Cybersec Sentinel - Cybersec Sentinel (Page 15)

Cybersec Sentinel

Cybersec Sentinel: 30+ years of IT expertise, delivering clear, actionable cyber security insights.

DeerStealer Uses Google Authenticator as a Trojan Horse

DeerStealer Uses Google Authenticator as a Trojan Horse

Overview DeerStealer is a recent and increasingly concerning information-stealing malware. It has gained notoriety for its use of deceptive distribution methods, specifically by disguising itself as legitimate applications such as Google Authenticator. The malware is typically spread through fake advertisements and malicious downloads. Once installed, DeerStealer harvests sensitive data including

Entra ID Cybersecurity Threat: UnOAuthorized Admin Privilege Escalation

Vulnerabilities

Entra ID Cybersecurity Threat: UnOAuthorized Admin Privilege Escalation

Summary A critical vulnerability known as "UnOAuthorized" has been discovered in Microsoft Entra ID (formerly Azure Active Directory). This vulnerability allows attackers with specific administrative roles, such as Application Administrator or Cloud Application Administrator, to escalate their privileges to Global Administrator. This escalation is made possible due to

SharpRhino Explained: Key Facts and How to Protect Your Data

SharpRhino Explained: Key Facts and How to Protect Your Data

Overview Quorum Cyber's Incident Response team has discovered a new malware, SharpRhino, during a recent ransomware investigation. SharpRhino, attributed to the ransomware group Hunters International, functions as both an initial infection vector and a Remote Access Trojan (RAT). This malware exemplifies the sophisticated methods ransomware groups are employing

ACR Stealer: Bypassing Defender SmartScreen and How to Mitigate

ACR Stealer: Bypassing Defender SmartScreen and How to Mitigate

Overview ACR Stealer is a sophisticated information-stealing malware actively distributed as Malware-as-a-Service (MaaS). It has evolved from its predecessor, GrMsk Stealer, and is known for its advanced obfuscation and anti-analysis techniques, making it a significant threat to user data security. Technical Details ACR Stealer targets sensitive user information by employing

Eldorado Strikes Windows and Linux

Eldorado Strikes Windows and Linux

Overview Eldorado is a new ransomware-as-a-service (RaaS) operation that has emerged targeting both Windows and Linux systems. First appearing on March 16, 2024, when an advertisement for its affiliate program was posted on the ransomware forum RAMP, Eldorado has since gained notoriety for its sophisticated capabilities and widespread impact. Technical

FakeBat's Malvertising Mayhem

FakeBat's Malvertising Mayhem

Security Advisory Report: FakeBat Malware Summary FakeBat, also known as EugenLoader or PaykLoader, has emerged as a significant threat in 2024, spreading through drive-by download attacks and malvertising campaigns. Distributed under a Loader-as-a-Service (LaaS) model by the Russian-speaking threat actor Eugenfest, FakeBat targets victims through compromised websites, fake browser updates,

Fickle Stealer Strikes Again – A Deep Dive into the Ruthless Rust-Based Malware

Fickle Stealer Strikes Again – A Deep Dive into the Ruthless Rust-Based Malware

Overview Fickle Stealer, a sophisticated piece of malware written in Rust, has been identified as a significant threat targeting Windows users. Initially observed in May 2024, this malware leverages Rust's performance and safety features, making it challenging for researchers to detect and analyze. Distributed via multiple vectors, including

WarmCookie Malware Hijacking Google Accounts

WarmCookie Malware Hijacking Google Accounts

Report Updated: October 19, 2024 Threat Group: SocGolish Threat Type: Backdoor Malware Exploited Vulnerabilities: Misleading browser update pop-ups Malware Used: WarmCookie Threat Score: 8.2/10 (High risk due to widespread phishing campaigns and advanced backdoor capabilities) Last Threat Observation: October 7, 2024 Overview WarmCookie is a Windows backdoor malware

Update for Black Basta Ransomware - Targeting Critical Infrastructure

Update for Black Basta Ransomware - Targeting Critical Infrastructure

Executive Summary: The threat posed by the Black Basta ransomware to critical infrastructure is immediate and severe, with a notable surge in aggressive activities targeting essential sectors such as healthcare and energy. Recent intelligence underscores the group's deployment of sophisticated methods, including advanced malware tools like QAKBOT, Brute

Hijack Loader Malware

Hijack Loader Malware

Overview Hijack Loader, also known as IDAT Loader, has evolved with enhanced evasion techniques aimed at increasing its stealth and persistence within infected systems. Recent variants demonstrate advanced tactics such as process hollowing and User Account Control (UAC) bypass. Technical Details The malware initiates an attack by deploying a first-stage