Trustwave SpiderLabs “noted” in Part 1 and Part 2 of our OneNote research that OneNote has been used as a malware delivery mechanism now we will shift gears and focus on several OneNote decoy notes SpiderLabs has discovered that deliver malware families like Qakbot, XWorm, Icedid, and AsyncRAT. While the malware payload can change, the techniques have generally been the same.
In part one, we examined how threat actors abuse a OneNote document to install an infostealer. Part 2 of this series discusses an AsyncRAT infection chain while detailing important parts of the code. We’ll also quickly analyze other notable malware strains such as Qakbot and RemcosRAT.
Threat actors are taking advantage of Microsoft OneNote's ability to embed files and use social engineering techniques, such as phishing emails and lures inside the OneNote document, to get unsuspecting users to download and open malicious files. Once clicked, an attacker can use the embedded code for various malicious purposes, such as stealing data or installing ransomware on victims' systems.
Australia is renowned for our willingness to adopt IT efficiencies! The ongoing shift to cloud computing both worldwide and here, seen recently in Amazon’s expansion to a second data center in Melbourne, shows that Australians are not afraid of outsourcing workloads to shared data center.
President Joe Biden took the next step in the nation's ongoing effort to combat cyber threats by issuing the National Cybersecurity Strategy on March 2, which focuses on growing the public-private sector security partnership needed to protect critical infrastructure, dismantle threat groups, and increase resiliency.
Trustwave Government Solutions (TGS), a wholly-owned subsidiary of Trustwave Holdings, Inc., which supports the public sector with market-leading Managed Detection and Response (MDR) cybersecurity services, has achieved Palo Alto Networks Cortex eXtended Managed Detection and Response (XMDR) Specialization.
One year ago today, Russia launched a massive combined arms ground, air, and sea assault against Ukraine, including a large cyber component designed to sow confusion among Ukrainian authorities. At the first anniversary, the initial takeaway is the role played by cyber has not been as prominent as predicted for what has turned into the largest European land war since 1945. Russia and Ukraine are still actively using their cyber troops to conduct a variety of attacks against their foe.
As AISA’s Cyber Conference 2023 being held in Canberra March 20-22 approaches, I thought I would go over some of the hot topics that I expect delegates from Australian public sector organizations will be talking about at the event. And just a quick aside, Trustwave is a keen sponsor of the baristas at this year’s Australian Cyber Conference and we hope to share a hot beverage (of your choice) with you, so please stop by to discuss some of the following hot button topics.
The decision to buy a Security Information and Event Management (SIEM) product or outsource to a Managed Detection and Response (MDR) service depends on a number of factors, including the size of your organization, the complexity of your IT infrastructure, and your overall security needs.
We’ve now seen a number of different use cases for ChatGPT from marketing, sales, software development and others including from the security field. This platform continues to dominate most of the headlines and impress based on how it’s able to handle questions and topics from various backgrounds.
