Events
To Cymulate

Community
Cymulate Live

Cymulate Live

Breaking industry news, cyber security resources, trends and more.

187 Topics

Recently active

Most replies Most views Newest first

idantCommunity Manager

published in Threat Feed

🚨 Wiper Malware Could be Used Against Other Targets🚨News

Avast Threat Research announced the discovery of new Golang ransomware, which they called HermeticRansom. This malware was found around the same time the HermeticWiper was found, and based on publicly available information from security community it was used in recent cyberattacks in Ukraine. The new ransomware was likely used as a smokescreen for the HermeticWiper attack due to its non-sophisticated style and poor implementation. Findings in a nutshell: Elections GoRansom (aka HermeticRansom) was used to target assets on the same day as HermeticWiper; The developers used a sarcastic function-naming scheme related to US presidential elections; The malware does not use any kind of obfuscation and has pretty straightforward functionality, suggesting it was created in a short amount of time.

550

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 CHINA-LINKED GROUP USING NEW DAXIN BACKDOOR 🚨News

New research by the Symantec Threat Hunter team, has uncovered a highly sophisticated piece of malware being used by China-linked threat actors, exhibiting technical complexity previously unseen by such actors. The malware appears to be used in a long-running espionage campaign against select governments and other critical infrastructure targets. There is strong evidence to suggest the malware, Backdoor.Daxin, which allows the attacker to perform various communications and data-gathering operations on the infected computer, has been used as recently as November 2021 by attackers linked to China. Most of the targets appear to be organizations and governments of strategic interest to China. In addition, other tools associated with Chinese espionage actors were found on some of the same computers where Daxin was deployed. Daxin is without doubt the most advanced piece of malware Symantec researchers have seen used by a China-linked actor. Considering its capabilities and the nature of its

500

1 year ago

Miri AdjiashviliEmployee

posted in Researchers Feed

Request smuggling and request concatenation in SAP NetWeaver, SAP Content Server and SAP Web Dispatcher (CVE-2022-22536)

On February 8th, SAP disclosed several vulnerabilities in the Internet Communication Manager (ICM), a critical component of its NetWeaver Application Servers. One critical vulnerability, named ICMAD (CVE-2022-22536), received a CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).A remote unauthenticated attacker could exploit this vulnerability by sending a simple HTTP request, and lead to a full system takeover and complete compromise of Confidentiality, Integrity and Availability of the system.While the best mitigation would be to patch the vulnerable servers as soon as possible, the following SAP Notes provide additional information around patch and mitigations:3123396 – [CVE-2022-22536] Request smuggling and request concatenation in SAP NetWeaver, SAP Content Server and SAP Web Dispatcher 3137885 – Workaround for security SAP note 3123396 3138881 – wdisp/additional_conn_close workaround for security SAP note 3123396The Cymulate team published an Advanced Scenario scanner allow

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Lorenz ransomware targets worldwide organizations 🚨News

Lorenz is a ransomware strain, believed to be a rebranding of the ".sZ40" ransomware. Lorenz targets organizations worldwide with customized attacks demanding hundreds of thousands of dollars, and even millions in ransom fee. The group is targeting victims mostly in English-speaking countries, and according to their website, the group has published stolen data from more than 20 victims, although the estimated number of successful attacks is believed to be higher.

440

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Palestine-Aligned Hackers Use New NimbleMamba Implant in Recent Attacks 🚨News

TA402, a likely Palestinian-aligned advance persistent threat actor, has recently engaged in campaigns leveraging a new implant, dubbed by Proofpoint analysts as NimbleMamba. NimbleMamba is likely a replacement for the group's previously used LastConn implant. These campaigns have a complex attack chain that leverages geofencing and URL redirects to legitimate sites in order to bypass detection efforts.

270

1 year ago

idantCommunity Manager

published in Threat Feed

🚨Pay to play PrivateLoader spreads Smokeloader, Redline, Vidar malware🚨News

PrivateLoader is a modular downloader programmed in the C++ programming language connected to an unidentified PPI service. PrivateLoader sits at the front of this operation and communicates with its back-end infrastructure to retrieve URLs for the malicious payloads to "install" on the infected host. As is the case with downloaders tied to PPI services, PrivateLoader communicates a variety of statistics such as which payloads were downloaded and launched successfully. Distribution campaigns generally rely on a network of search engine optimization (SEO) enhanced websites that lure unsuspecting victims searching for warez aka pirated software to download and execute malware. A password-protected archive typically is delivered that contains a setup file that embeds and executes multiple malicious payloads on the infected host such as GCleaner, PrivateLoader, Raccoon, Redline, Smokeloader and Vidar malware.

410

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Russia arrested REvil ransomware group operators 🚨News

Following news that members of the infamous 'big-game hunter' ransomware group REvil have been arrested by Russian law enforcement, effectively dismantling the group and their operations, it is likely that the group's affiliates will migrate to other ransomware-as-a-service (RaaS) providers. Varonis Threat Labs has observed one such RaaS provider, ALPHV (aka BlackCat ransomware), gaining traction since late 2021, actively recruiting new affiliates and targeting organizations across multiple sectors worldwide.

270

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Iranian APT MuddyWater targets Turkish users with malicious PDFs and maldocs 🚨News

MuddyWater has conducted various campaigns against entities spread throughout the U.S.A, Europe, Middle East and South Asia. A typical TTP employed by the group is the heavy use of scripting in their infection chains using languages like PowerShell and Visual Basic coupled with the frequent use of living-off-the-land binaries (LoLBins). Cisco Talos recently observed a campaign operated by MuddyWater targeting users in Turkey. This campaign consists of the use of malicious PDFs and Microsoft Office documents (maldocs) to serve as the initial infection vector. These maldocs were named in such a way as to masquerade as legitimate documents from the Turkish Health and Interior Ministries. Next, the malware executes a series of scripts deployed on the infected endpoint to serve as downloaders and instrumentors for additional payloads.

320

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Shuckworm Continues Cyber-Espionage Attacks Against Ukraine 🚨News

The Russia-linked Shuckworm group (aka Gamaredon, Armageddon) is continuing to conduct cyber-espionage attacks against targets in Ukraine. Shuckworm specializes in cyber-espionage campaigns mainly against entities in Ukraine. The group is known to use phishing emails to distribute either freely available remote access tools, including Remote Manipulator System (RMS) and UltraVNC, or customized malware called Pterodo/Pteranodon targets. A recent report published by The Security Service of Ukraine (SSU) noted that Shuckworm's attacks have grown in sophistication in recent times, with attackers now using living-off-the-land tools to steal credentials and move laterally on victim networks.

410

1 year ago

Miri AdjiashviliEmployee

posted in Researchers Feed

Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)

Last week, a local privilege escalation vulnerability was introduced in the Polkit component, affecting every major Linux distribution. Polkit is a component for controlling system-wide privileges in Unix-like operating systems. It allows a non-privileged process to communicate with privileged ones.This memory corruption vulnerability, which got the name PwnKit, exploits a bug in polkit’s pkexec utility where it doesn’t handle the calling parameters count correctly and ends trying to execute environment variables as commands.This easily exploited vulnerability, which received a CVSS score of 7.8, allows any unprivileged user to gain full root privileges on a vulnerable host by exploiting this vulnerability in its default configuration. The exploit to this vulnerability was published and is now available to all.To mitigate this vulnerability, it is necessary to update the operating system and patch this vulnerability. If full patching is not an option at the moment, an example of a temp

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Lazarus Group launches attack using Windows Update and GitHub 🚨

Lazarus Group is one of the most sophisticated North Korean APTs that has been active since 2009. The group is responsible for many high profile attacks in the past and has gained worldwide attention. The Malwarebytes Threat Intelligence team was able to spot a new campaign on Jan 18th 2022. In this campaign, Lazarus conducted spear phishing attacks weaponized with malicious documents that use their known job opportunities theme. Malwarebytes identified two decoy documents masquerading as American global security and aerospace giant Lockheed Martin. This attack includes a clever use of Windows Update to execute the malicious payload and GitHub as a command and control server. The rogue GitHub account was reported for harmful content.

350

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Researchers detected APT actor BlueNoroff 🚨News

BlueNoroff is the name of an APT group coined by Kaspersky researchers while investigating the notorious attack on Bangladesh's Central Bank back in 2016. A mysterious group with links to Lazarus and an unusual financial motivation for an APT. The group seems to work more like a unit within a larger formation of Lazarus attackers, with the ability to tap into its vast resources: be it malware implants, exploits, or infrastructure.

290

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Linux malware is on the rise🚨News

Malware targeting Linux-based operating systems, commonly deployed in Internet of Things (IoT) devices, have increased by 35% in 2021, according to current CrowdStrike threat telemetry, with the top three malware families accounting for 22% of all Linux-based IoT malware in 2021. XorDDoS, Mirai and Mozi are the most prevalent Linux-based malware families observed, with Mozi registering a significant tenfold increase in the number of in-the-wild samples. The primary purpose of these malware families is to compromise vulnerable internet-connected devices, amass them into botnets, and use them to perform distributed denial of service (DDoS) attacks.

370

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 White Rabbit malware was detected 🚨News

Researchers spotted the new ransomware family White Rabbit discretely making a name for itself by executing an attack on a local US bank. This newcomer takes a page from Egregor, a more established ransomware family, in hiding its malicious activity and carries a potential connection to the advanced persistent threat (APT) group FIN8.

480

1 year ago

Miri AdjiashviliEmployee

posted in Researchers Feed

Lateral Movement Use Case - Local Administrator's Password Reuse

As part of the Professional-Services packages we offer our clients, Cymulate’s security experts ran Lateral Movement campaign together with the clients. The main security misconfigurations our team identified were associated with the usage of golden images to deploy new servers and workstations.The usage of golden images can help IT managers to easily deploy new endpoints in the network. By preconfiguring once, the IT team can rest assured the new endpoint will include all the necessary settings and configurations, without the need to configure each new endpoint every time. The problem starts, when the deployment procedure lacks changing the password of the local users on the new endpoint following the deployment.By reusing the token of the local users, especially the local administrator user, a potential threat actor could easily move laterally and reach high risk network areas and critical assets. In severe cases, the Domain Controller’s local administrator password is reused as well

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Donot Team APT constantly hits its targets until they succeed🚨News

Recent attacks carried out by Donot Team, targeting government and military entities in several South Asian countries Donot Team (also known as APT-C-35 and SectorE02) is a threat actor operating since at least 2016 and known for targeting organizations and individuals in South Asia with Windows and Android malware. A recent report by Amnesty International links the group's malware to an Indian cybersecurity company that may be selling the spyware or offering a hackers-for-hire service to governments of the region. ESET have been closely following the activities of Donot Team, and have traced several campaigns that leverage Windows malware derived from the group's signature yty malware framework. According to their findings, the group is very persistent and has consistently targeted the same organizations for at least the last two years.

480

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 US Military Ties Prolific MuddyWater Cyberespionage APT to Iran🚨News

Iranian MOIS hacker group MuddyWater is using a suite of malware to conduct espionage and malicious activity. MuddyWater is commonly considered an Iranian state-sponsored threat actor but no further granularity has previously been available. As of January 12th, 2022, U.S. CyberCommand has attributed this activity to the Iranian Ministry of Intelligence (MOIS). While some cases allow for attribution hunches, or even fleshed out connections to handles and online personas, attribution to a particular government organization is often reserved to the kind of visibility only available to governments with a well-developed all-source and signals intelligence apparatus.

320

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Abcbot DDoS Botnet Linked to Older Cryptojacking Campaign 🚨News

Abcbot, the emerging botnet that was recently analyzed and reported on, has a longer history than first thought. We discovered a link between Xanthe and Abcbot campaigns when analyzing the infrastructure behind Abcbot. Based on the analysis, we believe that the same threat actor is responsible for both Xanthe and Abcbot and is shifting its objective from mining cryptocurrency on compromised hosts to activities more traditionally associated with botnets, such as DDoS attacks.

360

1 year ago

Miri AdjiashviliEmployee

posted in Researchers Feed

HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2022-21907)

In the last Patch Tuesday (Jan, 11th 2022), Microsoft introduced a patch for a critical vulnerability in the HTTP Protocol Stack (http.sys) CVE-2022-21907. This vulnerability, who got a CVSS Base Score of 9.8, allows an unauthenticated attacker to send a specially crafted packet to the server and run malicious code.The affected operating systems include Windows 10, Windows Server 2019 (Builds 1809 and 20H2 or higher) and Windows Server 2022.Windows 10 and Windows server 2019 build 1809 are not vulnerable by default, unless “HTTP Trailer Support” was enabled. It can be checked by querying the registry for a specific key, meaning this configuration is enabled (a temporary mitigation could be deleting this registry value).Windows 10 and Windows server 2019, builds 20H2 or higher, and Windows Server 2022 have “HTTP Trailer Support” enabled by default, making them vulnerable.Cymulate released a small scanner under the “Advanced Scenarios” part of the platform, to help our customers scan the

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Zloader malware exploits Microsoft's e-signature verification🚨News

An ongoing ZLoader malware campaign has been uncovered exploiting remote monitoring tools and a nine-year-old flaw concerning Microsoft's digital signature verification to siphon user credentials and sensitive information. Check Point Research, which has been tracking the sophisticated infection chain since November 2021, attributed it to a cybercriminal group dubbed Malsmoke, citing similarities with previous attacks. "The techniques incorporated in the infection chain include the use of legitimate remote management software (RMM) to gain initial access to the target machine," Check Point's Golan Cohen said. "The malware then exploits Microsoft's digital signature verification method to inject its payload into a signed system DLL to further evade the system's defenses."

310

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Latin American banking trojans target Brazil, Spain, and Mexico 🚨News

Latin American banking trojans are an ongoing, evolving threat. They target mainly Brazil, Spain, and Mexico. There are at least eight different malware families still active. Researchers briefly describe their main features. The vast majority are distributed via spam, usually leading to a ZIP archive or an MSI installer.

240

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Dridex Malware is being Distributed Through Phishing Emails🚨News

Dridex is a banking malware that collects a user's banking credentials and performs malicious behaviors by receiving commands from the attacker. It is usually distributed through spam emails and performs malicious behaviors after downloading the main module through a loader. The recently discovered distribution method of Dridex has the following flow and characteristics: Phishing emails indiscriminately distributed to random users Documents are protected with passwords to bypass anti-malware's detection, password is written in the email Message "Merry X-MAS!" or "Merry Christmas!" pops up when document macro is enabled Creates and runs VBS scripts using the Excel Cell Formula method Downloads and runs Dridex The content of phishing emails varies from 'Christmas bonus for all workers' to 'Termination of employment.'

200

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Dribex Malware is being Distributed Via Phishing Emails🚨News

250

1 year ago

idantCommunity Manager

posted in Cymulate's News & Updates

The Most Impactful Cybersecurity Incidents of 2021 - What do you think?

"Those who do not learn history are doomed to repeat it."Take a lesson from the 7 most disruptive incidents of 2021, as reported by Dark Reading. What do you find as the most disruptive incident 2021? And of course…

1 year ago

idantCommunity Manager

published in Threat Feed

🚨 Malicious Notepad++ installers push StrongPity malware 🚨News

The sophisticated hacking group known as StrongPity is circulating laced Notepad++ installers that infect targets with malware. This hacking group, also known as APT-C-41 and Promethium, was previously seen distributing trojanized WinRAR installers in highly-targeted campaigns between 2016 and 2018, so this technique is not new. The recent lure involves Notepad++, a very popular free text and source code editor for Windows used in a wide range of organizations. The discovery of the tampered installer comes from a threat analyst known as 'blackorbird' analysts, while Minerva Labs reports on the malware.

230

1 year ago

Page 4 / 8

Badge winners

Jerry_Hsiehhas earned the badge Conversation Starter
viraj_korgaonkarhas earned the badge Conversation Starter
surasej_chhas earned the badge Conversation Starter
rupa_sharmahas earned the badge Conversation Starter
madu_hettigehas earned the badge Conversation Starter

Show all badges

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Login

CUSTOMER / CYMULATE EMPLOYEE LOGIN

Username *

E-mail address *

First Name *

Last Name *

Country *

Company Name

(Private)

Only you and moderators can see this information

State

Password *

I accept the terms & conditions

loginBox.register.email_repeat

Login to the community

No account yet? Create an account

Login

CUSTOMER / CYMULATE EMPLOYEE LOGIN

Username or Email

Password

Remember me

Forgot password?

Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.

Username or e-mail

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.