Cybersec Sentinel (Page 15)

New Vilsa Stealer Malware Infiltrates Systems and Steals Sensitive Data

New Vilsa Stealer Malware Infiltrates Systems and Steals Sensitive Data

Threat Group: - Unknown Threat Type: - Information Stealer Exploited Vulnerabilities: - Virtual Machine Detection, Browser Data Extraction, Cryptocurrency Wallets Malware Used: - Vilsa Stealer, hvnc.py Threat Score: - High (8.5/10) — Due to its advanced encryption, persistence mechanisms, and broad targeting capabilities. Last Threat Observation: - October

CVE-2024-43572 Uncovers Critical Windows Management Console Flaw

Vulnerabilities

CVE-2024-43572 Uncovers Critical Windows Management Console Flaw

Advisory ID: CVE-2024-43572 Release Date: October 2024 Severity: Critical Affected Software: Windows Management Console Description The vulnerability in the Windows Management Console (WMC) could allow an attacker to execute arbitrary code by exploiting improper input validation. Successful exploitation may enable an attacker to run commands with elevated privileges or install

Gorilla Botnet Swings into Action Wreaks Havoc Worldwide

Gorilla Botnet Swings into Action Wreaks Havoc Worldwide

Threat Group: - Gorilla Botnet Threat Type: - Botnet (DDoS Attacks) Exploited Vulnerabilities: - IoT devices, Apache Hadoop YARN RPC vulnerability Malware Used: - Modified Mirai variant Threat Score: - High (8.8/10) — due to its advanced techniques, cross-platform capabilities, and impact on critical infrastructure. Last Threat Observation: -

KLogExe and FPSpy Signal a New Wave of Espionage by Sparkling Pisces Hackers

KLogExe and FPSpy Signal a New Wave of Espionage by Sparkling Pisces Hackers

Threat Group: Sparkling Pisces (aka Kimsuky, THALLIUM) Threat Type: Keylogger & Backdoor Malware Exploited Vulnerabilities: User exploitation via spear phishing, DLL hijacking Malware Used: KLogExe (keylogger), FPSpy (backdoor) Threat Score: High (8.0/10) — Due to the combination of data exfiltration and its ability to bypass static detection Last Threat

Continuous Threat Exposure Management (CTEM): A Detailed Guide for Cybersecurity Defence

How To's Featured

Continuous Threat Exposure Management (CTEM): A Detailed Guide for Cybersecurity Defence

CTEM is a proactive cybersecurity approach that continuously monitors, assesses, and mitigates threats like ransomware and data breaches. It enhances risk prioritisation, compliance, and cost efficiency while staying updated with evolving cyber threats through advisories.

Perfctl Malware Hijacks Linux Servers for Cryptomining and Proxyjacking

Perfctl Malware Hijacks Linux Servers for Cryptomining and Proxyjacking

Threat Group: - Unknown Threat Type: - Cryptomining & Proxyjacking Malware Exploited Vulnerabilities: - Polkit (CVE-2021-4043), Apache RocketMQ (CVE-2023-33246) Malware Used: - Perfctl Threat Score: - High (8/10) Last Threat Observation: - October 3, 2024 Overview: Perfctl is a stealthy and persistent malware targeting Linux servers, leveraging misconfigurations and

ELPACO-Team Ransomware: Escalating Threat to Windows Systems

ELPACO-Team Ransomware: Escalating Threat to Windows Systems

Threat Group: ELPACO-team Threat Type: Ransomware Exploited Vulnerabilities: Outdated software and phishing emails Malware Used: ELPACO-team Ransomware Threat Score: High (8.2/10) Last Threat Observation: October 2024 Overview The ELPACO-team ransomware is a malicious strain designed to encrypt files and demand ransom payments in cryptocurrency for their release. Known

Andariel Hacking Group Targets Global Defense and Infrastructure Sectors

Andariel Hacking Group Targets Global Defense and Infrastructure Sectors

Threat Group: - Andariel (Subgroup of Lazarus Group, aka Stonefly, Silent Chollima, Onyx Sleet) Threat Type: - Advanced Persistent Threat (APT), Ransomware, Cyber Espionage Exploited Vulnerabilities: - CVE-2023-22515 (Atlassian Confluence), CVE-2023-27350 (PaperCut), CVE-2023-42793 (TeamCity), CVE-2021-44228 (Apache Log4j) Malware Used: - DTrack, Maui, Dora RAT, Nukebot, SHATTEREDGLASS, Sliver, Mimikatz Threat Score:

Storm-0501 Expands Ransomware Reach by Targeting Cloud Infrastructure

Storm-0501 Expands Ransomware Reach by Targeting Cloud Infrastructure

Threat Group: Storm-0501 Threat Type: Ransomware Exploited Vulnerabilities: Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler (CVE-2023-4966), ColdFusion (CVE-2023-29300) Malware Used: Embargo Ransomware Threat Score: High (8.5/10) — Due to significant lateral movement across hybrid cloud environments, strong persistence mechanisms, and critical data exfiltration. Last Threat Observation: September 2024 by Microsoft Threat

Staying Ahead of AI-Driven Cyber Threats with a Multi-Layered Defense Approach

Staying Ahead of AI-Driven Cyber Threats with a Multi-Layered Defense Approach

Introduction: The Rise of AI-Generated Malware As artificial intelligence (AI) continues to evolve, its applications in the field of cybersecurity have become a double-edged sword. On one side, AI enhances the capabilities of defense systems, helping organizations detect, prevent, and mitigate threats faster than ever before. On the other side,