Cybersec Sentinel - Cybersec Sentinel

Cybersec Sentinel

Cybersec Sentinel: 30+ years of IT expertise, delivering clear, actionable cyber security insights.

Perfctl Malware Hijacks Linux Servers for Cryptomining and Proxyjacking

Perfctl Malware Hijacks Linux Servers for Cryptomining and Proxyjacking

Threat Group: - Unknown Threat Type: - Cryptomining & Proxyjacking Malware Exploited Vulnerabilities: - Polkit (CVE-2021-4043), Apache RocketMQ (CVE-2023-33246) Malware Used: - Perfctl Threat Score: - High (8/10) Last Threat Observation: - October 3, 2024 Overview: Perfctl is a stealthy and persistent malware targeting Linux servers, leveraging misconfigurations and

ELPACO-Team Ransomware: Escalating Threat to Windows Systems

ELPACO-Team Ransomware: Escalating Threat to Windows Systems

Threat Group: ELPACO-team Threat Type: Ransomware Exploited Vulnerabilities: Outdated software and phishing emails Malware Used: ELPACO-team Ransomware Threat Score: High (8.2/10) Last Threat Observation: October 2024 Overview The ELPACO-team ransomware is a malicious strain designed to encrypt files and demand ransom payments in cryptocurrency for their release. Known

Andariel Hacking Group Targets Global Defense and Infrastructure Sectors

Andariel Hacking Group Targets Global Defense and Infrastructure Sectors

Threat Group: - Andariel (Subgroup of Lazarus Group, aka Stonefly, Silent Chollima, Onyx Sleet) Threat Type: - Advanced Persistent Threat (APT), Ransomware, Cyber Espionage Exploited Vulnerabilities: - CVE-2023-22515 (Atlassian Confluence), CVE-2023-27350 (PaperCut), CVE-2023-42793 (TeamCity), CVE-2021-44228 (Apache Log4j) Malware Used: - DTrack, Maui, Dora RAT, Nukebot, SHATTEREDGLASS, Sliver, Mimikatz Threat Score:

Storm-0501 Expands Ransomware Reach by Targeting Cloud Infrastructure

Storm-0501 Expands Ransomware Reach by Targeting Cloud Infrastructure

Threat Group: Storm-0501 Threat Type: Ransomware Exploited Vulnerabilities: Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler (CVE-2023-4966), ColdFusion (CVE-2023-29300) Malware Used: Embargo Ransomware Threat Score: High (8.5/10) — Due to significant lateral movement across hybrid cloud environments, strong persistence mechanisms, and critical data exfiltration. Last Threat Observation: September 2024 by Microsoft Threat

Staying Ahead of AI-Driven Cyber Threats with a Multi-Layered Defense Approach

Staying Ahead of AI-Driven Cyber Threats with a Multi-Layered Defense Approach

Introduction: The Rise of AI-Generated Malware As artificial intelligence (AI) continues to evolve, its applications in the field of cybersecurity have become a double-edged sword. On one side, AI enhances the capabilities of defense systems, helping organizations detect, prevent, and mitigate threats faster than ever before. On the other side,

DragonForce Ransomware Emerging Threat and Key Mitigation Strategies

DragonForce Ransomware Emerging Threat and Key Mitigation Strategies

Threat Group: DragonForce Threat Type: Ransomware (Ransomware-as-a-Service - RaaS) Exploited Vulnerabilities: Varies, but primarily through credential theft and unpatched systems Malware Used: Modified LockBit and Conti ransomware variants Threat Score: High (8.2/10) – Due to its use of sophisticated double extortion and advanced encryption techniques. Last Threat Observation: September

RomCom Malware Variant SnipBot Targets IT and Legal Sectors

RomCom Malware Variant SnipBot Targets IT and Legal Sectors

Threat Group: RomCom Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Social engineering (phishing emails) and PDF exploits Malware Used: SnipBot (RomCom 5.0 variant) Threat Score: High (8.8/10) – due to its advanced command execution capabilities, obfuscation techniques, and wide target range across industries Last Threat Observation: September

Mallox Ransomware Expands Targeting to Linux Systems

Mallox Ransomware Expands Targeting to Linux Systems

Threat Group: Mallox Threat Type: Ransomware (Linux and Windows) Exploited Vulnerabilities: Unsecured MS-SQL servers, weak SSH configurations, exposed ports Malware Used: Mallox, Kryptina (Linux variant) Threat Score: High (8.5/10) — The group has expanded operations to Linux systems and continues to evolve by targeting cloud and critical infrastructure, leveraging

Necro Trojan Malware Resurfaces in Google Play and Modded Apps

Necro Trojan Malware Resurfaces in Google Play and Modded Apps

Threat Group: Necro Trojan Operators Threat Type: Android Trojan Downloader Exploited Vulnerabilities: Supply chain attack via SDKs in Android apps Malware Used: Necro Trojan (Trojan-Downloader.AndroidOS.Necro variants) Threat Score: High (8.2/10) — Due to large-scale infiltration and the advanced use of steganography for payload concealment. Last Threat Observation:

PondRAT Malware Targets Linux and macOS Python Developers in New Attack

PondRAT Malware Targets Linux and macOS Python Developers in New Attack

Threat Group: Gleaming Pisces (also known as Citrine Sleet, Labyrinth Chollima, Nickel Academy, and UNC4736) Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Supply chain attacks through Python Package Index (PyPI) Malware Used: PondRAT (variant of POOLRAT) Threat Score: High (8.3/10) Last Threat Observation: September 22, 2024 Overview

SambaSpy RAT Aims at Italian Targets in a Focused Phishing Attack

SambaSpy RAT Aims at Italian Targets in a Focused Phishing Attack

Threat Group: Suspected Brazilian Portuguese-speaking actors Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: None publicly listed, targets Italian users via phishing Malware Used: SambaSpy (Java-based RAT, obfuscated with Zelix KlassMaster) Threat Score: High (7.5/10) – Focused and highly targeted campaign with the potential for broader exploitation Last Threat

Mitre ATT&CK Framework Simplified: Understanding Cyber Threats

Mitre ATT&CK Framework Simplified: Understanding Cyber Threats

Contents * Introduction * The Foundations of ATT&CK * Why the ATT&CK Framework Matters * In-Depth Exploration of ATT&CK Components * The ATT&CK Matrix Explained * Applying the ATT&CK Framework * Real-World Scenarios and Case Studies * Understanding ATT&CK for Young Minds * The Future of ATT&

Raptor Train Botnet Disrupted After Targeting Global Critical Infrastructure

Raptor Train Botnet Disrupted After Targeting Global Critical Infrastructure

Threat Details and Score Threat Group: Flax Typhoon (Chinese state-sponsored) Threat Type: Botnet (IoT) Exploited Vulnerabilities: IoT device vulnerabilities, including zero-day and n-day vulnerabilities in over 20 device types Malware Used: Nosedive (a variant of Mirai) Threat Score: High (8.9/10) — Due to its scale, complexity, and targeting of

Vanilla Tempest Unleashes INC Ransomware on Hospitals

Vanilla Tempest Unleashes INC Ransomware on Hospitals

Threat Details and Score Threat Group: Vanilla Tempest (also known as Vice Society) Threat Type: Ransomware-as-a-Service (RaaS) Exploited Vulnerabilities: Initial access via Gootloader malware, Remote Desktop Protocol (RDP) abuse, and Windows Management Instrumentation (WMI) for lateral movement Malware Used: INC ransomware, Supper backdoor, AnyDesk, MEGA Threat Score: High (8.7/

UNC2970 Launches MISTPEN Against Critical Infrastructure

UNC2970 Launches MISTPEN Against Critical Infrastructure

Threat Details and Score Threat Group: UNC2970 (North Korea-linked) Threat Type: Cyber-Espionage Malware (Backdoor) Exploited Vulnerabilities: None exploited, uses modified open-source software Malware Used: MISTPEN, BURNBOOK, TEARPAGE Threat Score: High (8.3/10) Last Observation: September 18, 2024 (Mandiant) Overview: The UNC2970 threat group, associated with North Korea, has been

Kransom Ransomware Exploits DLL Side-Loading and Certificate Misuse

Kransom Ransomware Exploits DLL Side-Loading and Certificate Misuse

Threat Group: Kransom Threat Type: Ransomware Exploited Vulnerabilities: Unpatched software vulnerabilities, phishing Malware Used: Kransom Ransomware Threat Score: High (8/10) — Advanced evasion techniques and use of legitimate digital certificates make detection challenging Last Threat Observation: September 2024, verified through multiple cybersecurity sources Overview Kransom ransomware is a newly identified

Meow Ransomware Evolves into Data Extortion

Meow Ransomware Evolves into Data Extortion

Threat Details and Score Threat Group: Meow, also known as MeowCorp and MeowLeaks, a ransomware group derived from NB65 (itself based on Conti v2's leaked source code). Threat Type: Ransomware/Data Extortion. Exploited Vulnerabilities: Weak RDP configurations, phishing campaigns, compromised software (e.g., VMware and Jenkins), deceptive downloads,

Advanced Phishing Tactic Exploits Kiosk Mode to Force Credential Entry

Advanced Phishing Tactic Exploits Kiosk Mode to Force Credential Entry

Threat Group: Amadey Threat Type: Credential theft (Browser lock, Kiosk mode exploitation) Exploited Vulnerabilities: No direct system vulnerability, but uses deceptive phishing techniques to trick users into entering credentials. Malware Used: Amadey malware loader, StealC info stealer, and AutoIt Credential Flusher Threat Score: High (7.8/10) — This campaign is

Hadooken Malware Becomes a Growing Threat to WebLogic Infrastructure

Hadooken Malware Becomes a Growing Threat to WebLogic Infrastructure

Threat Group: Unclear attribution, though linked to prior infrastructure used by TeamTNT and 8220 Gang. Threat Type: Cryptominer and Botnet, with potential future ransomware connections. Exploited Vulnerabilities: Weak credentials and misconfigured Oracle WebLogic servers. Malware Used: Hadooken (deploys both a cryptominer and Tsunami botnet). Threat Score: High (7.5/10)

The Scattered Spider Group Ramps Up Cloud Attacks

The Scattered Spider Group Ramps Up Cloud Attacks

Threat Group: Scattered Spider Threat Type: Cybercrime Group (Focused on Cloud Environments, Ransomware) Exploited Vulnerabilities: Azure Cross-Tenant Synchronization, Federated Identity Providers, Cloud Platforms Malware Used: AlphV ransomware Threat Score: High (8.8/10) — Due to its sophisticated exploitation of cloud-based systems, privilege escalation methods, and use of advanced tools for

RansomHub Affiliate NoName Group Launches ScRansom Attacks

RansomHub Affiliate NoName Group Launches ScRansom Attacks

Threat Group: NoName (formerly known as CosmicBeetle) Threat Type: Ransomware (Part of the Spacecolon malware family) Exploited Vulnerabilities: CVE-2017-0144 (EternalBlue), CVE-2023-27532 (Veeam Backup), CVE-2020-1472 (ZeroLogon), and others Malware Used: ScRansom, LockBit variants, RansomHub Threat Score: High (8.5/10) – Due to its focus on SMBs and evolving encryption methods Last

Mustang Panda Expands Global Espionage with FDMTP and PUBLOAD

Mustang Panda Expands Global Espionage with FDMTP and PUBLOAD

Threat Group: Mustang Panda (also known as Earth Preta, Bronze President, HoneyMyte) Threat Type: Cyber-Espionage Exploited Vulnerabilities: Phishing, DLL Side-loading, Removable Media Propagation Malware Used: PUBLOAD, FDMTP, PTSOCKET, HIUPAN Worm Threat Score: Critical (9.0/10) — Due to widespread targeting of government entities, advanced data exfiltration techniques, and consistent evolution

Configuring FIDO2 Keys for Passwordless Authentication in Entra ID

Configuring FIDO2 Keys for Passwordless Authentication in Entra ID

Complete Guide to Implementing Passwordless Authentication with FIDO2 in an Entra ID and Intune Environment for Windows 10 and 11 Devices Contents 1. Introduction 2. Prerequisites 3. Step 1: Enable FIDO2 Security Keys in Entra ID 4. Step 2: Restrict FIDO2 Key Models Based on AAGUIDs 5. Step 3: Enable

Make Cybersecurity Easier with Bulk IoC Importing into Microsoft Defender for Endpoints

Make Cybersecurity Easier with Bulk IoC Importing into Microsoft Defender for Endpoints

Step-by-Step Instructions for Importing IoCs: 1. Log in to Microsoft 365 Defender: * Go to the Microsoft 365 Defender portal at security.microsoft.com and log in with your administrator credentials. 2. Access the Indicators Section: * Navigate to Settings -> Rules -> Indicators. This section allows you to manage

Fake LinkedIn Job Offers Hide Dangerous Malware

Fake LinkedIn Job Offers Hide Dangerous Malware

Threat Type: Malware (Dropper and Payload) Exploited Vulnerabilities: macOS systems, social engineering (LinkedIn) Malware Used: COVERTCATCH Threat Score: High (8.2/10) — Targeting macOS and Web3 developers with sophisticated social engineering tactics. Last Threat Observation: September 7, 2024, reported by Vumetric, Mandiant, and other platforms. Overview: A new malware campaign,