All articles tagged with #cyber espionage
The EU has blacklisted members of Russia’s FSB-led Turla cyber espionage group for years of hacking and spying across Europe and Ukraine, targeting governments and critical infrastructure; the sanctions include travel bans and asset freezes on individuals and entities such as AST and NPP Gamma, with the UK also imposing penalties.
The DarkSpectre threat actor, linked to China, has exposed a series of malicious browser extensions across Chrome, Edge, and Firefox, affecting over 8.8 million users worldwide. These extensions, including ShadyPanda, GhostPoster, and The Zoom Stealer, are designed for data theft, corporate espionage, and meeting information harvesting, often masquerading as legitimate tools for video conferencing and utilities. The campaigns have been active for over seven years, with some extensions still in the trust-building phase, posing significant risks to user privacy and corporate security.
China's Ministry of State Security has become a major cyber power, conducting sophisticated operations like the Salt Typhoon intrusion, which stole data from numerous countries, highlighting its strategic cyber capabilities and the leadership's focus on technological and cyber espionage advancements under Xi Jinping.
The FBI has issued a warning that a Chinese hacking campaign has expanded its reach to 80 countries, highlighting a significant global cybersecurity threat and ongoing cyber espionage activities.
North Korea's APT37 group is using sophisticated malware embedded in JPEG images and leveraging steganography to evade detection and attack Windows systems, primarily in South Korea. The malware employs multi-stage shellcode injection, fileless techniques, and cloud API abuse for command and control, highlighting the need for advanced behavioral detection and proactive security measures.
Microsoft announced that a cyber-espionage group called Storm-2603 is exploiting vulnerabilities in SharePoint server software to deploy ransomware, leading to at least 400 known victims including U.S. government agencies, marking a significant escalation in the campaign.
Microsoft knew of a critical SharePoint security flaw identified in May but released a patch that failed to fully fix it, leading to a global cyber espionage operation targeting around 100 organizations, with Chinese hacking groups exploiting the vulnerability despite Microsoft's efforts to patch it.
The article discusses the emerging risks associated with advancing quantum technology, highlighting potential threats to cybersecurity and the possibility of a 'cyber doomsday' scenario as these technologies become more prevalent.
Chinese state-sponsored group APT41 exploited Google Calendar for malware C2 operations, using a sophisticated multi-stage malware to target government entities and organizations worldwide, with Google taking measures to neutralize the campaign.
A Chinese hacking group known as "Salt Typhoon" has stolen a significant amount of Americans' metadata in a cyber-espionage campaign, according to a senior US official. The hackers targeted multiple telecommunications companies, including Verizon, AT&T, and T-Mobile, although some companies reported no customer data compromise. The stolen metadata, which includes call records but not content, can reveal detailed personal information. The US government, prioritizing the issue, has briefed President Biden and held a classified briefing for senators on the matter.
A Russian hacking group, identified as "RomCom," has exploited two zero-day vulnerabilities to target Firefox and Tor browser users on Windows PCs, primarily in Europe and North America. The attacks, which began in October, involve a malicious web page that installs a backdoor on victims' PCs without user interaction. The vulnerabilities, CVE-2024-9680 and CVE-2024-49039, have been patched by Mozilla, Tor, and Microsoft. However, users who haven't updated remain at risk. ESET links these attacks to RomCom's previous exploits.
Chinese hackers are reportedly embedding themselves in U.S. critical infrastructure to gain an advantage in potential conflicts, according to Morgan Adamski of U.S. Cyber Command. This follows a significant cyberespionage operation, "Salt Typhoon," which targeted U.S. telecommunications, compromising call records and communications of key officials. The Chinese government denies involvement, and the Chinese Embassy has not commented on the allegations.
Russian military hackers, part of the GRU, have developed a novel Wi-Fi hacking technique called a "nearest neighbor attack," allowing them to breach networks remotely without leaving Russian soil. This method involves hacking into a nearby network and using its devices to access the target network, as discovered by cybersecurity firm Volexity during a 2022 investigation in Washington, DC. The attack highlights the evolving threat of cyber espionage and the need for enhanced Wi-Fi security measures.
T-Mobile has been targeted by a cyber-espionage campaign linked to Chinese state-sponsored hackers known as Salt Typhoon, which also affected other major U.S. telecom providers. The breach focused on wiretap systems used for law enforcement surveillance, compromising sensitive communications involving high-ranking U.S. officials. While T-Mobile reports no significant impact on customer data, the incident underscores vulnerabilities in the telecommunications sector and the need for enhanced security measures. T-Mobile is collaborating with federal authorities to address the breach.
T-Mobile was among several telecommunications companies targeted in a Chinese cyber-espionage operation, according to The Wall Street Journal. Hackers linked to a Chinese intelligence agency breached T-Mobile's network to spy on high-value intelligence targets. While T-Mobile claims no significant impact on its systems or customer data, the FBI and CISA reported that China-linked hackers intercepted surveillance data from U.S. telecom companies. Beijing has denied these hacking allegations.