REPORT BREACH
admin

admin

  • Joined: September 10, 2024
  • Articles: 1058

BlueBravo Targets European Diplomats with GraphicalProton Backdoor July 28, 2023 Cyber Espionage / Malware The Russian state-sponsored group known as BlueBravo has been detected attacking diplomatic entities in Eastern Europe with the intent of deploying a new backdoor malware dubbed GraphicalProton. This move highlights the ongoing evolution of cyber threats, according to a recent report from Recorded Future. The phishing campaign, active from March to May 2023, employs legitimate internet services (LIS) to obscure command-and-control (C2) activities. BlueBravo, also referred to as APT29, Cloaked Ursa, and Midnight Blizzard (formerly Nobelium), is linked to Russia’s Foreign Intelligence Service (SVR) and has historically utilized platforms like Dropbox, Firebase, Google Drive, Notion, and Trello to bypass detection and maintain covert communication with compromised systems. GraphicalProton marks the latest in a series of malware targeting diplomatic organizations, following GraphicalNeutrino (SNOWYAMBER), HALFRIG, and QUARTERRIG.

BlueBravo Deploys GraphicalProton Backdoor Targeting European Diplomatic Entities On July 28, 2023, reports emerged detailing a sophisticated cyber espionage campaign orchestrated by the Russian state-sponsored group known as BlueBravo. This threat actor has turned its focus towards diplomatic institutions located…

Title: Exploring a Data Exfiltration Attack: Insights from the Porsche Experience Date: July 28, 2023 Category: Cyber Attack / Vulnerability In line with Checkmarx’s mission to enhance secure software development, our Security Research team examined the security measures of prominent car manufacturers. Given Porsche’s comprehensive Vulnerability Reporting Policy, we chose to focus our research there. Our investigation uncovered a potential attack scenario stemming from the combination of security vulnerabilities identified across various Porsche assets, including a website and a GraphQL API, which could facilitate data exfiltration. Data exfiltration poses a significant threat to any business or organization, regardless of its size, as it can lead to severe consequences when malicious individuals gain unauthorized access to sensitive data. Porsche maintains a varied online presence, featuring numerous microsites, websites, and web applications, with The Porsche Experience being one such platform that caters to registered users.

Data Exfiltration Attack Scenario: The Porsche Experience July 28, 2023 In recent investigations aimed at assessing the security frameworks of major automotive manufacturers, the Security Research team at Checkmarx has focused its attention on Porsche. Recognized for its robust Vulnerability…

Malicious Python Package Steals AWS Credentials

Security Operations Developers’ Credentials Compromised Through Typosquatted ‘Fabric’ Library Prajeet Nair (@prajeetspeaks) • November 11, 2024 Image: Shutterstock A deceptive Python package, masquerading as a popular SSH automation library, has been active on the PyPi repository since 2021. This malicious…

STARK#MULE Cyber Campaign Targets Korean Speakers with U.S. Military-Themed Malware Documents

July 28, 2023
Cyber Attack / Malware

A persistent cyber attack campaign identified as STARK#MULE is aimed at Korean-speaking individuals, using U.S. Military-themed documents to lure victims into executing malware on compromised systems. Cybersecurity firm Securonix has been monitoring this activity, though the full extent of the attacks remains unclear and it is unknown if any of them have successfully compromised systems. Security researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov noted in a report shared with The Hacker News that these attacks are reminiscent of previous ones linked to North Korean groups like APT37, which has historically targeted South Korea, particularly its government officials. APT37, also known by various aliases including Nickel Foxcroft, Reaper, Ricochet Chollima, and ScarCruft, is recognized as a North Korean state-sponsored actor focused on southern targets.

STARK#MULE Targets Koreans with U.S. Military-Themed Document Lures In a notable development in cyber threats, a new campaign has emerged targeting Korean-speaking individuals through the use of U.S. military-themed documents designed to deliver malware. Cybersecurity experts from Securonix have named…