A campaign targeting Russian entities leveraged social media, Microsoft Learn Challenge, Quora, and GitHub as intermediate C2 servers to deliver Cobalt Strike Beacon. This article has been indexed from Securelist Read the original article: Cobalt Strike Beacon delivered via GitHub…
Tag: Securelist
Cobalt Strike Beacon delivered via GitHub and social media
A campaign targeting Russian entities leveraged social media, Microsoft Learn Challenge, Quora, and GitHub as intermediate C2 servers to deliver Cobalt Strike Beacon. This article has been indexed from Securelist Read the original article: Cobalt Strike Beacon delivered via GitHub…
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Explaining the ToolShell vulnerabilities in SharePoint: how the POST request exploit works, why initial patches can be easily bypassed, and how to stay protected. This article has been indexed from Securelist Read the original article: ToolShell: a story of five…
The SOC files: Rumble in the jungle or APT41’s new target in Africa
Kaspersky experts analyze an incident that saw APT41 launch a targeted attack on government IT services in Africa. This article has been indexed from Securelist Read the original article: The SOC files: Rumble in the jungle or APT41’s new target…
The SOC files: Rumble in the jungle or APT41’s new target in Africa
Kaspersky experts analyze an incident that saw APT41 launch a targeted attack on government IT services in Africa. This article has been indexed from Securelist Read the original article: The SOC files: Rumble in the jungle or APT41’s new target…
Rumble in the jungle: APT41’s new target in Africa
Kaspersky experts analyze an incident that saw APT41 launch a targeted attack on government IT services in Africa. This article has been indexed from Securelist Read the original article: Rumble in the jungle: APT41’s new target in Africa
GhostContainer backdoor: malware compromising Exchange servers of high-value organizations in Asia
In an incident response case in Asia, Kaspersky researchers discovered a new backdoor for Microsoft Exchange servers, based on open-source tools and dubbed “GhostContainer”. This article has been indexed from Securelist Read the original article: GhostContainer backdoor: malware compromising Exchange…
Forensic journey: Breaking down the UserAssist artifact structure
A Kaspersky GERT expert describes the UserAssist Windows artifact, including previously undocumented binary data structure, and shares a useful parsing tool. This article has been indexed from Securelist Read the original article: Forensic journey: Breaking down the UserAssist artifact structure
Code highlighting with Cursor AI for $500,000
Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer. This article has been indexed from Securelist Read the original article: Code highlighting with Cursor AI for $500,000
Batavia spyware steals data from Russian organizations
Kaspersky experts have discovered a new spyware called Batavia, which steals data from corporate devices. This article has been indexed from Securelist Read the original article: Batavia spyware steals data from Russian organizations
Approach to mainframe penetration testing on z/OS. Deep dive into RACF
We have explored the RACF security package in z/OS and developed a utility to interact with its database. Now, we are assessing RACF configuration security for penetration testing. This article has been indexed from Securelist Read the original article: Approach…
AI and collaboration tools: how cyberattackers are targeting SMBs in 2025
In its annual SMB threat report, Kaspersky shares insights into trends and statistics on malware, phishing, scams, and other threats to small and medium-sized businesses, as well as security tips. This article has been indexed from Securelist Read the original…
AI and collaboration tools: how cyberattackers are targeting SMBs in 2025
In its annual SMB threat report, Kaspersky shares insights into trends and statistics on malware, phishing, scams, and other threats to small and medium-sized businesses, as well as security tips. This article has been indexed from Securelist Read the original…
SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play
SparkKitty, a new Trojan spy for iOS and Android, spreads through untrusted websites, the App Store, and Google Play, stealing images from users’ galleries. This article has been indexed from Securelist Read the original article: SparkKitty, SparkCat’s little brother: A…
Toxic trend: Another malware threat targets DeepSeek
Kaspersky GReAT experts discovered a new malicious implant: BrowserVenom. It enables a proxy in browsers like Chrome and Mozilla and spreads through a DeepSeek-mimicking phishing website. This article has been indexed from Securelist Read the original article: Toxic trend: Another…
Toxic trend: Another malware threat targets DeepSeek
Kaspersky GReAT experts discovered a new malicious implant: BrowserVenom. It enables a proxy in browsers like Chrome and Mozilla and spreads through a DeepSeek-mimicking phishing website. This article has been indexed from Securelist Read the original article: Toxic trend: Another…
Sleep with one eye open: how Librarian Ghouls steal data by night
According to Kaspersky, Librarian Ghouls APT continues its series of attacks on Russian entities. A detailed analysis of a malicious campaign utilizing RAR archives and BAT scripts. This article has been indexed from Securelist Read the original article: Sleep with…
Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721
Kaspersky GReAT experts describe the new features of a Mirai variant: the latest botnet infections target TBK DVR devices with CVE-2024-3721. This article has been indexed from Securelist Read the original article: Analysis of the latest Mirai wave exploiting TBK…
IT threat evolution in Q1 2025. Mobile statistics
The number of attacks on mobile devices involving malware, adware, or unwanted apps saw a significant increase in the first quarter. This article has been indexed from Securelist Read the original article: IT threat evolution in Q1 2025. Mobile statistics
IT threat evolution in Q1 2025. Non-mobile statistics
The report presents statistics for Windows, macOS, IoT, and other threats, including ransomware, miners, local and web-based threats, for Q1 2025. This article has been indexed from Securelist Read the original article: IT threat evolution in Q1 2025. Non-mobile statistics