstone remote access tool (RAT) in targeted attacks against various organizations in the telecommunications and energy industries in Asia.

A spate of attacks targeting users in Vietnam and India are infecting users with a backdoor designed to steal massive amounts of information. According to researchers with Rapid7, the targeted attacks are using a malicious Microsoft Word document that exploits vulnerabilities in Microsoft Office to compromise computers with malware known as KeyBoy.

Users from Vietnam, India, China, Taiwan and possibly other countries, were targeted as part of an attack campaign that uses Microsoft Word documents rigged with exploits in order to install a backdoor program that allows attackers to steal information, according to researchers from security firm Rapid7. The targeted attacks used specifically crafted Word documents as […]

Kaspersky Lab experts published a new research report about NetTraveler, which is a family of malicious programs used by APT actors to successfully compromise more than 350 high-profile victims in 40 countries. The NetTraveler group has infected victims across multiple establishments in both the public and private sector including government institutions, embassies, the oil and gas industry, research centers, military contractors and activists. According to Kaspersky Lab’s report, this threat actor has been active since … More →

NetTraveler cyber espionage campaign, revealed by Kaspersky’s team, targeted over 350 high profile victims from 40 countries. NetTraveler, this is the name of a new global cyber espionage campaign revealed by researchers at Kaspersky, the team of experts discovered an espionage activity against over 350 high profile victims from 40 countries. The name of the operation derives […]

A cyber-espionage campaign discovered by Kaspersky Lab has hit more than 350 businesses and government agencies throughout the world. According to Kaspersky Lab, the main tool used in the attacks is known as ‘NetTraveler,’ named after an internal string present in early versions of the malware. The group behind the attack is believed to have been active as early as 2004 – though the highest volume of activity occurred during the past three years.

An ongoing cyberespionage campaign compromised over 350 high-profile victims from more than 40 countries over the past eight years, including political activists, research centers, governmental institutions, embassies, military contractors and private companies from various industries. Researchers from antivirus vendor Kaspersky Lab named the campaign NetTraveler, after a string found in the main data stealing malware […]

Ninety-one percent of targeted attacks start with spear- phishing email, according to a newly released research by Trend Micro. Spear-phishing emails contain a malicious attachment exploiting a Microsoft Office vulnerability (CVE-2012-0158). These emails are part of the operations of an emerging and active targeted threat called Safe campaign, the operations of which are documented in […]

A recent intrusion on the computer network of Norwegian telecommunications company Telenor was the result of a large cyberespionage operation of Indian origin that for the past few years has targeted business, government and political organizations from different countries, according to researchers from security firm Norman Shark. Researchers from Norman analyzed the malware samples used […]

Researchers at Trend Micro shined a light on a cyber-espionage campaign that infected nearly 12,000 unique IP addresses spread across more than 100 countries.

Trend Micro researchers have discovered a new, massive cyber espionage campaign that has been hitting as many as 71 victims each day, including government ministries, technology companies, academic research institutions, nongovernmental organizations and media outlets. Dubbed “Safe,” the campaign has first been spotted in October 2012 and has so far resulted in nearly 12,000 unique IP addresses spread over more than 100 countries to be connected to two sets of command-and-control (C&C) infrastructures, but the … More →

ESET has uncovered and analyzed a targeted campaign that tries to steal sensitive information from different organizations, particularly in Pakistan (with limited spread around the world). During the course of ESET investigations several leads were discovered that indicate the threat has its origin in India and has been going on for at least two years. This targeted attack used a code signing certificate issued to a seemingly legitimate company to sign malicious binaries and improve … More →

Researchers at ESET have discovered a targeted cyber espionage campaign in Pakistan, which is attempting to compromise sensitive information from various organizations. While limited, traces of the same attack have also been discovered in other parts of the globe.

The recently discovered cyber espionage campaign “Red October” has shocked world wide security community, the principal questions raised are: Who is behind the attacks? How is possible that for so long time the campaign went undetected? Which is the role of AV company in these operations? To try to understand who is behind the attacks […]

On Monday, Kaspersky Lab uncovered details of a complex cyber espionage campaign dubbed ‘Operation Red October’ that has been targeting specific groups throughout the world for over five years.

Last October Kaspersky Lab’s Global Research & Analysis Team started a new investigation after several attacks hit computer networks of various international diplomatic service agencies. The attacks appeared very suspect, a new large scale cyber-espionage operation has been discovered, the operation is dubbed «Red October», a name inspired by famous novel «The Hunt For The Red […]

Cyber security researchers have turned up evidence of a sophisticated cyber-espionage campaign that has been targeting political and business groups throughout the world for more than five years.

Most Popular Exploit Documents Used in April 2012 Trend Micro researchers recently offered a peek into just how prevalent the use of certain document types is among attackers.

Booby-trapped RTF documents are one of the most common types of malicious Microsoft Office files that are used to infect computers with advanced persistent threats (APTs), according to security researchers from Trend Micro. “Taking data from exploit documents gathered last April, we can see that the most exploited MS Office software is MS Word,” said […]

Here’s an overview of some of last week’s most interesting news, podcasts and articles: Smart meters vulnerable to false data injection False data injection attacks exploit the configuration of power grids by introducing arbitrary errors into state variables while bypassing existing techniques for bad measurement detection. Poor internal security processes spell disaster Poor internal security management processes present more risk than malicious threats. More than 50 percent of an AlgoSec survey respondents incurred a system … More →

With the April Patch Tuesday, Microsoft has issued six bulletins – four critical, two important – and has delivered patches for 11 vulnerabilities. One particular bulletin (MS12-027) stands out and patching the vulnerability (CVE-2012-0158) documented in it should be considered a priority, as Microsoft shared that it is currently being exploited in the wild. The flaw is in Windows Common Controls ActiveX control and consequently affects a great many Microsoft products such as Office 2003 … More →

Microsoft released its April 2012 Security Bulletin a few minutes ago. As expected, this is a six-bulletin package addressing a total of 11 vulnerabilities. Per usual, I’m sharing the early analysis that’s been dropped into my inbox… Symantec: “The WinVerifyTrust Signature Validation Vulnerability is interesting because it lets attackers modify signed Portable Executable files undetected,” […]

Microsoft today delivered six security updates to patch 11 vulnerabilities in Windows, Internet Explorer (IE), Office and several other products, including one bug that attackers are already exploiting. The company also issued the first patch for Windows 8 Consumer Preview, the beta-like build Microsoft released at the end of February. But it was MS12-027 that […]

This month Microsoft issued six bulletins, four critical, two important, addressing 11 distinct vulnerabilities. Organizations should focus most of their attention on MS12-027. What makes this bulletin stand out is that Microsoft is aware of attacks in the wild against it and that it affects an unsually wide-range of Microsoft products, including Office 2003 through 2010 on Windows, SQL Server 2000 through 2008 R2, BizTalk Server 2002, Commerce Server 2002 through 2009 R2, Visual FoxPro … More →