Cybersecurity News - Page 10

The agencies warned that APTs regularly target critical infrastructure to gather intelligence and gain long-term access to networks.

After gaining access, the attackers use PowerShell scripts to identify antivirus and endpoint detection tools, collect system information and other data.

The attackers often install more than one RMM tool on the same device to have backup access if one program is detected and removed.

The activity is similar to past router-based FrostArmada attacks linked to the Russian hacking group APT28, also known as Fancy Bear.

The exposed directories also contained Windows and Linux versions of a previously undocumented Go-based malware implant called Hades.

In brief: The UTA0533 group caught exploiting SonicWall 0days, Russian hackers abuse a critical Zimbra flaw, and more.

Updated Matchboil variant now uses WinRAR to extract downloaded files and can retrieve the utility from Dropbox if it is missing.

Attackers began targeting vulnerable systems shortly after a proof-of-concept (PoC) exploit was released publicly.

Law enforcement seized more than 200 servers and arrested the platform's developer.

Researchers linked the activity to a threat actor believed to be operating from East Asia.