Cybersec Sentinel - Cybersec Sentinel (Page 9)

Cybersec Sentinel

Cybersec Sentinel: 30+ years of IT expertise, delivering clear, actionable cyber security insights.

Necro Trojan Malware Resurfaces in Google Play and Modded Apps

Necro Trojan Malware Resurfaces in Google Play and Modded Apps

Threat Group: Necro Trojan Operators Threat Type: Android Trojan Downloader Exploited Vulnerabilities: Supply chain attack via SDKs in Android apps Malware Used: Necro Trojan (Trojan-Downloader.AndroidOS.Necro variants) Threat Score: High (8.2/10) — Due to large-scale infiltration and the advanced use of steganography for payload concealment. Last Threat Observation:

PondRAT Malware Targets Linux and macOS Python Developers in New Attack

PondRAT Malware Targets Linux and macOS Python Developers in New Attack

Threat Group: Gleaming Pisces (also known as Citrine Sleet, Labyrinth Chollima, Nickel Academy, and UNC4736) Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Supply chain attacks through Python Package Index (PyPI) Malware Used: PondRAT (variant of POOLRAT) Threat Score: High (8.3/10) Last Threat Observation: September 22, 2024 Overview

SambaSpy RAT Aims at Italian Targets in a Focused Phishing Attack

SambaSpy RAT Aims at Italian Targets in a Focused Phishing Attack

Threat Group: Suspected Brazilian Portuguese-speaking actors Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: None publicly listed, targets Italian users via phishing Malware Used: SambaSpy (Java-based RAT, obfuscated with Zelix KlassMaster) Threat Score: High (7.5/10) – Focused and highly targeted campaign with the potential for broader exploitation Last Threat

Mitre ATT&CK Framework Simplified: Understanding Cyber Threats

Mitre ATT&CK Framework Simplified: Understanding Cyber Threats

Contents * Introduction * The Foundations of ATT&CK * Why the ATT&CK Framework Matters * In-Depth Exploration of ATT&CK Components * The ATT&CK Matrix Explained * Applying the ATT&CK Framework * Real-World Scenarios and Case Studies * Understanding ATT&CK for Young Minds * The Future of ATT&

Raptor Train Botnet Disrupted After Targeting Global Critical Infrastructure

Raptor Train Botnet Disrupted After Targeting Global Critical Infrastructure

Threat Details and Score Threat Group: Flax Typhoon (Chinese state-sponsored) Threat Type: Botnet (IoT) Exploited Vulnerabilities: IoT device vulnerabilities, including zero-day and n-day vulnerabilities in over 20 device types Malware Used: Nosedive (a variant of Mirai) Threat Score: High (8.9/10) — Due to its scale, complexity, and targeting of

Vanilla Tempest Unleashes INC Ransomware on Hospitals

Vanilla Tempest Unleashes INC Ransomware on Hospitals

Threat Details and Score Threat Group: Vanilla Tempest (also known as Vice Society) Threat Type: Ransomware-as-a-Service (RaaS) Exploited Vulnerabilities: Initial access via Gootloader malware, Remote Desktop Protocol (RDP) abuse, and Windows Management Instrumentation (WMI) for lateral movement Malware Used: INC ransomware, Supper backdoor, AnyDesk, MEGA Threat Score: High (8.7/

UNC2970 Launches MISTPEN Against Critical Infrastructure

UNC2970 Launches MISTPEN Against Critical Infrastructure

Threat Details and Score Threat Group: UNC2970 (North Korea-linked) Threat Type: Cyber-Espionage Malware (Backdoor) Exploited Vulnerabilities: None exploited, uses modified open-source software Malware Used: MISTPEN, BURNBOOK, TEARPAGE Threat Score: High (8.3/10) Last Observation: September 18, 2024 (Mandiant) Overview: The UNC2970 threat group, associated with North Korea, has been

Kransom Ransomware Exploits DLL Side-Loading and Certificate Misuse

Kransom Ransomware Exploits DLL Side-Loading and Certificate Misuse

Threat Group: Kransom Threat Type: Ransomware Exploited Vulnerabilities: Unpatched software vulnerabilities, phishing Malware Used: Kransom Ransomware Threat Score: High (8/10) — Advanced evasion techniques and use of legitimate digital certificates make detection challenging Last Threat Observation: September 2024, verified through multiple cybersecurity sources Overview Kransom ransomware is a newly identified

Meow Ransomware Evolves into Data Extortion

Meow Ransomware Evolves into Data Extortion

Threat Details and Score Threat Group: Meow, also known as MeowCorp and MeowLeaks, a ransomware group derived from NB65 (itself based on Conti v2's leaked source code). Threat Type: Ransomware/Data Extortion. Exploited Vulnerabilities: Weak RDP configurations, phishing campaigns, compromised software (e.g., VMware and Jenkins), deceptive downloads,

Advanced Phishing Tactic Exploits Kiosk Mode to Force Credential Entry

Advanced Phishing Tactic Exploits Kiosk Mode to Force Credential Entry

Threat Group: Amadey Threat Type: Credential theft (Browser lock, Kiosk mode exploitation) Exploited Vulnerabilities: No direct system vulnerability, but uses deceptive phishing techniques to trick users into entering credentials. Malware Used: Amadey malware loader, StealC info stealer, and AutoIt Credential Flusher Threat Score: High (7.8/10) — This campaign is