пятница, 26 мая 2023 г.

Hacker Group 'Moses Staff' Using New StrifeWater RAT In Ransomware Attacks

 


A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.

Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."

"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."

Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.

The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.


To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.

The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.

The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.

StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.

"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."

Related links


Автор: на Комментариев нет:

четверг, 25 мая 2023 г.

Press Release - This Is Cthulhu Wars Duel & Extinction!

Support me on Patreon!


This is Cthulhu Wars Duel & Extinction!
Petersen Games is happy to announce the reprint release of Cthulhu Wars Duel and the new release of Cthulhu Wars Duel: Extinction, available for purchase at https://petersengames.com/cthulhu-wars-duel/


This is Cthulhu Wars Duel!

Cthulhu Wars Duel is a fast-moving, two-player strategy game in which you play as Great Cthulhu himself or the Black Goat, a cosmic goddess of hideous fertility. Each side is strikingly different with unique units, abilities and strategies available.



Cthulhu Wars Duel Extinction is a stand-alone expansion to the core game. You play as The Sleeper, primordial god of slumber and hunger, or Ithaqua, the Windwalker, god of outer space and all that is coldest and darkest. Each side is strikingly different with unique units, abilities, and strategies available.

Cthulhu Wars Duel Extinction is fully compatible with the original Cthulhu Wars Duel game. Both are standalone products, but Factions and Maps can be mixed and matched in any combination!




Did you like this press release?  Show your support: Support me on Patreon! Also, click the heart at Board Game Links , like GJJ Games on Facebook , or follow on Twitter .  And be sure to check out my games on  Tabletop Generation.

Автор: на Комментариев нет:

понедельник, 8 мая 2023 г.

<> Cheap Country Targeted website traffic <>

Hi there
Receive local traffic to increase local audience and leads through your
website

more details and plans can be found here
https://bulkwebtraffic.io/


thanks and regards
Peter Wallace




Unsubscribe:
https://mgdots.co/unsubscribe/
Автор: на Комментариев нет:

пятница, 10 марта 2023 г.

<> NEW! Social SEO <>

Hi,

Get some SEO action with the latest Social SEO Strategy, our Social Signals
Boost, which will improve your ranks in just 1 week, safely and permanently

check more details about our plans here
https://buysocialsignals.co/buy-social-signals/









Unsubscribe:
https://mgdots.co/unsubscribe/
Автор: на Комментариев нет:

суббота, 31 декабря 2022 г.

<> NEW! Social SEO <>

Hello

Get some SEO action with the latest Social SEO Strategy, our Social Signals
Boost, which will improve your ranks in just 1 week, safely and permanently

check more details about our plans here
https://realsocialsignals.co/buy-social-signals/









Unsubscribe:
https://mgdots.co/unsubscribe/
Автор: на Комментариев нет:

среда, 26 октября 2022 г.

<> cheap whitehat monthly SEO Plans <>

Hello

I`ve just checked your website and saw that it could really use a boost

if you ever should choose to consider a SEO strategy for your website,
kindly check our plans here
https://www.cheapseoagency.co/cheap-seo-packages/

thanks and regards
Cheap SEO Agency









Unsubscribe:
https://mgdots.co/unsubscribe/
Автор: на Комментариев нет:

суббота, 6 августа 2022 г.

Ethical hacking : Top 14 best websites to learn hacking 2018

  • SecTools.Org: List of 75 security tools based on a 2003 vote by hackers.
  • SecurityFocus: Provides security information to all members of the security community, from end users, security hobbyists and network administrators to security consultants, IT Managers, CIOs and CSOs.
  • The Hacker News: The Hacker News — most trusted and widely-acknowledged online cyber security news magazine with in-depth technical coverage for cybersecurity.
  • Phrack Magazine: Digital hacking magazine.
  • Black Hat: The Black Hat Briefings have become the biggest and the most important security conference series in the world by sticking to our core value: serving the information security community by delivering timely, actionable security information in a friendly, vendor-neutral environment.
  • KitPloit: Leading source of Security Tools, Hacking Tools, CyberSecurity and Network Security.
  • Exploit DB: An archive of exploits and vulnerable software by Offensive Security. The site collects exploits from submissions and mailing lists and concentrates them in a single database.
  • Hakin9: E-magazine offering in-depth looks at both attack and defense techniques and concentrates on difficult technical issues.
  • Packet Storm: Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers.
  • DEFCON: Information about the largest annual hacker convention in the US, including past speeches, video, archives, and updates on the next upcoming show as well as links and other details.
  • Metasploit: Find security issues, verify vulnerability mitigations & manage security assessments with Metasploit. Get the worlds best penetration testing software now.
  • Hacked Gadgets: A resource for DIY project documentation as well as general gadget and technology news.
  • HackRead: HackRead is a News Platform that centers on InfoSec, Cyber Crime, Privacy, Surveillance, and Hacking News with full-scale reviews on Social Media Platforms.
  • NFOHump: Offers up-to-date .NFO files and reviews on the latest pirate software releases.
Автор: на Комментариев нет:
Подписаться на: Сообщения (Atom)