Recent Cybersecurity Breach Targets Personal Information, Heightening Risks for Affected Individuals In the evolving landscape of cybersecurity threats, a recent data breach underscores the vulnerabilities faced by individuals and organizations alike. Reports indicate that a significant amount of sensitive personal…
Turla’s New ‘DeliveryCheck’ Backdoor Compromises Ukrainian Defense Sector
On July 20, 2023, reports emerged of a sophisticated .NET-based backdoor known as DeliveryCheck (also referred to as CAPIBAR or GAMEDAY) targeting the defense sector in Ukraine and Eastern Europe. Attributed to the Russian nation-state actor Turla—also recognized by aliases such as Iron Hunter, Secret Blizzard (formerly Krypton), Uroburos, Venomous Bear, and Waterbug—this malware is associated with Russia’s Federal Security Service (FSB). According to the Microsoft threat intelligence team, in partnership with the Computer Emergency Response Team of Ukraine (CERT-UA), DeliveryCheck is distributed through malicious email attachments containing harmful macros. The backdoor maintains persistence via a scheduled task that downloads and executes it in memory. Additionally, it connects to a command-and-control (C2) server to receive instructions, which may include deploying various payloads embedded within XSLT stylesheets. Successful initial accesses are sometimes accompanied by additional malicious activities.
New Threat Discovered: Turla’s DeliveryCheck Backdoor Targets Ukrainian Defense Infrastructure On July 20, 2023, cybersecurity experts revealed a new threat targeting the defense sector in Ukraine and Eastern Europe. The malware, identified as DeliveryCheck—also referred to by the codename CAPIBAR…
Hot Topic, a well-known retailer specializing in pop-culture merchandise and fashion, is currently facing significant scrutiny due to a recent data breach. The breach allegedly involves a cybercriminal group identified as ‘Satanic,’ which is demanding a ransom of $100,000 in…
Cybercrime, Fraud Management & Cybercrime, Standards, Regulations & Compliance U.S. to Push for Human Rights Protections in Support of Cybercrime Treaty Chris Riotta (@chrisriotta) • November 12, 2024 The United Nations cybercrime treaty has drawn strong objections from Western tech…
In a significant cybersecurity incident, Hot Topic has reportedly experienced a data breach affecting nearly 57 million individuals. This breach has raised alarms within the retail sector, as the company is recognized as a prominent fashion retailer catering to a…
Wiz Reports: Microsoft Attack Using Azure AD Token Forging Technique Has Wider Implications Beyond Outlook
On July 21, 2023, it was revealed that the recent breach of Microsoft’s email services by the Chinese state-sponsored group Storm-0558 is more extensive than initially suspected. According to cloud security firm Wiz, the attack exploited an inactive consumer signing key from Microsoft accounts (MSA) to forge Azure Active Directory (Azure AD) tokens, allowing unauthorized access not just to Outlook Web Access (OWA) and Outlook.com, but potentially to a wide range of Azure AD applications. This includes major platforms like OneDrive, SharePoint, and Teams, as well as customer applications utilizing "Login with Microsoft" features, and certain multi-tenant applications under specific conditions. Wiz’s CTO, Ami Luttwak, emphasized, "Everything in the world of Microsoft leverages Azure Active Directory auth tokens for access," highlighting the far-reaching implications of this vulnerability.
In a recent report by Wiz, a cloud security firm, it has come to light that the recent breach of Microsoft’s email infrastructure by the Chinese state-sponsored group known as Storm-0558 has broader implications than initially perceived. The breach exploited…
Endpoint Security, Fraud Management & Cybercrime, Social Engineering Malware Disguised as Avast Antivirus Detected Prajeet Nair (@prajeetspeaks) • November 12, 2024 Image: Shutterstock The Android SpyNote malware is utilizing a deceptive tactic by posing as an antivirus application to exploit…
Two Georgia Companies Sued Over Data Breaches On November 12, 2024, two companies based in Georgia were hit with a federal lawsuit, accused of inadequately protecting the personally identifiable information of thousands of individuals during a series of data breaches…
On July 25, 2023, Cyber Threat Intelligence revealed that North Korean state-sponsored hackers connected to the Reconnaissance General Bureau (RGB) were linked to the JumpCloud breach due to a significant operational security (OPSEC) error that revealed their IP address. Google’s threat intelligence firm Mandiant has identified this group as UNC4899, which overlaps with known clusters like Jade Sleet and TraderTraitor—hackers notorious for targeting the blockchain and cryptocurrency sectors. Furthermore, UNC4899 shares connections with APT43, another hacking group affiliated with North Korea, previously exposed in March for conducting intelligence-gathering campaigns and stealing cryptocurrency from various companies. Their tactics include employing Operational Relay Boxes (ORBs) using L2TP IPsec tunnels along with commercial VPN services to conceal their identity.
North Korean State-Sponsored Hackers Identified in JumpCloud Breach Due to Operational Security Oversight On July 25, 2023, cybersecurity experts revealed that the recent breach of JumpCloud, a directory-as-a-service provider, has been linked to North Korean state-sponsored hackers associated with the…
Emerging Concerns over Law Enforcement Surveillance Technologies and Implications for Privacy Recent discussions have highlighted the extensive array of tools available to law enforcement agencies, notably facial recognition technologies. Nicole Napolitano, director of research at the Center for Policing Equity,…
