Breaches

Weekly Malware Roundup – September 18, 2023

greykeep · September 18, 2023 ·

GreyKeep Security Malware Roundup - September 5, 2023

This is the GreyKeep Security Malware Roundup for September 18, 2023. Here’s a summary of what’s in this week’s edition:

Targets

Amazon Web Services
(Amplify, Fargate, SageMaker)
Microsoft Windows
Apple MacOS
Facebook Messenger

Google Chrome
Adobe Acrobat
GitHub
Free Download Manager
Webdav

Organizations

MGM Resorts International
Defense
Satellite

Pharmaceutical
Asian power grid
Android banking apps

Threat Actors

Earth Lusca (China)
ALPHV
Cuba (ransomeware group)

Peach Sandstorm (Iran)
Winnti Group/Redfly (China)
Lazarus (N. Korea)

[Read more…]

Cybersecurity Daily: September 14, 2023

greykeep · September 14, 2023 ·

GreyKeep Security Cybersecurity Daily News

Your daily dose of relevant cybersecurity advisories, industry news, and product updates for September 14, 2023.

Advisories

[Read more…]

Weekly Malware Roundup – September 11, 2023

greykeep · September 11, 2023 ·

This is the GreyKeep Security Malware Roundup for September 11, 2023. Here’s a summary of what’s in this week’s edition:

Targets

Android
Windows (NTLMv2)
Windows (Advanced Installer)
Microsoft IIS
Microsoft Teams
Cisco ASA

Apple MacOS
Apple iPhone
Fortinet SSL-VPN
Zoho ManageEngine
Facebook Messenger
IRM Next Generation

Organizations

Ukraine
Cybersecurity researchers

Graphic designers
Hotels and resorts

Threat Actors

North Korea
Lazarus (N. Korea)
APT28/Fancy Bear (Russia)

APT34 (Iran)
Charming Kitten (Iran)
Hive0117

[Read more…]

Cybersecurity Daily: September 8, 2023

greykeep · September 9, 2023 ·

Your daily dose of relevant cybersecurity advisories, industry news, and product updates for September 8, 2023.

Advisories

[Read more…]

Chinese Hackers Continue Espionage Campaign Despite Barracuda Remediation

greykeep · August 31, 2023 ·

A suspected Chinese hacking group (tracked as UNC4841) continues to target compromised Barracuda appliances in government, high tech, and information technology sectors. The group originally targeted organizations worldwide by exploiting a zero-day vulnerability discovered in Barracuda Email Security Gateway (ESG). Mandiant initially detailed the 8-month-long espionage campaign in a blog post on June 15, 2023. The vulnerability, reported as CVE-2023-2868, allows for remote command execution on the target appliance while processing .tar files containing specially crafted file names.

[Read more…]