News

24 Results / Page 2 of 3

Background
Mjolnir Security Torri Botnet IOC

todaySeptember 29, 2018

  • 43
close

Business + News + Malware + Botnet + Exploits + Threat Intelligence + IoT Mjolnir Security

Torii Botnet

Security researchers at Avast have discovered a new malware strain that uses comes with a quite rich set of features for exfiltration of (sensitive) information, modular architecture capable of fetching and executing other commands and executables and all of it via multiple layers of encrypted communication named Torii. We have already ...

Hidden Cobra Mjolnir Security

todayMay 30, 2018

  • 23
close

News + Malware + APT + Threat Intelligence Mjolnir Security

North Korean Malicious Cyber Activity: HIDDEN COBRA – Joanap Backdoor Trojan and Brambul Server Message Block Worm

Backdoor.Joanap is a malicious program which is developed by cyber criminals to gain illegal income. It uses several stealthy ways to get inside the targeted computer and after successful invasion it carry out several malicious activities. According to a research this malware hides its executable in INI and CNF files ...

todayMay 23, 2018

  • 14
close

IoT + News + Malware + Botnet + Threat Intelligence Mjolnir Security

VPNFilter Malware targets over half a million networking devices worldwide

A new malware known as VPNFilter capable of targeting a range of routers and NAS devices rendering infected devices unusable and also capable of maintaining a persistent presence on an infected device, even after a reboot. VPNFilter has a range of capabilities including spying on traffic being routed through the ...

todayJanuary 4, 2018

  • 59
close

Backdoor + Business + News + Exploits Mjolnir Security

Meltdown and Spectre – coming to a PC or Cloud Server near you

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in ...

todayDecember 15, 2017

  • 16
close

APT + Exploits + Backdoor + Threat Intelligence + Breach + SCADA + Business + News + Malware Mjolnir Security

New ICS Attack Framework “TRITON” targeting Critical Infrastructure

Mandiant recently responded to an incident at a critical infrastructure organization where an attacker deployed malware designed to manipulate industrial safety systems. The targeted systems provided emergency shutdown capability for industrial processes. We assess with moderate confidence that the attacker was developing the capability to cause physical damage and inadvertently shutdown operations. This malware, which we call TRITON, is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. We have not attributed the incident to a threat actor, though we believe the activity is consistent with a nation state preparing for an attack. TRITON is one of a limited number of publicly identified malicious software families targeted at industrial control systems (ICS). It follows Stuxnet which was used against Iran in 2010 and Industroyer which we believe was deployed by Sandworm Team against Ukraine in 2016. TRITON is consistent with these attacks, in that it could prevent safety mechanisms from executing their intended function, resulting in a physical consequence. Malware Family Main Modules Description TRITON trilog.exe Main executable leveraging libraries.zip library.zip Custom communication library for interaction with Triconex controllers. Table 1: Description of TRITON Malware Incident Summary The attacker gained remote access to an SIS engineering workstation and deployed the TRITON attack framework to reprogram the SIS ...

todayDecember 15, 2017

  • 10
close

News + Malware + Ransomware + Backdoor + Threat Intelligence + Breach Mjolnir Security

Remote Desktop Server Owners beware, new HC7 GOTYA Ransomware Installed via Remote Desktop Services

There was a time when most Server Administrations/Network Administrators would just change the port 3389 to any other and/or change default login username to a RDP server and assume its secure. While this may best practice, it doesnt really help as a simple nmap scan reveals the listening port and ...