Cybersec Sentinel - Cybersec Sentinel (Page 11)

Cybersec Sentinel

Cybersec Sentinel: 30+ years of IT expertise, delivering clear, actionable cyber security insights.

Rising Phobos Ransomware Activity in High-Impact Sectors

Rising Phobos Ransomware Activity in High-Impact Sectors

Threat Group: Phobos Ransomware Operators Threat Type: Ransomware-as-a-Service (RaaS) Exploited Vulnerabilities: Exposed Remote Desktop Protocol (RDP) Ports, Weak Passwords, Phishing Attacks Malware Used: Phobos Ransomware Overview: Phobos ransomware remains a significant and evolving threat, particularly targeting critical sectors such as healthcare, government, and education. Since its emergence in 2019, Phobos

Cybersec Sentinel Is Back—and Better Than Ever!

Cybersec Sentinel Is Back—and Better Than Ever!

After a week of being offline, we’re thrilled to announce that Cybersec Sentinel is back, stronger, and more secure than ever before! This wasn’t just a routine update—this was a strategic overhaul to ensure that Cybersec Sentinel can continue to be your trusted source for cybersecurity advisories

APT Group Citrine Sleet Deploys FudModule Rootkit via Chrome Vulnerability

APT Group Citrine Sleet Deploys FudModule Rootkit via Chrome Vulnerability

Threat Group: Citrine Sleet (North Korea-linked APT group) Threat Type: Advanced Persistent Threat (APT) Exploited Vulnerability: Google Chrome Zero-Day (CVE-2024-7971) Malware Used: FudModule Rootkit Overview A North Korea-linked APT group, known as Citrine Sleet, has been identified exploiting a newly discovered zero-day vulnerability in Google Chrome (CVE-2024-7971). This vulnerability, a

Malware Disguised as GlobalProtect VPN

Malware Disguised as GlobalProtect VPN

Summary Cybersecurity researchers have identified a new malware campaign targeting users in the Middle East. The malware, disguised as the Palo Alto Networks GlobalProtect VPN tool, demonstrates a sophisticated infection chain and utilizes advanced Command and Control (C&C) infrastructure to evade detection. This advisory provides a detailed analysis

Qilin Ransomware Adopts Aggressive Credential Harvesting - October 2024 Update

Qilin Ransomware Adopts Aggressive Credential Harvesting - October 2024 Update

Threat Group: - Qilin (formerly known as "Agenda") Threat Type: - Ransomware-as-a-Service (RaaS) Exploited Vulnerabilities: - Zero-day vulnerabilities, VPN access without multi-factor authentication (MFA), spear-phishing, and remote monitoring tools Malware Used: - Qilin Ransomware, with variants developed in Golang and Rust Threat Score: - High (8.8/10)

KOK08 Ransomware: What to Know

KOK08 Ransomware: What to Know

Overview KOK08 ransomware, identified as a variant of the Matrix ransomware family, is involved in malicious activities including file encryption and data exfiltration. This ransomware uses sophisticated methods that are consistent with the broader trends observed in 2024, where targeted attacks on critical infrastructure and high-value targets have become more

PEAKLIGHT: What You Need to Know

PEAKLIGHT: What You Need to Know

Overview PEAKLIGHT is a sophisticated memory-only malware recently identified by cybersecurity researchers at Mandiant. This malware is particularly concerning due to its stealthy nature, residing exclusively in a computer's RAM, which allows it to evade traditional antivirus solutions that rely on disk scanning. The infection is initiated through

The Styx Stealer Threat: What You Need to Know

The Styx Stealer Threat: What You Need to Know

Overview Styx Stealer is a sophisticated information-stealing malware targeting Windows systems, with a primary focus on cryptocurrency theft and data exfiltration. It is an advanced variant of the older Phemedrone Stealer and has been actively distributed since April 2024. This malware exploits vulnerabilities in outdated Windows Defender versions, making it

Microsoft Reveals Critical IPv6 Flaw Impacting Every Windows System

Vulnerabilities

Microsoft Reveals Critical IPv6 Flaw Impacting Every Windows System

Overview A critical security vulnerability, identified as CVE-2024-38063, has been discovered in the Windows TCP/IP stack, specifically affecting systems using the IPv6 protocol. This vulnerability is classified as a Remote Code Execution (RCE) flaw, meaning that an attacker can gain control over a system without any user interaction. Given

DeerStealer Uses Google Authenticator as a Trojan Horse

DeerStealer Uses Google Authenticator as a Trojan Horse

Overview DeerStealer is a recent and increasingly concerning information-stealing malware. It has gained notoriety for its use of deceptive distribution methods, specifically by disguising itself as legitimate applications such as Google Authenticator. The malware is typically spread through fake advertisements and malicious downloads. Once installed, DeerStealer harvests sensitive data including