Browsing tag
Cybersecurity researchers have discovered a new Raspberry Robin campaign wave that propagates the malware through malicious Windows Script Files (WSFs) since March 2024. “Historically, Raspberry Robin was known to spread through removable media like USB drives, but over time its distributors have experimented with other initial infection vectors,” HP Wolf Security researcher Patrick Schläpfer said […]
Multiple threat actors, including LockBit ransomware affiliates, are actively exploiting a recently disclosed critical security flaw in Citrix NetScaler application delivery control (ADC) and Gateway appliances to obtain initial access to target environments. The joint advisory comes from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Multi-State Information Sharing and […]
Russian cyber espionage actors affiliated with the Federal Security Service (FSB) have been observed using a USB propagating worm called LitterDrifter in attacks targeting Ukrainian entities. Check Point, which detailed Gamaredon’s (aka Aqua Blizzard, Iron Tilden, Primitive Bear, Shuckworm, and Winterflounder) latest tactics, branded the group as engaging in large-scale campaigns that are followed by […]
High-profile government and telecom entities in Asia have been targeted as part of an ongoing campaign since 2021 that’s designed to deploy basic backdoors and loaders for delivering next-stage malware. Cybersecurity company Check Point is tracking the activity under the name Stayin’ Alive. Targets include organizations located in Vietnam, Uzbekistan, Pakistan, and Kazakhstan. “The simplistic […]
An active malware campaign targeting Latin America is dispensing a new variant of a banking trojan called BBTok, particularly users in Brazil and Mexico. “The BBTok banker has a dedicated functionality that replicates the interfaces of more than 40 Mexican and Brazilian banks, and tricks the victims into entering its 2FA code to their bank […]
Tactical similarities have been unearthed between the double extortion ransomware group known as Rhysida and Vice Society, including in their targeting of education and healthcare sectors. “As Vice Society was observed deploying a variety of commodity ransomware payloads, this link does not suggest that Rhysida is exclusively used by Vice Society, but shows with at […]
A new malware strain known as BundleBot has been stealthily operating under the radar by taking advantage of .NET single-file deployment techniques, enabling threat actors to capture sensitive information from compromised hosts. “BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all,” Check Point said […]
The Chinese nation-state actor known as Mustang Panda has been linked to a new set of sophisticated and targeted attacks aimed at European foreign affairs entities since January 2023. An analysis of these intrusions, per Check Point researchers Itay Cohen and Radoslaw Madej, has revealed a custom firmware implant designed explicitly for TP-Link routers. “The […]
Various sectors in East Asian markets have been subjected to a new email phishing campaign that distributes a previously undocumented strain of Android malware called FluHorse that abuses the Flutter software development framework. “The malware features several malicious Android applications that mimic legitimate applications, most of which have more than 1,000,000 installs,” Check Point said […]
An Iranian nation-state threat actor has been linked to a new wave of phishing attacks targeting Israel that’s designed to deploy an updated version of a Windows backdoor called PowerLess. Cybersecurity firm Check Point is tracking the activity cluster under its mythical creature handle Educated Manticore, which exhibits “strong overlaps” with a hacking crew known […]
A financially motivated threat actor tracked as Blind Eagle has resurfaced with a refined toolset and an elaborate infection chain as part of its attacks targeting organizations in Colombia and Ecuador. Check Point’s latest research offers new insights into the Spanish-speaking group’s tactics and techniques, including the use of sophisticated tools and government-themed lures to […]
An enhanced version of the XLoader malware has been spotted adopting a probability-based approach to camouflage its command-and-control (C&C) infrastructure, according to the latest research. “Now it is significantly harder to separate the wheat from the chaff and discover the real C&C servers among thousands of legitimate domains used by Xloader as a smokescreen,” Israeli […]
The notorious TrickBot malware is targeting customers of 60 financial and technology companies, including cryptocurrency firms, primarily located in the U.S., even as its operators have updated the botnet with new anti-analysis features. “TrickBot is a sophisticated and versatile malware with more than 20 modules that can be downloaded and executed on demand,” Check Point […]
A popular malware known for stealing sensitive information from Windows machines has evolved into a new strain capable of also targeting Apple’s macOS operating system. The upgraded malware, dubbed “XLoader,” is a successor to another well-known Windows-based info stealer called Formbook that’s known to vacuum credentials from various web browsers, capture screenshots, record keystrokes, and […]
According to information security specialists, ZoneAlarm, the firewall software produced by security firm Check Point, was the victim of a data breach that compromised the information stored in one of the company’s online forums. After infiltrating the ZoneAlarm forum, threat actors gained illegitimate access to the full names, dates of birth, email addresses and passwords […]
ZoneAlarm, an internet security software company owned by Israeli cybersecurity firm Check Point Technologies, has suffered a data breach exposing data of its discussion forum users, the company confirmed The Hacker News. With nearly 100 million downloads, ZoneAlarm offers antivirus software, firewall, and additional virus protection solutions to home PC users, small businesses, and mobile […]
Web application security specialists report the discovery of a critical vulnerability in a Check Point software solution that, if exploited, would allow a threat actor to perform a privilege escalation to execute arbitrary code with administrator privileges. The company has already been notified and is working to eliminate this security risk. The SafeBreach Labs team […]
Last year, researchers highlighted a WhatsApp vulnerability that can let an attacker alter users’ conversations. Despite disclosure, Facebook failed to fix the flaws. This year, researchers have deployed a WhatsApp Protocol Decryptor tool as well. The tool makes it much easier to exploit the flaw, as well as to decrypt the famous WhatsApp encryption. Researchers […]
Short Bytes: A new Android malware, named Gooligan, is here to compromise your Google accounts. It steals the account authorization keys and installs malicious adware on devices. With a 1 million infected devices, Gooligan continues to infect 13,000 new devices each day. Check Point has released an online tool to check if your Google account has […]
Short Bytes: Check Point has released the list of the most dangerous malware that are most prevalent in the world. This list was topped by Conficker, a worm that spreads from system to system and downloads malware. For the first time, ransomware found a place in the top 3. In the mobile arena, for the sixth consecutive month, HummingBad remained […]