Two malware variants used in simultaneous cyber-threat campaigns against United States utility entities have been linked to a single threat group. New research into the “FlowCloud” and “LookBack” variants showed similarities that extend beyond targeting. Both are sophisticated remote-access trojans (RATs) that use sector-specific spearphishing emails and other overlapping tactics, techniques, and procedures (TTPs). Researchers have begun to track the operators of FlowCloud and LookBack as “TA410”, likely a capable and persistent group that poses a credible threat to utility entities; TA410’s ability to access services and processes, using LookBack and FlowCloud, would likely enable the group to control or manipulate compromised networks and halt critical functions, as well as steal sensitive business data.
Most Recent Flipbooks
Weekly Intelligence Summary 16 October 2020
Advanced persistent threat groups linked to China and Iran have conducted cyber espionage through front companies, under the guise of legitimate technology services.
Weekly Intelligence Summary 09 October 2020
The source code of several operating systems (OS) developed by Microsoft has been published online, sparking public concerns about security.
Weekly Intelligence Summary 02 October 2020
Ransomware encrypted and disabled the systems of Universal Health Services (UHS) hospitals in the US this week, in yet another example of threat actors targeting the healthcare sector.
Weekly Intelligence Summary 25 September 2020
Ransomware attacks are increasingly targeting UK educational establishments, according to the UK’s National Cyber Security Centre (NCSC).
Weekly Intelligence Summary 18 September 2020
Three state-linked threat groups have reportedly conducted cyber attacks aimed at the US Democratic and Republican presidential campaigns.
Weekly Intelligence Summary 11 September 2020
An operations security (OpSec) failure by the threat group “FIN7” led to an unintentional exposure of their new tools, campaigns, and underground affiliations.
Weekly Intelligence Summary 04 September 2020
A wave of extortion attacks has interrupted operations in the financial services and retail sectors with threats of distributed denial of service (DDoS) if ransom is not paid.
Weekly Intelligence Summary 28 August 2020
Remote workers have been falling victim to a voice-phishing (vishing) campaign that involves phone calls and custom phishing pages intended to solicit virtual private network (VPN) credentials.
Weekly Intelligence Summary 21 August 2020
Global technology firm Intel Corporation (Intel) confirmed a data leak after 20GB of its confidential proprietary data was made available online.
Weekly Intelligence Summary 14 August 2020
Since its first appearance, WastedLocker has been a successful tool for extorting millions of dollars from companies in a series of targeted attacks.
Weekly Intelligence Summary 07 August 2020
“Lazarus Group” has reportedly used their newly identified “MATA” malware framework and newly created “VHD” ransomware to target high-profile victims.
Weekly Intelligence Summary 31 July 2020
After exposing more than 300 million user records in May 2020, the “ShinyHunters” threat group has allegedly returned with a second stage of data leaks.
Weekly Intelligence Summary 24 July 2020
On 15 July 2020 threat actors compromised 130 Twitter accounts to promote a cryptocurrency scam, which reportedly garnered at least USD 121,000.
Weekly Intelligence Summary 17 July 2020
A cybercriminal-forum user claims to have accessed and exfiltrated 15 billion records pertaining to multiple companies by compromising Data Viper, a cyber-security firm that holds breached data.
Weekly Intelligence Summary 10 July 2020
Ransomware appeared on the horizon long before 2020, but has arguably taken the cyber-threat landscape by storm over the past six months.
Weekly Intelligence Summary 03 July 2020
A two-pronged approach in a new cyber-threat campaign revealed cooperation between the “InvisiMole” threat collective and pro-Russia group “Gamaredon”
Weekly Intelligence Summary 26 June 2020
A cyber-threat campaign was discovered exploiting an Adobe Campaign redirection flaw and abusing mail servers for heavily obfuscated phishing attacks.
Weekly Intelligence Summary 12 June 2020
The “Maze” group recently began collaborating with other ransomware operators by hosting their victims’ leaked data on the Maze News website.
Weekly Intelligence Summary 05 June 2020
The United States National Security Agency (NSA) released a cyber security advisory about the threat group “Sandworm”, likely a unit of the Russian GRU military intelligence agency.
Weekly Intelligence Summary 29 May 2020
A new ideologically motivated threat group, “CyberWare”, has been observed using ransomware in wiper attacks against companies it believes are conducting scams.