HackDig : Dig high-quality web security articles for hackers

Inter skimming kit used in homoglyph attacks

As we continue to track web threats and credit card skimming in particular, we often rediscover techniques we’ve encountered elsewhere before. In this post, we share a recent find that involves what is known as an homoglyph attack. This technique has been exploited for some time already, especially in phishing scams with IDN homograph attacks. Th
Publish At:2020-08-06 16:20 | Read:356 | Comments:0 | Tags:Threat analysis credit card skimming homoglyph Inter kit Mag

Malspam campaign caught using GuLoader after service relaunch

They say any publicity is good publicity. But perhaps this isn’t true for CloudEye, an Italian firm that claims to provide “the next generation of Windows executables’ protection”. First described by Proofpoint security researchers in March 2020, GuLoader is a downloader used by threat actors to distribute malware on a large scale.
Publish At:2020-07-30 16:35 | Read:263 | Comments:0 | Tags:Malware Threat analysis GuLoader malspam malware spam steale

Effective Threat Intelligence Through Vulnerability Analysis

Vulnerabilities are weaknesses leveraged by adversaries to compromise the confidentiality, availability or integrity of a resource. The vulnerability ecosystem has matured considerably in the last few years. A significant amount of effort has been invested to capture, curate, taxonomize and communicate the vulnerabilities in terms of severity, impact and com
Publish At:2020-07-30 15:37 | Read:288 | Comments:0 | Tags:Vulnerability Management ENISA Report threat analysis vulner

Chinese APT group targets India and Hong Kong using new variant of MgBot malware

This blog post was authored by Hossein Jazi and Jérôme Segura On July 2, we found an archive file with an embedded document pretending to be from the government of India. This file used template injection to drop a malicious template which loaded a variant of Cobalt Strike. One day later, the same threat actor changed their template and dropped a load
Publish At:2020-07-21 14:16 | Read:247 | Comments:0 | Tags:Threat analysis APT china chinese apt government of india ho

Credit card skimmer targets ASP.NET sites

Cybercriminals typically focus on targets that can get them the highest return with the least amount of effort. This is often determined by their ability to scale attacks, and therefore on how prevalent a vulnerability or target system is. Enter: the credit card skimmer. In the world of digital skimming, we’ve seen the most activity on e-commerce co
Publish At:2020-07-06 15:00 | Read:390 | Comments:0 | Tags:Threat analysis ASP.net credit card credit card skimmer cred

Web skimmer hides within EXIF metadata, exfiltrates credit cards via image files

They say a picture is worth a thousand words. Threat actors must have remembered that as they devised yet another way to hide their credit card skimmer in order to evade detection. When we first investigated this campaign, we thought it may be another one of those favicon tricks, which we had described in a previous blog. However, it turned out to be diff
Publish At:2020-06-25 16:41 | Read:247 | Comments:0 | Tags:Threat analysis EXIF Magecart metadata skimmers skimming

Multi-stage APT attack drops Cobalt Strike using Malleable C2 feature

This blog post was authored by Hossein Jazi and Jérôme Segura On June 10, we found a malicious Word document disguised as a resume that uses template injection to drop a .Net Loader. This is the first part of a multi-stage attack that we believe is associated to an APT attack. In the last stage, the threat actors used Cobalt Strike’s Malleable C2 fe
Publish At:2020-06-17 15:39 | Read:357 | Comments:0 | Tags:Malware Threat analysis APT C2 cobalt strike Malleable C2

Honda and Enel impacted by cyber attack suspected to be ransomware

Car manufacturer Honda has been hit by a cyber attack, according to a report published by the BBC, and later confirmed by the company in a tweet. Another similar attack, also disclosed on Twitter, hit Edesur S.A., one of the companies belonging to Enel Argentina which operates in the business of energy distribution in the City of Buenos Aires. Based on sa
Publish At:2020-06-10 02:12 | Read:392 | Comments:0 | Tags:Ransomware Threat analysis ekans enel honda ransomware Snake

New LNK attack tied to Higaisa APT discovered

This post was authored by Hossein Jazi and Jérôme Segura On May 29th, we identified an attack that we believe is part of a new campaign from an Advanced Persistent Threat actor known as Higaisa. The Higaisa APT is believed to be tied to the Korean peninsula, and was first disclosed by Tencent Security Threat Intelligence Center in early 2019. The grou
Publish At:2020-06-04 12:55 | Read:403 | Comments:0 | Tags:Malware Threat analysis APT Higaisa korea LNK PlugX rat

Coronavirus campaigns lead to surge in malware threats, Labs report finds

In the first three months of 2020, as the world clamped down to limit coronavirus, cyber threats ramped up. Our latest, special edition for our quarterly CTNT report focuses on recent, increased malware threats which all have one, big thing in common—using coronavirus as a lure. Our report, “Cybercrime tactics and techniques: Attack on home base,” analyze
Publish At:2020-06-01 13:35 | Read:529 | Comments:0 | Tags:Cybercrime Malware Reports Scams Social engineering Threat a

Winning with Cyber Threat Intelligence: Taking a More Personal View

In this final article of our trilogy, we investigate how a cyber threat intelligence (CTI) analyst and associated programmes provide insight about physical and cyber threats to your organisation. The value of these insights is reflected in the wins, which come as a result of context building, holistic understanding, and enhanced awareness in order to outmano
Publish At:2020-05-24 09:53 | Read:342 | Comments:0 | Tags:Security Awareness Cyber Threats threat analysis threat inte

Shining a light on “Silent Night” Zloader/Zbot

When it comes to banking Trojans, ZeuS is probably the most famous one ever released. Since its source code originally leaked in 2011, several new variants proliferated online. That includes a past fork called Terdot Zbot/Zloader, which we extensively covered in 2017. But recently, we observed another bot, with a design reminiscent of ZeuS, that seems to
Publish At:2020-05-24 07:20 | Read:303 | Comments:0 | Tags:Malware Threat analysis banking Trojan banking Trojans HYAS

Credit card skimmer masquerades as favicon

Malware authors are notorious for their deceptive attempts at staying one step ahead of defenders. As their schemes get exposed, they always need to go back to their bag of tricks to pull out a new one. When it comes to online credit card skimmers, we have already seen a number of evasion techniques, some fairly simple and others more elaborate. The goal
Publish At:2020-05-18 13:43 | Read:420 | Comments:0 | Tags:Threat analysis ants and cockroach credit car credit card sk

New Mac variant of Lazarus Dacls RAT distributed via Trojanized 2FA app

This blog post was authored by Hossein Jazi, Thomas Reed and Jérôme Segura. We recently identified what we believe is a new variant of the Dacls Remote Access Trojan (RAT) associated with North Korea’s Lazarus group, designed specifically for the Mac operating system. Dacls is a RAT that was discovered by Qihoo 360 NetLab in December 2019 as a fu
Publish At:2020-05-18 13:43 | Read:561 | Comments:0 | Tags:Mac Malware Threat analysis APT Dacls Lazarus mac malware ra

APTs and COVID-19: How advanced persistent threats use the coronavirus as a lure

The coronavirus (Covid-19) has become a global pandemic and this is a golden time for attackers to take advantage of this fear to increase the likelihood of their attacks success rate by performing spam and spear phishing campaigns. From late January, several cyber-criminal and state-sponsored groups have begun using coronavirus-based phishing as their i
Publish At:2020-04-09 16:48 | Read:669 | Comments:0 | Tags:Threat analysis advanced persistent threats APTs covid-19 ma

Tools

Tag Cloud