Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Most malware security researchers encounter in the wild is written in C or C++. These languages provide low-level system access and control, plus performance, allowing threat actors to create highly efficient and stealthy code. But that doesn’t mean cybercriminals are limited to those two languages. SecurityScorecard recently reverse-engineered the Vjw0rm worm written in JavaScript and the Java-based STRRAT remote access trojan (RAT).

SeroXen is a new Remote Access Trojan (RAT) that showed up in late 2022 and is becoming more popular in 2023. Advertised as a legitimate tool that gives access to your computers undetected, it is being sold for only $30 for a monthly license or $60 for a lifetime bundle, making it accessible.

The US healthcare sector continues to be aggressively targeted by ransomware operators. Royal and BlackCat are two of the more recent – and highly sophisticated – ransomware threats. These two new flavors of ransomware pose serious potential impacts on the healthcare sector, but there are appropriate mitigation and defense strategies that organizations can take to protect against them.

Read also: IT analyst poses as ransomware group to hijack ransom payment, iSpoof founder gets 13 years in prison, and more.

There is still a long way to go in the quest for equal representation in cybersecurity. While Women’s History Month and International Women’s Day are a important catalysts for discussions aimed at addressing the issue, we should not limit efforts to a limited time of the year. It’s a goal we should turn our attention to 365 days of the year.

Whitworth University is a small private Christian university located in Spokane, Washington. The school manages information for more than 3,000 students each year, and all that data was put at risk when the school was hit by a ransomware attack. The unexpected attack caused the students to lose personal data and put them at serious risk of an identity theft attack. This university earns approximately $150 million in revenue annually and maintains a staff of over 720 people.

Polymorphic and metamorphic malware constantly changes itself in order to avoid detection and persistently remain on the system. This adaptive behavior is the main distinctive attribute of these types of malware, which is also why they are harder to detect; it is also why they pose a great threat to systems. On the surface, the functionality of this sort of changing and mutating malware appears the same, but each has its own differences.

The US Cybersecurity and Infrastructure Security Agency (CISA), FBI, and others have issued a joint alert, advising organisations of the steps they should take to mitigate the threat posed by BianLian ransomware attacks. BianLian, which has been targeting different industry sectors since June 2022, is a ransomware developer, deployer and data extortion group which has predominantly targeted enterprises.

Cyber threats are a growing concern for organizations of all sizes. Data breaches, malware infections, and ransomware attacks can severely disrupt operations, including financial loss, reputational damage, and legal liabilities. As a result, it is essential to proactively monitor your environment and identify malicious activity to detect threats before they can cause significant damage.

I’d position the following scenario to you as hypothetical but the reality of it is we have all been there at one time or another. Either as the result of a rogue script, a complete accident, or even malicious behavior, many are familiar with that sinking feeling when you noticed certain Azure Active Directory (Azure AD) objects have been deleted. Whether it be Users, Groups, Enterprise Apps, or Application Registrations, businesses rely on these Azure AD objects.

There’s no denying it, public cloud is here to stay and there’s a pretty good chance that your company is running some workloads on Amazon Web Services.

Kroll’s findings for Q1 2023 highlight fragmented threat actor groups and a continued evolution in attack methods and approaches, which, alongside other key shifts in behavior, have concerning implications for organizations in many sectors. In Q1 2023, Kroll observed a 57% increase in the overall targeting of the professional services sector from the end of 2022.

CISA issues a joint advisory on Russia’s Snake malware operation, hackers use ChatGPT lures to spread malware on Facebook, and a new phishing-as-a-service tool appears in the wild.

Akira is a new family of ransomware, first used in cybercrime attacks in March 2023.

The Cybersecurity and Infrastructure Security Agency (CISA) shared the findings of an investigation by numerous cybersecurity agencies worldwide on May 9th, exposing the malicious cyberespionage operations carried out by the Russian FSB utilizing the “Snake” malware. The US-CERT Alert (AA23-129A) Hunting Russian Intelligence “Snake” Malware provided information about this investigation and takedown (along with attacker TTPs and IOCs).

Kroll Cyber Threat Intelligence analysts have identified a new strain of ransomware, named CACTUS, targeting large commercial entities since March 2023. The name “CACTUS” is derived from the filename provided within the ransom note, cAcTuS.readme.txt, and the self-declared name within the ransom note itself. Encrypted files are appended with.cts1, although Kroll notes the number at the end of the extension has been observed to vary across incidents and victims.

In February 2022, Microsoft disabled VBA macros on documents due to their frequent use as a malware distribution method. This move prompted malware authors to seek out new ways to distribute their payloads, resulting in an increase in the use of other infection vectors, such as password-encrypted zip files and ISO files.

The City of Dallas, Texas, is the ninth largest in the United States currently, with a population of more than 2.6 million people. This massive city was just hit by a substantial ransomware attack by the Royal ransomware gang. The attack interfered with policy response time, 911 services, the police website, the city's court system, and more. With such significant interference occurring in the city's system of government, it's a serious issue for everyone in Dallas.

Software developers build approximately 80% of software applications using open-source code, which opens up a world of opportunity for today’s threat actors. Code package repositories such as npm and RubyGems allow anyone to store or publish packages, and unfortunately that can include packages containing malware. These are known as malicious packages — the malware of the software supply chain. As the name implies, a malicious package is software that is created with malicious intent.

560,000 new pieces of malware are detected daily and over 1 billion malware programs exist currently. The first half of 2022 alone saw 236.7 million ransomware attacks globally with an average cost of $4.54 million per incident. This Blog Includes show Top Malware Attack Statistics Malware statistics 2023 How Many Malware Are Detected Every Day?

CommScope is a massive tech company with more than 30,000 employees. The organization works with companies around the world and helps to establish network infrastructure systems for hospitals, schools, federal agencies, and more. CommScope is based out of Hickory, North Carolina, and has been in business since 1976. The massive company has an annual revenue of 9.23 billion USD and manages substantial networks for businesses throughout the United States.

The annual RSA Conference always brings exciting product innovations, new partnerships, and lots of debate across cybersecurity and risk practitioners, and last week’s event was no different. RSAC comes on the heels of the recently released National Cybersecurity Strategy which outlined heightened security aspirations for technology providers and organizations that maintain personal data.

CrossLock is a ransomware group that emerged in April 2023, targeting a large digital certifier company in Brazil. This ransomware was written in Go, which has also been adopted by other ransomware groups, including Hive, due to the cross-platform capabilities offered by the language. CrossLock operates in the double-extortion scheme, by threatening to leak stolen data on a website hosted on the deep web if the ransom isn’t paid by the victim.

In recent years, especially with hybrid work, almost everyone uses an iOS or Android device for work. In fact, in a recent survey, Lookout found that 92% of remote workers use their personal laptops or smartphones for work tasks, with 46% of them having saved files onto their devices. Now that employees expect to be productive from anywhere, organizations across all industries have become more relaxed with allowing the use of personal devices with bring-your-own-device (BYOD) programs.