In the spotlight this week: A recently discovered campaign has used the legitimate storage services of BitBucket to facilitate malware distribution and increase the perceived trust between an unknown threat actor and a targeted system. These methods likely facilitate obfuscation and increase the likelihood of maintaining persistence on a target. The campaign detonated a suite of malware variants on a single host, not only to inflict maximum damage on a victim, but also to make identifying and eradicating the different malware from a system comparatively more arduous. Apart from abusing Bitbucket, the attackers went through great lengths to avoid detection, such as providing regular updates to malware and using packers to impede analysis attempts.
Most Recent Flipbooks
Weekly Intelligence Summary 25 September 2020
Ransomware attacks are increasingly targeting UK educational establishments, according to the UK’s National Cyber Security Centre (NCSC).
Weekly Intelligence Summary 18 September 2020
Three state-linked threat groups have reportedly conducted cyber attacks aimed at the US Democratic and Republican presidential campaigns.
Weekly Intelligence Summary 11 September 2020
An operations security (OpSec) failure by the threat group “FIN7” led to an unintentional exposure of their new tools, campaigns, and underground affiliations.
Weekly Intelligence Summary 04 September 2020
A wave of extortion attacks has interrupted operations in the financial services and retail sectors with threats of distributed denial of service (DDoS) if ransom is not paid.
Weekly Intelligence Summary 28 August 2020
Remote workers have been falling victim to a voice-phishing (vishing) campaign that involves phone calls and custom phishing pages intended to solicit virtual private network (VPN) credentials.
Weekly Intelligence Summary 21 August 2020
Global technology firm Intel Corporation (Intel) confirmed a data leak after 20GB of its confidential proprietary data was made available online.
Weekly Intelligence Summary 14 August 2020
Since its first appearance, WastedLocker has been a successful tool for extorting millions of dollars from companies in a series of targeted attacks.
Weekly Intelligence Summary 07 August 2020
“Lazarus Group” has reportedly used their newly identified “MATA” malware framework and newly created “VHD” ransomware to target high-profile victims.
Weekly Intelligence Summary 31 July 2020
After exposing more than 300 million user records in May 2020, the “ShinyHunters” threat group has allegedly returned with a second stage of data leaks.
Weekly Intelligence Summary 24 July 2020
On 15 July 2020 threat actors compromised 130 Twitter accounts to promote a cryptocurrency scam, which reportedly garnered at least USD 121,000.
Weekly Intelligence Summary 17 July 2020
A cybercriminal-forum user claims to have accessed and exfiltrated 15 billion records pertaining to multiple companies by compromising Data Viper, a cyber-security firm that holds breached data.
Weekly Intelligence Summary 10 July 2020
Ransomware appeared on the horizon long before 2020, but has arguably taken the cyber-threat landscape by storm over the past six months.
Weekly Intelligence Summary 03 July 2020
A two-pronged approach in a new cyber-threat campaign revealed cooperation between the “InvisiMole” threat collective and pro-Russia group “Gamaredon”
Weekly Intelligence Summary 26 June 2020
A cyber-threat campaign was discovered exploiting an Adobe Campaign redirection flaw and abusing mail servers for heavily obfuscated phishing attacks.
Weekly Intelligence Summary 19 June 2020
Two malware variants used in simultaneous cyber-threat campaigns against United States utility entities have been linked to a single threat group.
Weekly Intelligence Summary 12 June 2020
The “Maze” group recently began collaborating with other ransomware operators by hosting their victims’ leaked data on the Maze News website.
Weekly Intelligence Summary 05 June 2020
The United States National Security Agency (NSA) released a cyber security advisory about the threat group “Sandworm”, likely a unit of the Russian GRU military intelligence agency.
Weekly Intelligence Summary 29 May 2020
A new ideologically motivated threat group, “CyberWare”, has been observed using ransomware in wiper attacks against companies it believes are conducting scams.
Weekly Intelligence Summary 22 May 2020
A threat group by the name of ShinyHunters has flooded dark web marketplaces and criminal forums with leaked databases belonging to at least 18 companies.
Weekly Intelligence Summary 15 May 2020
The apparent resurgence of advanced persistent threat (APT) group “Naikon” has established that “out of sight” does not mean “inactive”; despite scant reporting on the group in recent years, Naikon ha