Zhruba polovina Čechů plánuje nákup kryptoměn, ale třetina z nich podceňuje kybernetická rizika. Nový průzkum ESET ukazuje, že lidé se obávají podvodů a útoků, ale mnozí nevědí, jaká rizika to mohou být. Jak se chránit před kybernetickými hrozbami při investicích do kryptoměn? Přečtěte si více o aktuálních trendech a doporučeních pro bezpečné investování! #Kryptoměny #Kyberbezpečnost #ESET

Více informací najdete zde:
https://tiskovec.cz/clanky/pruzkum-eset-cesi-chteji-nakupovat-kryptomeny-podcenuji-ale-kyberneticka-rizika?utm_source=mastodon_czech&utm_medium=social&utm_campaign=new_article

https://www.europesays.com/de/18530/ ToddyCat: Malware nutzt Sicherheitsleck in Antivirensoftware #Antivirus #Deutschland #Eset #Germany #IT #Kaspersky #Malware #Science #Science&Technology #Security #Sicherheitslücken #Sicherheitsupdates #Technik #Technology #Virus #Wissenschaft #Wissenschaft&Technik

How ToddyCat tried to hide behind AV software

The ToddyCat APT group has developed a sophisticated tool called TCESB to stealthily execute payloads and evade detection. This tool exploits a vulnerability (CVE-2024-11859) in ESET Command line scanner for DLL proxying, using a modified version of the open-source EDRSandBlast malware. TCESB employs techniques like DLL proxying, kernel memory manipulation, and Bring Your Own Vulnerable Driver (BYOVD) to bypass security solutions. It searches for kernel structure addresses using CSV or PDB files, installs a vulnerable Dell driver, and decrypts AES-128 encrypted payloads. The discovery highlights the need for monitoring driver installations and Windows kernel debug symbol loading events to detect such sophisticated attacks.

Pulse ID: 67f3cb12758e286216442770
Pulse Link: https://otx.alienvault.com/pulse/67f3cb12758e286216442770
Pulse Author: AlienVault
Created: 2025-04-07 12:54:42

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Shifting the sands of RansomHub's EDRKillShifter

ESET researchers analyze the ransomware ecosystem in 2024, focusing on the newly emerged RansomHub gang. They uncover connections between RansomHub affiliates and rival gangs Play, Medusa, and BianLian through the use of EDRKillShifter, a custom EDR killer developed by RansomHub. The researchers leverage the widespread adoption of EDRKillShifter to track affiliate activities across multiple gangs and reconstruct its development timeline. The article also discusses the rise of EDR killers in ransomware attacks and provides insights into their anatomy and defense strategies. Despite disruptions to major ransomware groups, new threats like RansomHub quickly filled the void, highlighting the need for continued vigilance and law enforcement efforts targeting both operators and affiliates.

Pulse ID: 67e5309c175c81db27157632
Pulse Link: https://otx.alienvault.com/pulse/67e5309c175c81db27157632
Pulse Author: AlienVault
Created: 2025-03-27 11:03:56

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

You will always remember this as the day you finally caught FamousSparrow

ESET researchers uncovered new activity by the FamousSparrow APT group, including two undocumented versions of their SparrowDoor backdoor. The group compromised a US financial sector trade group and a Mexican research institute in July 2024. The new SparrowDoor versions show significant improvements in code quality and architecture, implementing command parallelization. FamousSparrow also used the ShadowPad backdoor for the first time. The analysis revealed links between FamousSparrow and other China-aligned threat actors like Earth Estries. The group's continued development of tools during a period of apparent inactivity suggests they remained active but undetected from 2022 to 2024.

Pulse ID: 67e460646f872ac59c466323
Pulse Link: https://otx.alienvault.com/pulse/67e460646f872ac59c466323
Pulse Author: AlienVault
Created: 2025-03-26 20:15:32

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Operation FishMedley targeting governments, NGOs, and think tanks

ESET researchers have uncovered a global espionage operation called Operation FishMedley, conducted by the FishMonger APT group, which is operated by the Chinese contractor I-SOON. The campaign targeted governments, NGOs, and think tanks across Asia, Europe, and the United States during 2022. The attackers used implants like ShadowPad, SodaMaster, and Spyder, which are common or exclusive to China-aligned threat actors. The operation involved sophisticated tactics including lateral movement, credential theft, and custom malware deployment. Seven victims were identified across various countries and sectors. The analysis provides technical details on the malware used, initial access methods, and command and control infrastructure.

Pulse ID: 67dd406f6ba9eecd280aa95e
Pulse Link: https://otx.alienvault.com/pulse/67dd406f6ba9eecd280aa95e
Pulse Author: AlienVault
Created: 2025-03-21 10:33:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Tecnologia Falso CapCut con IA, instala software espía #Virus #Software #ESET
https://enter504.com/falso-capcut-con-ia-instala-software-espia/

#ESET recommends installing #Linux if your unsupported #Windows 11 PC can't update from 10

https://www.neowin.net/amp/eset-recommends-installing-linux-if-your-unsupported-windows-11-pc-cant-update-from-10/

Latest issue of my curated #cybersecurity and #infosec list of resources for week #42/2024 is out!

It includes the following and much more:

➝ #Cisco Investigating #Breach;

➝ Data from #Verizon's push-to-talk System for Sale;

➝ #Gmail Alert For 2.5B Users As #AI Hack Confirmed;

➝ Dark Web Shut Down in Finland;

➝ #Microsoft Lost Cloud Security Logs;

➝ #ESET Breached;

Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end

https://infosec-mashup.santolaria.net/p/infosec-mashup-422024?r=299go8&utm_campaign=post&utm_medium=web

Die Branche der Schlangenölverkäufer scheint wirklich verzweifelt!

Between #crowdstrike and grindr’s Republican Party issues… every is probably running Linux right now. Everyone IT team is on overtime. EVERYONE updating that #eSet. I can feel it. lolz.