Lifeboat Foundation

Threat actors are increasingly mimicking legitimate applications like Skype, Adobe Reader, and VLC Player as a means to abuse trust relationships and increase the likelihood of a successful social engineering attack.

Other most impersonated legitimate apps by icon include 7-Zip, TeamViewer, CCleaner, Microsoft Edge, Steam, Zoom, and WhatsApp, an analysis from VirusTotal has revealed.

“One of the simplest social engineering tricks we’ve seen involves making a malware sample seem a legitimate program,” VirusTotal said in a Tuesday report. “The icon of these programs is a critical feature used to convince victims that these programs are legitimate.”

Security researchers found a new service called Dark Utilities that provides an easy and inexpensive way for cybercriminals to set up a command and control (C2) center for their malicious operations.

The Dark Utilities service provides threat actors a platform that supports Windows, Linux, and Python-based payloads, and eliminates the effort associated with implementing a C2 communication channel.

A C2 server is how adversaries control their malware in the wild, sending out commands, configurations and new payloads, and receiving data collected from compromised systems.

On Monday, hackers exploited a basic vulnerability in the code of Nomad — a crypto “bridge” that allows customers to transfer cryptocurrencies between different blockchains — getting away with roughly $190 million in user investments, CNBC reports.

This hack is just the latest in a string of attacks on crypto bridges, platforms that, according to CNBC, have collectively lost more than $1 billion to hackers in 2022 alone.

Given that Nomad markets itself as a “secure” platform, the company definitely has a lot of explaining to do.

One of the primary methods used by malware distributors to infect devices is by deceiving people into downloading and running malicious files, and to achieve this deception, malware authors are using a variety of tricks.

Some of these tricks include masquerading malware executables as legitimate applications, signing them with valid certificates, or compromising trustworthy sites to use them as distribution points.

According to VirusTotal, a security platform for scanning uploaded files for malware, some of these tricks are happening on a much larger scale than initially thought.

Researchers have reported the discovery of an exoplanet orbiting Ross 508 near the inner edge of its habitable zone.

Researchers have uncovered a list of 3,207 mobile apps that are exposing Twitter API keys in the clear, some of which can be utilized to gain unauthorized access to Twitter accounts associated with them.

The takeover is made possible, thanks to a leak of legitimate Consumer Key and Consumer Secret information, respectively, Singapore-based cybersecurity firm CloudSEK said in a report exclusively shared with The Hacker News.

Continue reading “Researchers Discover Nearly 3,200 Mobile Apps Leaking Twitter API Keys” »

A 24-year-old Australian hacker has been charged with developing and selling the “Imminent Monitor” spy software to more than 14,500 people.

Critical Security Vulnerabilities In Netgear Business Routers Which The Netgear Team Can’t Fix. Stop Using These Routers As Soon As Possible — Vulnerabilities — Information Security Newspaper | Hacking News.

Vulnerabilities — information security newspaper | hacking news.

A Sentinel One investigation revealed threat actors (TA) have been abusing the Windows Defender command line tool to decrypt and load Cobalt Strike payloads.

The cybersecurity experts detailed their findings in an advisory last week, in which they said the TA managed to carry out the attacks after obtaining initial access via the Log4Shell vulnerability against an unpatched VMware Horizon Server.

The attackers reportedly modified the Blast Secure Gateway component of the application by installing a web shell using PowerShell code.

The findings reportedly uncovered 475 web pages of elaborate ransomware products and services, alongside many high-profile groups aggressively marketing ransomware-as-a-service (RAAS).

Forensic Pathways also identified 30 different “brands” of ransomware, with some known names such as BlackCat, Egregor, Hidden Tear and WannaCry having been successfully used in high-profile attacks.

The research also suggested Ransomware strains used in high-profile attacks command a higher price for associated services.