Agent Tesla is a remote access trojan (RAT) written for the.NET framework that has knowingly been in operation since 2014. Threat actors behind this malware have leveraged many different methods to deliver their payload over time including macro enabled Word documents, Microsoft Office vulnerabilities, OLE objects and most recently, compiled HTML help files.
Healthcare organisations in the United States are being warned to be on their guard once again, this time against a family of ransomware known as Venus. An advisory from the United States Department of Health and Human Services (HHS) has warned that the cybercriminals behind the Venus ransomware have targeted at least one healthcare entity in the United States, and are known to be targeting publicly-exposed Remote Desktop Servers.
In this third post in our series on Malicious Software Packages, we’ll focus on the aftermath of a successful attack and how the attacker executes payloads to serve their needs through various real-life scenarios. Before we start, let’s review a few highlights from the second post you might’ve missed: Now, let’s get to blog three in the series.
PC manufacturer Lenovo has been forced to push out a security update to more than two dozen of its laptop models, following the discovery of high severity vulnerabilities that could be exploited by malicious hackers. Security researchers at ESET discovered flaws in 25 of its laptop models - including IdeaPads, Slims, and ThinkBooks - that could be used to disable the UEFI Secure Boot process.
“Have you backed up your files?” If you had a Dirham for every time you heard this and followed up with immediate action, you’d be a Shiekh by now. But alas, we’re here because you didn’t do your due diligence and now you have to pay the ultimate price—your data has been compromised and you’ll have to decide what to do about it. But don’t feel too bad; data backup at a corporate level is a luxury not everyone gets to enjoy.
Every software we use consists of instructions in the form of computer codes that dictate how computers behave or perform certain tasks. But not all software is designed to make our lives easier. Malware, a portmanteau of the words malicious and software, is specifically designed to help hackers gain access to, steal information from, or damage a computer. Oftentimes, all this happens without the knowledge of the computer user themselves. Until it’s too late, that is.
BlackCat (a.k.a. ALPHV and Noberus) is a Ransomware-as-a-Service (RaaS) group that emerged in November 2021, making headlines for being a sophisticated ransomware written in Rust. It has both Windows and Linux variants and the payload can be customized to adapt to the attacker’s needs. BlackCat is also believed to be the successor of the Darkside and BlackMatter ransomware groups.
Let’s dig deeper into the techniques used by attackers and the mitigations you should implement when ransomware on Azure affects you. By now, we should all be aware of ransomware from the constant news articles associated with this known threat. As we explained in the anatomy of a cloud attacks, ransomware is a way for attackers to make money when they gain control of your accounts through data encryption, therefore restricting your access to the system.
In workplaces of the past, IT teams could afford to trust the devices in their network because they knew them. After all, they issued and managed them. But today’s work environment makes trust a little difficult. From work from home to the vast expansion of enterprise applications, IT and security teams have a whole new set of cybersecurity challenges to mitigate. Your workers are human and are subject to human error. Phishing attempts are not always easy to spot.
