Cybersec Sentinel - Cybersec Sentinel (Page 8)

Cybersec Sentinel

Cybersec Sentinel: 30+ years of IT expertise, delivering clear, actionable cyber security insights.

KLogExe and FPSpy Signal a New Wave of Espionage by Sparkling Pisces Hackers

KLogExe and FPSpy Signal a New Wave of Espionage by Sparkling Pisces Hackers

Threat Group: Sparkling Pisces (aka Kimsuky, THALLIUM) Threat Type: Keylogger & Backdoor Malware Exploited Vulnerabilities: User exploitation via spear phishing, DLL hijacking Malware Used: KLogExe (keylogger), FPSpy (backdoor) Threat Score: High (8.0/10) — Due to the combination of data exfiltration and its ability to bypass static detection Last Threat

Continuous Threat Exposure Management (CTEM): A Detailed Guide for Cybersecurity Defence

How To's Featured

Continuous Threat Exposure Management (CTEM): A Detailed Guide for Cybersecurity Defence

CTEM is a proactive cybersecurity approach that continuously monitors, assesses, and mitigates threats like ransomware and data breaches. It enhances risk prioritisation, compliance, and cost efficiency while staying updated with evolving cyber threats through advisories.

Perfctl Malware Hijacks Linux Servers for Cryptomining and Proxyjacking

Perfctl Malware Hijacks Linux Servers for Cryptomining and Proxyjacking

Threat Group: - Unknown Threat Type: - Cryptomining & Proxyjacking Malware Exploited Vulnerabilities: - Polkit (CVE-2021-4043), Apache RocketMQ (CVE-2023-33246) Malware Used: - Perfctl Threat Score: - High (8/10) Last Threat Observation: - October 3, 2024 Overview: Perfctl is a stealthy and persistent malware targeting Linux servers, leveraging misconfigurations and

ELPACO-Team Ransomware: Escalating Threat to Windows Systems

ELPACO-Team Ransomware: Escalating Threat to Windows Systems

Threat Group: ELPACO-team Threat Type: Ransomware Exploited Vulnerabilities: Outdated software and phishing emails Malware Used: ELPACO-team Ransomware Threat Score: High (8.2/10) Last Threat Observation: October 2024 Overview The ELPACO-team ransomware is a malicious strain designed to encrypt files and demand ransom payments in cryptocurrency for their release. Known

Andariel Hacking Group Targets Global Defense and Infrastructure Sectors

Andariel Hacking Group Targets Global Defense and Infrastructure Sectors

Threat Group: - Andariel (Subgroup of Lazarus Group, aka Stonefly, Silent Chollima, Onyx Sleet) Threat Type: - Advanced Persistent Threat (APT), Ransomware, Cyber Espionage Exploited Vulnerabilities: - CVE-2023-22515 (Atlassian Confluence), CVE-2023-27350 (PaperCut), CVE-2023-42793 (TeamCity), CVE-2021-44228 (Apache Log4j) Malware Used: - DTrack, Maui, Dora RAT, Nukebot, SHATTEREDGLASS, Sliver, Mimikatz Threat Score:

Storm-0501 Expands Ransomware Reach by Targeting Cloud Infrastructure

Storm-0501 Expands Ransomware Reach by Targeting Cloud Infrastructure

Threat Group: Storm-0501 Threat Type: Ransomware Exploited Vulnerabilities: Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler (CVE-2023-4966), ColdFusion (CVE-2023-29300) Malware Used: Embargo Ransomware Threat Score: High (8.5/10) — Due to significant lateral movement across hybrid cloud environments, strong persistence mechanisms, and critical data exfiltration. Last Threat Observation: September 2024 by Microsoft Threat

Staying Ahead of AI-Driven Cyber Threats with a Multi-Layered Defense Approach

Staying Ahead of AI-Driven Cyber Threats with a Multi-Layered Defense Approach

Introduction: The Rise of AI-Generated Malware As artificial intelligence (AI) continues to evolve, its applications in the field of cybersecurity have become a double-edged sword. On one side, AI enhances the capabilities of defense systems, helping organizations detect, prevent, and mitigate threats faster than ever before. On the other side,

DragonForce Ransomware Emerging Threat and Key Mitigation Strategies

DragonForce Ransomware Emerging Threat and Key Mitigation Strategies

Threat Group: DragonForce Threat Type: Ransomware (Ransomware-as-a-Service - RaaS) Exploited Vulnerabilities: Varies, but primarily through credential theft and unpatched systems Malware Used: Modified LockBit and Conti ransomware variants Threat Score: High (8.2/10) – Due to its use of sophisticated double extortion and advanced encryption techniques. Last Threat Observation: September

RomCom Malware Variant SnipBot Targets IT and Legal Sectors

RomCom Malware Variant SnipBot Targets IT and Legal Sectors

Threat Group: RomCom Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Social engineering (phishing emails) and PDF exploits Malware Used: SnipBot (RomCom 5.0 variant) Threat Score: High (8.8/10) – due to its advanced command execution capabilities, obfuscation techniques, and wide target range across industries Last Threat Observation: September

Mallox Ransomware Expands Targeting to Linux Systems

Mallox Ransomware Expands Targeting to Linux Systems

Threat Group: Mallox Threat Type: Ransomware (Linux and Windows) Exploited Vulnerabilities: Unsecured MS-SQL servers, weak SSH configurations, exposed ports Malware Used: Mallox, Kryptina (Linux variant) Threat Score: High (8.5/10) — The group has expanded operations to Linux systems and continues to evolve by targeting cloud and critical infrastructure, leveraging