The Hacker News

Bitter APT hackers add Bangladesh to their targets.

Views expressed in this cybersecurity, cyber crime, and cyber war update are those of the reporters and correspondents.

Accessed on 11 May 2022, 2123 UTC.

Content provided by "The Hacker News."

Source:  https://thehackernews.com/

Please click link or scroll down to read your selections.

Thanks for joining us today.

Russ Roberts

https://hawaiicybersecurityjournal.blogspot.com

https://paper.li/RussellRoberts (machine learning, artificial intelligence, IoT, and information security)

 Subscribe to Newsletter

• Home
• Data Breaches
• Cyber Attacks
• Vulnerabilities
• Malware
• Offers
• Contact





Bitter APT Hackers Add Bangladesh to Their List of Targets in South Asia

May 11, 2022Ravie Lakshmanan

An espionage-focused threat actor known for targeting China, Pakistan, and Saudi Arabia has expanded to set its sights on Bangladeshi government organizations as part of an ongoing campaign that commenced in August 2021. Cybersecurity firm Cisco Talos attributed the activity with moderate confidence to a hacking group dubbed the  Bitter APT  based on overlaps in the command-and-control (C2) infrastructure with that of prior campaigns mounted by the same actor. "Bangladesh fits the profile we have defined for this threat actor, previously targeting Southeast Asian countries including  China , Pakistan, and Saudi Arabia," Vitor Ventura, lead security researcher at Cisco Talos for EMEA and Asia, told The Hacker News. "And now, in this latest campaign, they have widened their reach to Bangladesh. Any new country in southeast Asia being targeted by Bitter APT shouldn't be of surprise." Bitter (aka APT-C-08 or T-APT-17) is suspected to be a South Asian hacking

Researchers Warn of Nerbian RAT Targeting Entities in Italy, Spain, and the U.K

May 11, 2022Ravie Lakshmanan

A previously undocumented remote access trojan (RAT) written in the Go programming language has been spotted disproportionately targeting entities in Italy, Spain, and the U.K. Called  Nerbian RAT  by enterprise security firm Proofpoint, the novel malware leverages COVID-19-themed lures to propagate as part of a low volume email-borne phishing campaign that started on April 26, 2022. "The newly identified Nerbian RAT leverages multiple anti-analysis components spread across several stages, including multiple open-source libraries," Proofpoint researchers  said  in a report shared with The Hacker News.  "It is written in operating system (OS) agnostic Go programming language, compiled for 64-bit systems, and leverages several encryption routines to further evade network analysis." The messages, amounting to less than 100 in number, purport to be from the World Health Organization about safety measures related to COVID-19, urging potential victims to open a macr

[White Paper] Social Engineering: What You Need to Know to Stay Resilient

May 11, 2022The Hacker News

Security and IT teams are losing sleep as would-be intruders lay siege to the weakest link in any organization's digital defense: employees. By preying on human emotion, social engineering scams inflict billions of dollars of damage with minimal planning or expertise. Cybercriminals find it easier to manipulate people before resorting to technical "hacking" tactics. Recent research reveals that social engineering is leveraged in 98% of attacks. As the rapid, ongoing acceleration of remote work raises the stakes, security leaders are fighting back with education and awareness. Resources developed by experts, like this new white paper — " Social Engineering: What You Need to Know to Stay Resilient " — identify the most common tactics, track how these types of attacks are evolving, and provide tips to protect organizations and their end-users. These insights not only inform security practitioners of the latest tactics and emerging threats, but help employees unde

Malicious NPM Packages Target German Companies in Supply Chain Attack

May 11, 2022Ravie Lakshmanan

Cybersecurity researchers have discovered a number of malicious packages in the NPM registry specifically targeting a number of prominent media, logistics, and industrial firms based in Germany to carry out  supply chain attacks . "Compared with most malware found in the NPM repository, this payload seems particularly dangerous: a highly-sophisticated, obfuscated piece of malware that acts as a backdoor and allows the attacker to take total control over the infected machine," researchers from JFrog  said  in a new report. The DevOps company said that evidence points to it being either the work of a sophisticated threat actor or a "very aggressive" penetration test. All the rogue packages, most of which have since been removed from the repository, have been traced to four "maintainers" - bertelsmannnpm, boschnodemodules, stihlnodemodules, and dbschenkernpm — indicating an attempt to impersonate legitimate firms like Bertelsmann, Bosch, Stihl, and DB Sc

E.U. Blames Russia for Cyberattack on KA-SAT Satellite Network Operated by Viasat

May 11, 2022Ravie Lakshmanan

The Five Eyes nations comprising  Australia ,  Canada ,  New Zealand ,  the U.K. , and  the U.S. , along with Ukraine and the European Union, formally pinned Russia for masterminding an attack on an international satellite communication ( SATCOM ) provider that had "spillover" effects across Europe. The  cyber offensive , which took place one hour before the Kremlin's military invasion of Ukraine on February 24, targeted the KA-SAT satellite network operated by telecommunications company Viasat, crippling the operations of wind farms and internet users in central Europe. Viasat, in late March,  disclosed  that it had shipped nearly 30,000 modems to distributors to restore service to customers whose modems were rendered unusable. "This cyberattack had a significant impact causing indiscriminate communication outages and disruptions across several public authorities, businesses and users in Ukraine, as well as affecting several E.U. Member States," the Counci

Microsoft Releases Fix for New Zero-Day with May 2022 Patch Tuesday Updates

May 10, 2022Ravie Lakshmanan

Microsoft on Tuesday rolled out fixes for as many as  74 security vulnerabilities , including one for a zero-day bug that's being actively exploited in the wild. Of the 74 issues, seven are rated Critical, 66 are rated Important, and one is rated low in severity. Two of the flaws are listed as publicly known at the time of release. These encompass 24 remote code execution (RCE), 21 elevation of privilege, 17 information disclosure, and six denial-of-service vulnerabilities, among others. The updates are in addition to  36 flaws  patched in the Chromium-based Microsoft Edge browser on April 28, 2022. Chief among the resolved bugs is  CVE-2022-26925  (CVSS score: 8.1), a spoofing vulnerability affecting the Windows Local Security Authority ( LSA ), which Microsoft describes as a "protected subsystem that authenticates and logs users onto the local system." "An unauthenticated attacker could call a method on the LSARPC interface and coerce the domain controller to

New REvil Samples Indicate Ransomware Gang is Back After Months of Inactivity

May 10, 2022Ravie Lakshmanan

The notorious ransomware operation known as REvil (aka Sodin or Sodinokibi) has resumed after six months of inactivity, an analysis of new ransomware samples has revealed. "Analysis of these samples indicates that the developer has access to REvil's source code, reinforcing the likelihood that the threat group has reemerged," researchers from Secureworks Counter Threat Unit (CTU)  said  in a report published Monday. "The identification of multiple samples with varying modifications in such a short period of time and the lack of an official new version indicates that REvil is under heavy active development once again." REvil, short for Ransomware Evil, is a ransomware-as-a-service (RaaS) scheme and attributed to a Russia-based/speaking group known as  Gold Southfield , arising just as  GandCrab  activity declined and the latter announced their retirement. It's also one of the earliest groups to adopt the double extortion scheme in which stolen data from

Popular This Week

This New Fileless Malware Hides Shellcode in Windows Event Logs

Researchers Warn of 'Raspberry Robin' Malware Spreading via External Drives

F5 Warns of a New Critical BIG-IP Remote Code Execution Vulnerability

NIST Releases Updated Cybersecurity Guidance for Managing Supply Chain Risks

Researchers Develop RCE Exploit for the Latest F5 BIG-IP Vulnerability

U.S. Sanctions Cryptocurrency Mixer Blender for Helping North Korea Launder Millions

Online Courses and Software

A to Z Cybersecurity Certification Training

Get Paid to Hack Computer Networks When You Become a Certified Ethical Hacker.

CompTIA Campus Premium

One-Stop-Shop for All CompTIA Certifications! Get 1-Yr Access to Courses, Live Hands-On Labs, Practice Exams and Updated Content

Network, Security and Ethical Hacking

Your 28-Hour Roadmap as an Ultimate Security Professional — Master Network Monitoring, PenTesting, and Routing Techniques and Vulnerabilities

Complete Linux Certification Training

Know Your Way Around Networks and Client-Server Linux Systems — Techniques, Command Line, Shell Scripting, and More

Cybersecurity Newsletter — Stay Informed

Sign up for cybersecurity newsletter and get latest news updates delivered straight to your inbox daily.

Email

Follow Us



780,100 Followers



1,985,000 Followers



301,500 Followers



19,500 Subscribers



125,500 Followers