Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering

Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering,

The Russian-speaking threat actor behind a backdoor known as Tomiris is primarily focused on gathering intelligence in Central Asia, fresh findings from Kaspersky reveal.
« Tomiris’s endgame consistently appears to be the regular theft of internal documents, » security researchers Pierre Delcher and Ivan Kwiatkowski said in an analysis published today. « The threat actor targets government and

,

The Russian-speaking threat actor behind a backdoor known as Tomiris is primarily focused on gathering intelligence in Central Asia, fresh findings from Kaspersky reveal.
« Tomiris’s endgame consistently appears to be the regular theft of internal documents, » security researchers Pierre Delcher and Ivan Kwiatkowski said in an analysis published today. « The threat actor targets government and

, ,
https://thehackernews.com/2023/04/russian-hackers-tomiris-targeting.html

Ransomware Hackers Using AuKill Tool to Disable EDR Software Using BYOVD Attack

Ransomware Hackers Using AuKill Tool to Disable EDR Software Using BYOVD Attack,

Threat actors are employing a previously undocumented « defense evasion tool » dubbed AuKill that’s designed to disable endpoint detection and response (EDR) software by means of a Bring Your Own Vulnerable Driver (BYOVD) attack.
« The AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying

,

Threat actors are employing a previously undocumented « defense evasion tool » dubbed AuKill that’s designed to disable endpoint detection and response (EDR) software by means of a Bring Your Own Vulnerable Driver (BYOVD) attack.
« The AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying

, ,
https://thehackernews.com/2023/04/ransomware-hackers-using-aukill-tool-to.html

Study: 84% of Companies Use Breached SaaS Applications – Here’s How to Fix it for Free!

Study: 84% of Companies Use Breached SaaS Applications – Here’s How to Fix it for Free!

,

A recent review by Wing Security, a SaaS security company that analyzed the data of over 500 companies, revealed some worrisome information. According to this review, 84% of the companies had employees using an average of 3.5 SaaS applications that were breached in the previous 3 months. While this is concerning, it isn’t much of a surprise. The exponential growth in SaaS usage has security and

,

A recent review by Wing Security, a SaaS security company that analyzed the data of over 500 companies, revealed some worrisome information. According to this review, 84% of the companies had employees using an average of 3.5 SaaS applications that were breached in the previous 3 months. While this is concerning, it isn’t much of a surprise. The exponential growth in SaaS usage has security and

, ,
https://thehackernews.com/2023/04/study-84-of-companies-use-breached-saas.html

Hackers Exploit Outdated WordPress Plugin to Backdoor Thousands of WordPress Sites

Hackers Exploit Outdated WordPress Plugin to Backdoor Thousands of WordPress Sites,

Threat actors have been observed leveraging a legitimate but outdated WordPress plugin to surreptitiously backdoor websites as part of an ongoing campaign, Sucuri revealed in a report published last week.
The plugin in question is Eval PHP, released by a developer named flashpixx. It allows users to insert PHP code pages and posts of WordPress sites that’s then executed every time the posts are

,

Threat actors have been observed leveraging a legitimate but outdated WordPress plugin to surreptitiously backdoor websites as part of an ongoing campaign, Sucuri revealed in a report published last week.
The plugin in question is Eval PHP, released by a developer named flashpixx. It allows users to insert PHP code pages and posts of WordPress sites that’s then executed every time the posts are

, ,
https://thehackernews.com/2023/04/hackers-exploit-outdated-wordpress.html

Explosion des ransomwares : les attaques se multiplient en 2023

Explosion des ransomwares : les attaques se multiplient en 2023,

ransomware

Une vague de ransomwares submerge les entreprises. Au premier trimestre 2023, les logiciels malveillants ont extorqué de l’argent à plus de 800 sociétés. Ce sont les virus disponibles par abonnement qui sont pointés du doigt.

,

ransomware

Une vague de ransomwares submerge les entreprises. Au premier trimestre 2023, les logiciels malveillants ont extorqué de l’argent à plus de 800 sociétés. Ce sont les virus disponibles par abonnement qui sont pointés du doigt.

, ,
https://www.01net.com/actualites/explosion-ransomwares-attaques-multiplient-2023.html

New All-in-One « EvilExtractor » Stealer for Windows Systems Surfaces on the Dark Web

New All-in-One « EvilExtractor » Stealer for Windows Systems Surfaces on the Dark Web

,

A new « all-in-one » stealer malware named EvilExtractor (also spelled Evil Extractor) is being marketed for sale for other threat actors to steal data and files from Windows systems.
« It includes several modules that all work via an FTP service, » Fortinet FortiGuard Labs researcher Cara Lin said. « It also contains environment checking and Anti-VM functions. Its primary purpose seems to be to

,

A new « all-in-one » stealer malware named EvilExtractor (also spelled Evil Extractor) is being marketed for sale for other threat actors to steal data and files from Windows systems.
« It includes several modules that all work via an FTP service, » Fortinet FortiGuard Labs researcher Cara Lin said. « It also contains environment checking and Anti-VM functions. Its primary purpose seems to be to

, ,
https://thehackernews.com/2023/04/new-all-in-one-evilextractor-stealer.html

Russian Hackers Suspected in Ongoing Exploitation of Unpatched PaperCut Servers

Russian Hackers Suspected in Ongoing Exploitation of Unpatched PaperCut Servers,

Print management software provider PaperCut said that it has « evidence to suggest that unpatched servers are being exploited in the wild, » citing two vulnerability reports from cybersecurity company Trend Micro.
« PaperCut has conducted analysis on all customer reports, and the earliest signature of suspicious activity on a customer server potentially linked to this vulnerability is 14th April 01

,

Print management software provider PaperCut said that it has « evidence to suggest that unpatched servers are being exploited in the wild, » citing two vulnerability reports from cybersecurity company Trend Micro.
« PaperCut has conducted analysis on all customer reports, and the earliest signature of suspicious activity on a customer server potentially linked to this vulnerability is 14th April 01

, ,
https://thehackernews.com/2023/04/russian-hackers-suspected-in-ongoing.html

Lazarus X_TRADER Hack Impacts Critical Infrastructure Beyond 3CX Breach

Lazarus X_TRADER Hack Impacts Critical Infrastructure Beyond 3CX Breach,

Lazarus, the prolific North Korean hacking group behind the cascading supply chain attack targeting 3CX, also breached two critical infrastructure organizations in the power and energy sector and two other businesses involved in financial trading using the trojanized X_TRADER application.
The new findings, which come courtesy of Symantec’s Threat Hunter Team, confirm earlier suspicions that the

,

Lazarus, the prolific North Korean hacking group behind the cascading supply chain attack targeting 3CX, also breached two critical infrastructure organizations in the power and energy sector and two other businesses involved in financial trading using the trojanized X_TRADER application.
The new findings, which come courtesy of Symantec’s Threat Hunter Team, confirm earlier suspicions that the

, ,
https://thehackernews.com/2023/04/lazarus-xtrader-hack-impacts-critical.html

CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug

CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The three vulnerabilities are as follows –

CVE-2023-28432 (CVSS score – 7.5) – MinIO Information Disclosure Vulnerability 
CVE-2023-27350 (CVSS score – 9.8) – PaperCut MF/NG Improper Access Control

,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The three vulnerabilities are as follows –

CVE-2023-28432 (CVSS score – 7.5) – MinIO Information Disclosure Vulnerability 
CVE-2023-27350 (CVSS score – 9.8) – PaperCut MF/NG Improper Access Control

, ,
https://thehackernews.com/2023/04/cisa-adds-3-actively-exploited-flaws-to.html

Kubernetes RBAC Exploited in Large-Scale Campaign for Cryptocurrency Mining

Kubernetes RBAC Exploited in Large-Scale Campaign for Cryptocurrency Mining,

A large-scale attack campaign discovered in the wild has been exploiting Kubernetes (K8s) Role-Based Access Control (RBAC) to create backdoors and run cryptocurrency miners.
« The attackers also deployed DaemonSets to take over and hijack resources of the K8s clusters they attack, » cloud security firm Aqua said in a report shared with The Hacker News. The Israeli company, which dubbed the attack 

,

A large-scale attack campaign discovered in the wild has been exploiting Kubernetes (K8s) Role-Based Access Control (RBAC) to create backdoors and run cryptocurrency miners.
« The attackers also deployed DaemonSets to take over and hijack resources of the K8s clusters they attack, » cloud security firm Aqua said in a report shared with The Hacker News. The Israeli company, which dubbed the attack 

, ,
https://thehackernews.com/2023/04/kubernetes-rbac-exploited-in-large.html