CERT alerts

A collection of 97 posts

CERT alerts

Information about "DigitalPlagiarist" campaign (mirroring legitimate sites)

We believe the "TelePort Crew" Threat Actor is operating out of Russia or Eastern Europe with the group's major motivations appearing to be financial in nature through cybercrime and/or corporate espionage.

CERT alerts

Information about APT28 group registering plenty of domains

Our APT28 (a.k.a. Fancy Bear, Sofacy) friends in the Russian Federation have been busy once again.

CERT alerts

Information about a malware operation targeting members of the Tibetan Parliament

The Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information. They are often targeted simultaneously with other ethnic minorities and religious groups in China.

CERT alerts

Information about PowerDuke: widespread post-election spear phishing campaigns targeting Think Tanks and NGOs

In the wake of the 2016 United States Presidential Election, not even six hours after Donald Trump became the nation’s President-Elect, an advanced persistent threat (APT) group launched a series of coordinated and well-planned spear phishing campaigns.

CERT alerts

Information about BLACKGEAR espionage campaign

BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years. Multiple papers and talks have been released covering this campaign, which used the ELIRKS backdoor when it was first discovered in 2012.

CERT alerts

Infomation about Moonlight – targeted attacks in the Middle East

Vectra Threat Labs researchers have uncovered the activities of a group of individuals currently engaged in targeted attacks against entities in the Middle East. We identified over 200 samples of malware generated by the group over the last two years.

CERT alerts

Information about BITTER, a targeted attack against Pakistan

Forcepoint Security Labs™ recently encountered a strain of attacks that appear to target Pakistani nationals. We named the attack "BITTER" based on the network communication header used by the latest variant of remote access tool (RAT) used

CERT alerts

A paper about APT reports help more to attackers than defenders

With the advancement of defensive cybersecurity practices and the regular release of reports exposing toolsets used in APT attacks, advanced threat actors have had to adapt.

CERT alerts

Information about deception tactics muddying attribution in targeted attacks

This paper takes a comprehensive look at the current state of attribution in targeted attack research and at deliberate attempts by the adversary to obstruct this process.

CERT alerts

Information about StrongPity waterhole attacks targeting Italian and Belgian encryption users (WinRAR and TrueCrypt)

The StrongPity APT is a technically capable group operating under the radar for several years. The group has quietly deployed zero-day in the past, effectively spearphished targets, and maintains a modular toolset.

CERT alerts

Information about Sofacy’s ‘Komplex’ OS X Trojan

Unit 42 researchers identified a new OS X Trojan associated with the Sofacy group that we are now tracking with the ‘Komplex’ tag using the Palo Alto Networks AutoFocus threat intelligence platform.

CERT alerts

Information about Buckeye cyberespionage group, that shifts gaze from US to Hong Kong

Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Traditionally, the group attacked organizations in the US as well as other targets.

CERT alerts

Information about Oracle MICROS POS terminal breach

Credit card industry giant Visa on Friday issued a security alert warning companies using point-of-sale devices made by Oracle‘s MICROS retail unit to double-check the machines for malicious software or unusual network activity, and to change passwords on the devices.

CERT alerts

Information about Dropping Elephant – aggressive cyber-espionage in the Asian region

Dropping Elephant (also known as “Chinastrats” and “Patchwork“) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools.

CERT alerts

Information about NetTraveler APT targets Russian, and European interests

Throughout 2016, Proofpoint researchers tracked a cyber-espionage campaign targeting victims in Russia and neighboring countries. The actor utilizes spear phishing campaigns to deliver NetTraveler, also known as TravNet.

CERT alerts

Information about espionage toolkit targeting Central and Eastern Europe

Over the course of the last year, ESET has detected and analyzed several instances of malware used for targeted espionage – dubbed SBDH toolkit.

CERT alerts

Information about Asruex, a malware infecting through shortcut files

JPCERT/CC has been observing malicious shortcut files that are sent as email attachments to a limited range of organisations since around October 2015. When this shortcut file is opened, the host will be infected with malware called “Asruex”.

CERT alerts

Information about Prince of Persia malware campaign

Unit 42 published a blog at the beginning of May titled “Prince of Persia,” in which we described the discovery of a decade-long campaign using a formerly unknown malware family, Infy, that targeted government and industry interests worldwide.

CERT alerts

Infomation about Threat Group-4127 targets Google accounts

SecureWorks® Counter Threat Unit™ (CTU) researchers track the activities of Threat Group-41271 (TG-4127), which traditionally targets governments, military, international non-governmental organizations (NGOs), and most recently, Hillary Clinton’s email.

CERT alerts

Information about tracking Elirks variants in Japan

A recent, well-publicized attack on a Japanese business involved two malware families, PlugX and Elirks, that were found during the investigation.

CERT alerts

Information about DUBNIUM’s flash-targeting exploit

The DUBNIUM campaign in December involved one exploit in-the-wild that affected Adobe Flash Player. In this blog, we’re going to examine the technical details of the exploit that targeted vulnerability CVE-2015-8651. For more detailson this vulnerability, see Adobe Security Bulletin APSB16-01 .

CERT alerts

Information about NDC intrusion malware

The Security Consulting team here at Fidelis specializes in investigations of critical security incidents by advanced threat actors. Last week, after Guccifer 2.0 claimed responsibility for the intrusion into the Democratic National Committee’s (DNC) servers

CERT alerts

Information about flash zero-day exploit deployed by the ScarCruft APT group

Earlier this year, we deployed new technologies in Kaspersky Lab products to identify and block zero-day attacks. This technology already proved its effectiveness earlier this year, when it caught an Adobe Flash zero day exploit(CVE-2016-1010).

CERT alerts

Information about Threat Group-4127 targeting Hillary Clinton presidential campaign

SecureWorks® Counter Threat Unit™ (CTU) researchers track the activities of Threat Group-4127[1] (TG-4127), which targets governments, military, and international non-governmental organizations (NGOs).

CERT alerts

Information about new Sofacy attacks against US Government Agency

The Sofacy group, also known as APT28, is a well-known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted the United States government.