CTI Roundup: Vortax Spreads Infostealer Malware, Linux Malware Uses Emojis to Execute Commands
Vortax spreads infostealer malware, new malware campaign distributes fake error messages, and Linux malware uses emojis to execute commands.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Malware
FakePenny Ransomware, Qilin Ransomware, and More: Hacker's Playbook Threat Coverage Round-up: June 2024
In this version of the Hacker’s Playbook Threat Coverage round-up, we are highlighting attack coverage for newly discovered or analyzed threats by the SafeBreach Labs team. SafeBreach customers can select and run these attacks and more from the SafeBreach Hacker’s Playbook to ensure coverage against these advanced threats.
Rising Trend of Ransomware Attacks in Healthcare: Complications from Supply Chain Attacks in Healthcare
Incident Overview In a significant breach of healthcare data security, the Qilin ransomware gang has leaked 400GB of NHS and patient data on Telegram. The group, identified as the Qilin ransomware gang, claimed responsibility for the exfiltration and demanded a $50 million ransom, threatening to release the data if their demands were not met. Following failed negotiations, the gang followed through on their threat and made the entire dataset public.
Enhancing your Clean Room with Rubrik Security Cloud and Cyber Recovery
Properly architecting and designing solutions for clean room recovery is a crucial step for any organization looking to become more resilient to cyber threats. Clean rooms provide organizations with an isolated environment where data integrity and recovery processes are insulated from external threats. By providing a clean room environment, organizations can expedite security investigations and recovery timelines in the event of a cyber attack.
Atlas Oil: The Consequences of a Ransomware Attack
Atlas Oil, a major player in the oil and fuel distribution industry, fell victim to a ransomware attack orchestrated by the Black Basta group. This attack not only compromised sensitive company data but also exposed a variety of documents that could potentially harm the company’s operations and reputation. Overall, Black Basta claims to have exfiltrated approximately 730 GB of data.
Emerging Rust Malware Uses PowerShell to Evade UAC and Steal Data
A new Rust-based information-stealing malware named Fickle Stealer has been identified, using multiple attack vectors to compromise systems and extract sensitive information. According to Fortinet FortiGuard Labs, Fickle Stealer is being distributed through four different methods: VBA dropper, VBA downloader, link downloader, and executable downloader. Some of these methods employ a PowerShell script to bypass User Account Control (UAC) and execute the malware.
Novel Technique Combination Used In IDATLOADER Distribution
Kroll’s Managed Detection and Response (MDR) team responded to an incident in which suspected malware was exhibiting strange download behavior. After successfully containing and resolving the incident, Kroll’s Cyber Threat Intelligence (CTI) team investigated further.
Deep Dive into Application Security: Understanding Firewalls, Malware, and APIs
In this week’s episode, we explore how Cloudflare handles application security, current trends, vulnerabilities, and future expectations. Host João Tomé is joined by Michael Tremante, Director of Product from our Application Security team. We discuss the evolution of application security and its increasing relevance today. We also go into specific use cases, covering firewall security, malware, supply chain risks, and the critical task of monitoring various vulnerabilities, including zero-day threats.
Evaluating dependence on NVD
As I mentioned at the beginning of this year, I am trying to do a monthly blog post on what might be termed “Major Security Events”. In particular this year, I’ve written about the Ivanti meltdown, Lockbit ransomware, and the xz backdoor. These events usually emerge cacophonously and suddenly into the cybersecurity landscape, and generally get everyone’s attention “real quick”.
Qilin Ransomware: What You Need To Know
Qilin (also known as Agenda) is a ransomware-as-a-service criminal operation that works with affiliates, encrypting and exfiltrating the data of hacked organisations and then demanding a ransom be paid.