Cybersecurity

TA402 Uses Complex IronWind Infection Chains to Target Middle East-Based Government Entities  | Proofpoint US

Key takeaways  From July through October 2023, Proofpoint researchers observed TA402 engage in phishing campaigns that delivered a new initial access downloader dubbed IronWind. The downloader was followed by additional stages that consisted of downloaded shellcode.   During the same period, TA402 adjusted its delivery methods, moving from using Dropbox links to using XLL and RAR […]

Cybersecurity

The Importance of Continuous Security Monitoring for a Robust Cybersecurity Strategy

Nov 14, 2023The Hacker NewsPen Testing / Vulnerability Management In 2023, the global average cost of a data breach reached $4.45 million. Beyond the immediate financial loss, there are long-term consequences like diminished customer trust, weakened brand value, and derailed business operations. In a world where the frequency and cost of data breaches are skyrocketing, […]

Cybersecurity

Alert: OracleIV DDoS Botnet Targets Public Docker Engine APIs to Hijack Containers

Nov 14, 2023NewsroomCloud Security / Malware Publicly-accessible Docker Engine API instances are being targeted by threat actors as part of a campaign designed to co-opt the machines into a distributed denial-of-service (DDoS) botnet dubbed OracleIV. “Attackers are exploiting this misconfiguration to deliver a malicious Docker container, built from an image named ‘oracleiv_latest’ and containing Python […]

Cybersecurity

#StopRansomware: Royal Ransomware | CISA

SUMMARY Update November 13, 2023 This CSA is being re-released to add new TTPs, IOCs, and information related to Royal Ransomware activity. End of Update Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware […]

Cybersecurity

Python Malware Poses DDoS Threat Via Docker API Misconfiguration

Security researchers have identified a new cyber-threat targeting publicly exposed instances of the Docker Engine API.  In this campaign, attackers exploit misconfigurations to deploy a malicious Docker container with Python malware compiled as an ELF executable. The malicious tool, functioning as a Distributed Denial of Service (DDoS) bot agent, exhibits various attack methods for conducting […]