Category: Heimdal Security Blog

New Stealer Malware on the Rise: Mystic Stealer

Mystic Stealer is an information-stealing malware that first emerged on hacking forums on April 2023. The stealer gets more and more popular among cybercriminals as its features evolve. Details About Mystic Stealer The malware is rented for $150/month, or $390/…

LockBit Ransomware Extorted $91 Million Dollars in 1,700 U.S. Attacks

In a joint LockBit ransomware advisory, U.S. and international cybersecurity officials reported that the group has successfully extorted over $91 million after committing almost 1,700 operations against American businesses since 2020. Details from the U.S. And International Cybersecurity Officials Joint…

More 3CX Data Exposed! Third-Party Vendor to Blame for the Leak

Sensitive 3CX data was exposed when a third-party vendor of the well-known Voice over Internet Protocol (VoIP) communications service 3CX left an open server. Even though the corporation had lately been the target of North Korean hackers, the problem slipped…

MDR vs. MSSP: Decoding the Differences Between Cybersecurity Solutions

In the constantly changing cybersecurity world, organizations confront a variety of obstacles when trying to protect their digital assets. Businesses must rely on comprehensive security solutions to safeguard their sensitive data as attacks become more complex and breaches more frequent. …

Private Data Compromised in Healthcare Breach

In a recent announcement, the Commonwealth Health System revealed that threat actors have successfully breached the computer network of a Scranton cardiology group, potentially compromising the private data of 181,764 patients. This incident marks the latest in a series of…

Patch Tuesday June 2023 – 78 Flaws and 38 RCE Bugs Fixed

As per usual, Microsoft rolled out its monthly updates on the second Tuesday of the month. 78 flaws, including 38 remote code execution vulnerabilities were fixed as part of this edition of Patch Tuesday. Microsoft only rated six problems as…

Fake Security Researchers Deliver Malicious Zero-Day Exploits

Cybercriminals use fake accounts on Twitter and GitHub to spread fake proof-of-concept (PoC) exploits for zero-day vulnerabilities. They impersonate cybersecurity researchers to push Windows and Linux with malware. How the Scam Works These impersonators pretend to work at a fake…

Threat Actors Target the University of Manchester in Cyberattack

The University of Manchester network was reportedly hit by a cyberattack and the security team suspects data was stolen. Researchers discovered the data breach on Tuesday, June 6th. Threat actors managed to gain unauthorized access to some of the university`s…

What Is User Access Review?

User access review is an essential component of any organization’s Identity and Access Management (IAM) strategy. Also known as access audit, entitlement review, account attestation, or account recertification, it describes the process of periodically reviewing the access rights and privileges…

What Is the Principle of Least Privilege (POLP)?

The principle of least privilege (POLP), also named the “principle of least authority” (POLA) or “the principle of minimal privilege” (POMP), stands for a cybersecurity best practice based upon granting the minimum required access that a user needs to perform…

Kimsuky Strikes Again: New Campaign Targets Credentials and Intelligence

Kimsuky, the notorious North Korean nation-state threat actor, has been linked to a social engineering campaign targeting experts on North Korean affairs in order to steal Google credentials and deliver reconnaissance malware. Using spoofed URLs, websites imitating legitimate web platforms,…

Royal Ransomware Gang Bolsters Arsenal with BlackSuit Encryptor

The testing phase of BlackSuit, a new encryptor developed by the Royal ransomware gang, has commenced. This encryptor bears striking resemblances to the typical encryptor used by the gang in their operations. Following the shutdown of the infamous Conti operation…

Companies Affected by Ransomware [Updated 2023]

The increasing frequency and size of ransomware attacks are becoming a huge concern for thousands of organizations globally. All over the world, threat actors take advantage of security vulnerabilities and encrypt data belonging to all sorts of organizations: from private…

The MOVEit Hack Affected BBC, British Airways, and Boots

British Airways, Boots, and the British Broadcasting Corporation (BBC) all confirmed that tens of thousands of employees’ personal data was exposed due to a widespread breach that affected a popular file transfer tool. It seems Zellis, a payroll provider company…

What Is SCIM Provisioning?

In the digital age, where enterprises thrive on collaboration and smooth connectivity, user identities and access privileges management has become critical. It’s no secret that manually adding and managing users (also known as user provisioning) can prove a challenging, time-consuming,…

New QBot Malware Campaign Exploits WordPad for Infection

A recent QBot malware campaign has been observed leveraging a DLL hijacking vulnerability in the WordPad utility application to evade detection by security measures. Exploiting Windows programs for malicious purposes is an increasingly prevalent trend observed among threat actors. According…

MacOS Vulnerability Enables Hackers to Bypass SIP Root Restrictions

Researchers discovered an Apple vulnerability that threat actors can use to deploy undeletable malware. In order to exploit CVE-2023-32369, hackers need to previously gain root privileges over the device. The Apple bug enables them to bypass System Integrity Protection (SIP)…

Warning: Lazarus Targets Windows IIS Web Servers For Initial Access

The notorious Lazarus Group of North Korean state-sponsored threat actors is currently targeting vulnerable Windows Internet Information Services (IIS) web servers to obtain first access to business networks. Lazarus’ primary motivation is financial, and many observers think that the hackers’…

RaidForums Members Data Leaked on New Hacking Forum

Threat actors and security researchers now have access to a database for the notorious RaidForums hacking forums, giving them insight into the forum’s regulars. RaidForums was a very popular hacking and data leak forum known for hosting, leaking, and selling…

New Phishing Kit: File Archivers in the Browser

A new phishing kit, “File Archivers in the Browser” abuses ZIP domains. The kit displays bogus WinRAR or Windows File Explorer windows in the browser. The goal is to convince users to launch malicious processes. Google just enabled this month…

What Is ZTNA? Zero Trust Network Access Explained.

In today’s fast-changing digital landscape, ensuring strong network security has become a top priority for companies of all sizes. Given the rise of remote work, cloud computing, and increasingly complex cyber threats, conventional network architectures and perimeter-based security measures are…

CosmicEnergy: The New Russian-Linked Malware Targets Industrial System

A new malware has been discovered in the wild by security researchers. Called CosmicEnergy, the malware is designed to disrupt industrial systems. Sources say that the Russian cybersecurity group Rostelecom-Solar (fka Solar Security) is behind the malware. IEC-104-compliant remote terminal…

Almost 300k People Affected by Ransomware Attack on Dish Network

Dish Network reported a data breach subsequent to the ransomware attack in February and started the process of notifying the affected parties. The broadcast company went offline on February 24, 2023, affecting Dish.com, Dish Anywhere, and many other Dish Network…

Over 300k People Affected by Ransomware Attack on Dish Network

Dish Network reported a data breach subsequent to the ransomware attack in February and started the process of notifying the affected parties. The broadcast company went offline on February 24, 2023, affecting Dish.com, Dish Anywhere, and many other Dish Network…

The Royal Gang Is Developing Its Own Malware Loader

It has been reported that the Royal ransomware group is enhancing its arsenal with new malware. This group is said to have surfaced following the dismantling of the notorious Conti group. Several other Conti-related groups have been observed using commercial…

Privileged Access Management (PAM) Best Practices

Privileged access management, PAM in short, is a crucial set of tools and technologies allowing organizations to maintain steadfast control and monitorization over the access to critical information and resources, as well as users, accounts and processes. Precisely because it is…

Three New Zero-Day Vulnerabilities Fixed By Apple

Apple resolves three new zero-day vulnerabilities used to compromise iPhones and Macs. The flaws were all found in the multi-platform WebKit browser engine, as the company revealed in security advisories released to inform its clients about the active exploitation of…

Lemon Gang Pre-Infects 9 Million Android Devices With Malware

Nearly 9 million Android-based smartphones, watches, TVs, and TV boxes have been infected with the “Guerrilla” malware, pre-installed on the devices by Lemon Group. The threat actors use the malware to load additional payloads, intercept one-time passwords from SMS, set…

State-Sponsored Cybercrime Group`s Infrastructure Revealed

Researchers have uncovered previously unknown attack infrastructure used by Pakistani and Chinese entities operated by the state-sponsored group SideWinder. In a joint report, cybersecurity companies Group-IB and Bridewell say the threat actor uses 55 domains and IP addresses. At least since…

Ransomware in the Name of Charity: MalasLocker Targets Zimbra

A new ransomware operation has been observed hacking Zimbra servers to steal emails and encrypt files. Instead of demanding a ransom payment, the threat actors claim to require a donation to charity. In March 2023, a ransomware operation dubbed MalasLocker began encrypting…

Capita Recommends Its Customers to Assume Their Data Was Stolen

At the end of March, a cyberattack affected Capita’s systems, resulting in the theft of customer data. Six weeks after the attack was revealed, Capita warned Universities Superannuation Scheme (USS), the largest private pension scheme in the UK, to assume…

PharMerica Cyber Incident Exposes 5.8 M People’s Data

PharMerica, the second largest provider of institutional pharmacy services in the United States, confirmed that it suffered a data breach that exposed the personal information of 5,815,591 people. The company started sending notices to the impacted individuals on the 12th…

Discord Announces a Data Breach Involving a Support Agent

Discord messaging platform announced a data breach. The incident involved a third-party support agent whose account has been compromised. The notification warned customers about unauthorized access to the agent’s support ticket queue. The Exposed Data & Security Measures This incident…

What Is Endpoint Privilege Management?

While this article aims to define what is endpoint privilege management, I will first begin to explain the circumstances of this process. Within any organization, privileges are usually split between two levels of hierarchy: standard users and administrators. The highest…

Toyota Disclosed a Ten-Year Long Data Breach

Toyota Motor Corporation issued a notice on the company’s Japanese newsroom disclosing a data breach of ten years. A database misconfiguration in its cloud environment leads to exposing of the car-location data of 2,150,000 customers. Details from the Data Breach…

Third-Party Patch Management: A Comprehensive Guide

In today’s digital age, software vulnerabilities are on the rise, and cyber threats are becoming more sophisticated. As a result, businesses must be proactive in their approach to cybersecurity to minimize the risk of a data breach. One way to…

Black Basta Ransomware Attacks Global Technology Company ABB

ABB, a leading provider of electrification and automation technology, has been hit by a Black Basta ransomware attack, which has reportedly affected business operations. As part of its services, ABB develops industrial control systems (ICS) and SCADA systems for manufacturers…

What Is Privileged Identity Management (PIM)?

When we talk about Privileged Access Management (PAM), Privileged Identity Management (PIM), Identity and Access Management (IAM), and other access management terms, we think of technologies for protecting a company’s critical assets. These phrases refer to maintaining the security of…

XDR vs SIEM vs SOAR: A Comparison

With the “detect early” and “respond fast” capabilities in your mind, you may wonder what to choose from the XDR vs SIEM vs SOAR options. A good Detection and Response (D&R) solution is essential for your company’s cybersecurity posture. As…

Linux Kernel Vulnerability Gives Cybercriminals Root Privileges

There is a new Linux NetFilter kernel flaw that allows unprivileged local users to escalate their privileges to root level, giving them complete control over the system. The vulnerability has been assigned the CVE-2023-32233 identifier, but its severity level has not…

Fake Windows Update Used to Push Aurora Info-Stealer

The Aurora information-stealing malware was delivered through an in-browser Windows update simulation in a recent malvertising campaign. For more than a year, Aurora has been advertised on various hacker forums as an info stealer with extensive capabilities and low antivirus…

Cactus Ransomware Infiltrates Networks by Exploiting VPN Flaws

Researchers warn Cactus Ransomware exploits VPN Flaws to compromise networks and encrypts itself to avoid detection. The new ransomware strain targets large commercial entities that use remote access services and scans after unpatched vulnerabilities for initial access. How Is Cactus…

Sysco`s System Breached, Customers` and Employees` Data Stolen

Sysco food distributor announced recently that its network was breached, and business, customer, and employee data was compromised. According to an internal memo the company sent to its employees on May 3rd, data belonging to customers and suppliers in the…

A New Ransomware Operation Threatens Your Business: Akira

Researchers spotted a new ransomware operation in March 2023. It is called Akira and targets businesses worldwide, breaching corporate networks, stealing and encrypting data. Threat actors claim to already have sixteen companies in their portfolio of victims from areas like…

Royal Ransomware Targets the City of Dallas in Ransomware Attack

Officials from Dallas, Texas declared that Royal Ransomware gang is responsible for a cyberattack that shut down most of the city’s services and knocked the Dallas Police and Fire Rescue departments offline this week. Since the ransomware group’s Wednesday morning…

Identity and Access Management Best Practices

Identity and Access Management is a critical component of modern-day cybersecurity. Often abbreviated as IAM, it refers to a collection of technologies, policies, and procedures that assist organizations in managing and verifying the identities of individuals and devices, granting access…

ReconShark – Kimsuky’s Newest Recon Tool

Kimsuky, a North Korean hacking group, has been observed employing a new version of its reconnaissance malware called “ReconShark” in a cyberespionage campaign with global reach. According to security analysts, the threat actor has broadened the range of targets it…

What Is IPAM in Networking and Cybersecurity?

Managing thousands of IP-connected devices can become a great challenge for many organizations. But imagine trying to keep track of which IP Address is assigned to each device, which DHCP lease is up, or when the IP has changed? In this…

New Decoy Dog Malware Toolkit Targets Enterprise Networks

A new, sophisticated malware toolkit called Decoy Dog was discovered after cybersecurity researchers analyzed more than 70 billion DNS records belonging to enterprise networks. To avoid detection, Decoy Dog uses stealthy methods like strategic domain aging and DNS query dribbling,…

What Is Privilege Escalation?

Privilege escalation might be a confusing cybersecurity term for many. That’s why in this article we’re going to shed a little bit more light on this topic. Keep reading to find out more about what is privilege escalation, how many…

RTM Locker Ransomware Gang Targets VMware ESXi Servers

RTM Locker is now the most recent enterprise-targeting ransomware operation found to be using a Linux encryptor to target virtual machines on VMware ESXi systems. The RTM (Read The Manual) cybercrime group, which is well-known for disseminating a unique banking…

Managed Threat Hunting: The Next Step from Traditional Cybersecurity

As the world becomes increasingly digital, cybersecurity threats continue to evolve and become more sophisticated. Traditional cybersecurity measures are no longer enough to protect organizations from malicious attacks. That’s where managed threat hunting comes in – a proactive approach that…

What Is a Ping Flood and How to Prevent It?

Imagine sitting at your computer, ready to work or browse the internet, only to find that your connection is suddenly sluggish or completely non-existent. You may have fallen victim to a ping flood attack – one of the most common…

What Is Cyber Threat Hunting? Process, Types and Solutions

Cyber threat hunting is a proactive search for malicious actors and contents in your system. Threat hunting is a must-have part of the defense strategy which focuses to detect and respond rapidly to unknown, undetected, and unresolved threats. This means…

TP-Link High-Severity Flaw Added to Mirai Botnet Arsenal

A TP-Link Archer A21 (AX1800) consumer-grade WiFi router vulnerability has been used by Mirai botnet to launch DDoS attacks against IoT devices. The flaw in the TP-Link Archer AX21 firmware was discovered back in December 2022, and the company released a patch in…

New LOBSHOT Malware Deployed Via Google Ads

Google advertisements have been exploited to distribute various types of malware over the past few months. To trick unsuspecting users into downloading malware onto their systems, threat actors often used the platform to promote fake websites on legit software and…

7,413 People Were Impacted by Alaska Railroad Data Breach

Alaska Railroad Corporation reported a data breach incident that occurred in December 2022 and they discovered it on March 18th, 2023. According to ARCC, a third party gained unauthorized access to the internal network system. Further on, threat actors accessed…

Yellow Pages Canada Suffered a Cyberattack

Yellow Pages Group, a Canadian entity that specializes in directory publishing, has officially confirmed that it has fallen victim to a cyberattack. Black Basta, a group known for spreading ransomware and engaging in extortion, has taken credit for the attack…

PaperCut Flaw Exploited to Hijack Servers, Fix Released

Attackers are taking advantage of critical flaws in the widely used PaperCut MF/NG print management software to install Atera remote management software and take control of servers. The software is used by more than 100 million people from over 70,000…

What Is Privileged Account and Session Management (PASM)?

Privileged Account and Session Management (PASM) is a new PAM (Privileged Access Management) that focuses on privileged account monitoring and management for compliance, security, and data integrity purposes. Whereas PAM covers user account, on rights escalation demands, PASM and PEDM…