Several domains including New York Times and Twitter attacked by Syrian Electronic Army - AlienVault Labs
AlienVault R&D Labs Portal. Get the latest news from our research. Several domains including New York Times and Twitter attacked by Syrian Electronic Army During the last few hours several domains including the one from The New York Times have been redirected to a Syrian Electronic Army server. Here is the list of domains pointing to that server: Returned 39 RRs in 1.50 seconds. sokiland.fr.nf. A
U.S. Department of Labor website hacked and redirecting to malicious code - AlienVault Labs
AlienVault R&D Labs Portal. Get the latest news from our research. U.S. Department of Labor website hacked and redirecting to malicious code During the last few hours we have identified that the U.S. Department of Labor website has been hacked and it is serving malicious code. As you can see in the following UrlQuery report the website is including code from the malicious server dol[.]ns01[.]us: O
How cybercriminals are exploiting Bitcoin and other virtual currencies - AlienVault Labs
AlienVault R&D Labs Portal. Get the latest news from our research. - What is Bitcoin? Bitcoin is an online descentralised virtual currency based on an open source, P2P protocol. Bitcoins can be transferred using a computer without relying on a financial institution. If you haven’t heard about Bitcoin I recommend you watch the following video: Both the Bitcoin creation and transfer is performed by
New Sykipot developments - AlienVault Labs
Several times the date of the exploit was a few days after the vulnerability had been disclosed and there wasn’t a patch released by the vendor. Campaigns In the past most of the campaigns which we found related to the Sykipot actors were based on SpearPhishing mails with attachments that exploited vulnerabilities in software like Microsoft Office, Adobe Flash, Adobe PDF and some times Internet Ex
A theory on the South Korean attacks - AlienVault Labs
AlienVault R&D Labs Portal. Get the latest news from our research. During the day I’ve been thinking about what have just happened in South Korea. We have published earlier today a quick blog post about how the wiper payload works. It is a very simple piece of code that overwrites the MBR (Master Boot Record) making the affected system unable to start after reboot. Other companies have published i
Information about the South Korean banks and media systems attacks - AlienVault Labs
AlienVault R&D Labs Portal. Get the latest news from our research. As many of you would probably know several South Korean banks and media companies have been affected by an attack that has wiped several systems. It seems the South Korean security company Nshc has published more details on his Facebook Page Based on the samples we collected, the malware overwrites the MBR (Master Boot Record) of t
Yara rules for APT1/Comment Crew malware arsenal - AlienVault Labs
AlienVault R&D Labs Portal. Get the latest news from our research. I’m sure all of you have heard about Mandiant’s APT1 report published yesterday. As many of you probably know we have been tracking and exposing this group for a long time as well as other individuals and companies in the security industry. A couple of examples are: - Win32/Coswid - Unveiling a spearphishing campaign and possible r
Georbot Botnet – A cyber espionage campaign against Georgian Government - Alienvault Labs
Alienvault R&D Labs Portal. Get the latest news from our research. A few days ago, CERT-Georgia published a great report describing a cyber spionage campaign. ESET wrote a great report a few months ago as well. The report said the malware was found in Georgian Governmental Agencies including ministries, parliament, banks, ngo’s. The report also says the purpose of the malware was “Collecting Sensi
CVE-2012-1535: Adobe Flash being exploited in the wild - Alienvault Labs
Alienvault R&D Labs Portal. Get the latest news from our research. Yesterday Adobe issued a security update to address CVE-2012-1535 that was being exploited in the wild. The sample that we analyzed is a Microsoft Office Word document with an embedded malicious Flash file. The name of the malicious doc file is iPhone 5 Battery.doc, md5: 7e3770351aed43fd6c5cab8e06dc0300 The doc file contains an unc
Sykipot is back - Alienvault Labs
This time it seems they are mainly using drive-by-download exploits like CVE-2011-0611 affecting Flash Player or the new Windows XML Core zero-day vulnerability. The CVE-2012-1889 vulnerability is related to Google’s warnings on state-sponsored attacks . Instead of attaching malicious files on e-mails, they send e-mails to the victims with a malicious link. Once the victim clicks on the link the m
More attacks linked to CVE-2012-0158, the evolution of a threat step by step - Alienvault Labs
Alienvault R&D Labs Portal. Get the latest news from our research. More attacks linked to CVE-2012-0158, the evolution of a threat step by step CVE-2012-0158 vulnerability has been one of the main players in the information security scene during the last weeks. Since it was seen in the wild for the first time, attackers have been using it to break the security of specific targets. We have been tra
MS Office exploit that targets MacOS X seen in the wild – delivers “Mac Control” RAT - Alienvault Labs
Alienvault R&D Labs Portal. Get the latest news from our research. MS Office exploit that targets MacOS X seen in the wild – delivers “Mac Control” RAT Continuing our research on Tibet attacks, we have found more Mac trojans and some interesting MS Office files that deliver them. The group behind these attacks is the same we have been tracking for a while: - AlienVault Tibet related Research now
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Flamer Indicators Of Compromise (OpenIOC) - Alienvault Labs