DarkOwl’s Post

Gamaredon, a Russia-linked hacking group, is now targeting mobile devices with two new spyware tools, BoneSpy and PlainGnome. These tools can steal SMS, call logs, location, and even camera photos, focusing on victims in former Soviet states. Find details here: https://lnkd.in/gCk-Zf85

Gamaredon, a Russia-linked hacking group, is now targeting mobile devices with two new spyware tools, BoneSpy and PlainGnome. These tools can steal SMS, call logs, location, and even camera photos, focusing on victims in former Soviet states. Find details here: https://lnkd.in/gCk-Zf85

Gamaredon, a Russia-linked hacking group, is now targeting mobile devices with two new spyware tools, BoneSpy and PlainGnome. These tools can steal SMS, call logs, location, and even camera photos, focusing on victims in former Soviet states. Find details here: https://lnkd.in/gCk-Zf85

Wowwww. A Russian Hacker Group called APT28, known as “Fancybear, Fighting Ursa, or Sofacy) launched a malware named HeadLace via fake luxury car ads to target diplomats.. They used cars like Audi Q7 & Quattro. A Threat Intelligence team at Palo Alto discovered and revealed that APT28 was exploring free amd public services to carry out their attack, like Webhook.site, which is used to create URL’s. Once the ad is clicked, the hackers could send a malicious HTML file that uses a multi-stage infection process. If the system the user is using is not a windows machine, the website redirects it to a decoy image hosted on something called ImgBB.

[#Blog] In this blog post, Volexity analyzes #DISGOMOJI 🔥, Discord-based malware 💀 using emojis for command and control (C2). #DISGOMOJI is used by #UTA0137, a suspected Pakistan-based threat actor. Read the full analysis here: https://lnkd.in/e29aQiZ2   #dfir #threatintel

Another excellent article from the Volexity threat team to my former Indian colleagues and friends. Make sure you invest in proper #nsm and #memoryforensic controls to close endpoint visibility gaps. And last but not least have a proper #threatintel provider

#cyber In case you weren't anxious already...Commercial spyware vendors such as NSO Group, Intellexa, Candiru, and Cy4Gate were the most productive in discovering new exploits to target users on Android, iOS, and browsers on various machines. Google believes in expanding sanctions and restrictions on such companies. Last year, Google observed 97 zero-day vulnerabilities exploited in the wild, over 50 percent more compared to 2022, when 62 vulnerabilities were discovered. The newly discovered zero-days number is not far from the record achieved in 2021 when 106 zero-days roamed the web. And state-sponsored threat actors from China, North Korea, and Russia are now overshadowed by commercial companies that focus on spying. Commercial spyware vendors were behind 75% of known zero-day exploits targeting devices or products from Google and Android, and most of them were also selling spyware capabilities to government customers, according to a combined analysis by Google’s Threat Analysis Group (TAG) and Mandiant. In total, 41.4% of all zero-day exploits were attributed to the so-called commercial surveillance vendors that sell or rent spyware. All government-sponsored cyber actors also had a 41.4% combined share, with the rest of zero-days going to financially motivated hackers.

An analysis of #cyberattack Turla Hackers Weaponizing LNK-Files Turla hackers have targeted Philippine companies and organizations, and to do so, they utilize a hacked media website to distribute malicious code. https://lnkd.in/dftyh8Tu #cybernews #cybercrime #cyneintelligence #cyberthreat #cyneractors

In recent years, elite commercial spyware vendors like Intellexa and NSO Group have developed an array of powerful hacking tools that exploit rare and unpatched “zero-day” software vulnerabilities to compromise victim devices. And increasingly, governments around the world have emerged as the prime customers for these tools, compromising the smartphones of opposition leaders, journalists, activists, lawyers, and others. On Thursday, though, Google's Threat Analysis Group is publishing findings about a series of recent hacking campaigns—seemingly carried out by Russia's notorious APT29 Cozy Bear gang—that incorporate exploits very similar to ones developed by Intellexa and NSO Group into ongoing espionage activity. https://lnkd.in/dNJzsJUu

The FBI warned today that new HiatusRAT malware attacks are now scanning for and infecting vulnerable web cameras and DVRs that are exposed online. https://lnkd.in/eZ_T-Dc8