C2 Archives - Securezoo

Cuba ransomware attacks on the rise with new exploits

Cybersecurity Articles, Malware, Ransomware, Vulnerabilities & Exploits / Frank Crast / December 4, 2022 / C2, CISA, Cuba, CVE-2020-1472, CVE-2022-24521, FBI, H0lyGh0st, KerberCache, Kerberoasting, LockBit, malware, Ransomware, RomCom, Spy Marketplace, Zeppelin

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have released a joint Cybersecurity Advisory (CSA) with new details regarding Cuba Ransomware attacks.

Cuba ransomware attacks on the rise with new exploits Read More »

H0lyGh0st ransomware actors target small and midsize businesses

Cybersecurity Attacks, Malware, Ransomware / Frank Crast / July 17, 2022 / Andariel, BLTC.exe, BTLC_C.exe, C2, Cybersecurity Threat Center, DarkSeoul, DEV-0530, H0lyGh0st, HolyGhost, HolyLock.exe, HolyRS.exe, Microsoft, MSTIC, North Korea, Plutonium, Ransomware, SiennaBlue, SiennaPurple, Small Business, SMB

Security researchers from Microsoft warn threat actors from North Korea are using H0lyGh0st ransomware to target small and midsize businesses around the globe.

H0lyGh0st ransomware actors target small and midsize businesses Read More »

FontOnLake malware targets Linux systems

Cybersecurity Attacks, Malware / Frank Crast / October 11, 2021 / Boost, C/C++, C2, ESET, FrontOnLake, Linux, malware, Poco, Protobuf, Trojan

A previously unknown malware family dubbed FontOnLake is targeting Linux systems. The malware is made up of “custom and well-designed modules.”

FontOnLake malware targets Linux systems Read More »

Sidewalk backdoor linked to Grayfly espionage group

Cybercrime, Cybersecurity Attacks, Malware, Vulnerabilities & Exploits / Frank Crast / September 13, 2021 / backdoor, C2, ESET, espionage, Exchange, Grayfly, malware, shellcode, Sidewalk

Researchers have recently discovered the Sidewalk modular backdoor has been linked to a Chinese Grayfly espionage group.

Sidewalk backdoor linked to Grayfly espionage group Read More »

Justice Department seizes domains used in Nobelium spear-phishing attacks

Cybersecurity Attacks, Messaging Security, Phishing / Frank Crast / June 2, 2021 / C2, DOJ, Microsoft, MSTIC, Nobelium, phishing, Spearphishing, U.S Department of Justice, USAID

The U.S. Justice Department has announced the seizure of domains used in Nobelium spear-phishing attacks previously identified by Microsoft last week.

Justice Department seizes domains used in Nobelium spear-phishing attacks Read More »

New macOS malware linked to OceanLotus group

Cybersecurity Attacks, Malware / Frank Crast / December 1, 2020 / APT, APT32, C2, macOS, malware, OceanLotus, payload

Security researchers have discovered a new macOS backdoor linked to the OceanLotus hacking group. The new malware variant has added new features such as new behavior and domain names.

New macOS malware linked to OceanLotus group Read More »

SlothfulMedia: new malware variant used by “sophisticated actors”

Malware / Frank Crast / October 2, 2020 / C2, CISA, CNMF, DOD, mediaplayer, RAT, SlothfulMedia

Security experts warned of a new malware variant dubbed SlothfulMedia has been used by a “sophisticated cyber actor.”

SlothfulMedia: new malware variant used by “sophisticated actors” Read More »

GADOLINIUM threat actors use cloud services and open source tools in cyberattacks

Cloud Security, Cybersecurity Articles, Cybersecurity Attacks, Malware / Frank Crast / October 2, 2020 / C2, COVID-19, GADOLINIUM, GitHub, KRYPTON, Microsoft, PowerSHell, ZINC

Security experts from Microsoft have observed a cyber threat actor dubbed GADOLINIUM that uses new attack techniques via cloud services and open source tools.

GADOLINIUM threat actors use cloud services and open source tools in cyberattacks Read More »

NSA and FBI: watch out for Russian malware Drovorub

Cybersecurity Attacks / Frank Crast / August 14, 2020 / APT28, C2, Drovorub, Fancy Bear, FBI, GTsSS, Linux, malware, NSA, rootkit, Russia, STRONTIUM

The National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) have released a joint cybersecurity alert for a new Russian malware dubbed Drovorub.

NSA and FBI: watch out for Russian malware Drovorub Read More »

Doki malware targets exposed Docker servers in the cloud

Cloud Security, Configuration Management, Cybersecurity Attacks / Frank Crast / July 29, 2020 / blockchain, C2, Cloud, Container, Cryptocurrency, Docker, Intezer, Linux, Ngrok

Security researchers at Intezer Labs detected a new Linux malware dubbed “Doki” and cyber attack that uses blockchain wallet for generating command and control (C2) domain names.

Doki malware targets exposed Docker servers in the cloud Read More »