Cybersecurity News - Page 302

The Ragnarok ransomware operation has been active since at least January 2020.

The ProxyShell vulnerabilities allow attackers to elevate privileges on the Exchange PowerShell backend and perform unauthenticated, remote code execution.

Written in C++, the Sardonic backdoor allows its operators to collect system information, execute arbitrary commands, and load and execute additional plugins.

The new APT is believed to have ties with a well-known Winnti Group hacker collective.

The Triada trojan can download additional malware, launch ads, issue subscriptions, and intercept a user’s SMSs.

The attacks, believed to have been orchestrated by LULU, a threat actor linked to the government of Bahrain, targeted nine Bahraini activists between June 2020 and February 2021.

The cybercriminal group conducted ransomware attacks since November 2020.

The ransomware operators claim to have stolen 250 GB of data from the company.

The researchers noticed that one of the flaws (CVE-2021-35395) has been exploited in the wild to spread a Mirai variant.

Exposed data includes COVID-19 vaccination records, social security numbers and email addresses tied to 47 entities, including American Airlines, Ford, and Microsoft.