Make the Most of Advanced Threat Detection at No Extra Cost In today’s rapidly evolving cybersecurity landscape, where both rogue actors and well-funded state-sponsored entities continuously devise sophisticated attacks, maintaining relevant and up-to-date detection capabilities is more critical than ever. In Q1 2024, APT groups from various global regions, such as China, North Korea, Iran, […]
Publications In May, our content verification team received more than 300 submissions for review. After the review, and in some cases, repeated revisions with minor corrections to the code, 59 new unique threat detection rules by Threat Bounty Program content authors were successfully published on the Threat Detection Marketplace. Explore Detections The submissions that were […]
The Vermin hacking group, also known as UAC-0020, resurfaces, targeting the Armed Forces of Ukraine. In the latest “SickSync” campaign uncovered by CERT-UA in collaboration with the Cybersecurity Center of the Armed Forces of Ukraine, adversaries once again employ SPECTR malware, which has been part of their adversary toolkit since 2019. SickSync Campaign Targeting the […]
Since the onset of the Russia-Ukraine war in 2022, there has been a significant rise in offensive operations, highlighting the profound impact of geopolitical tensions on global enterprises. Multiple hacking groups continue to use Ukraine as a testing ground to extend their attack surface into European and U.S. political arenas. CERT-UA has been lately reported […]
In mid-April 2024, CERT-UA warned defenders of repeated adversary attempts to compromise Ukrainian organizations using COOKBOX malware. Defenders observed the ongoing phishing campaign targeting Ukraine and took measures to disrupt the offensive attempts. The identified russia-linked malicious activity is tracked under the moniker FlyingYeti and overlaps with the UAC-0149 operation covered in the CERT-UA#9522 alert. […]
Threat actors frequently leverage remote management tools in cyber attacks via the phishing attack vector. For instance, the Remote Utilities software has been largely exploited in offensive campaigns against Ukraine. CERT-UA, in conjunction with CSIRT-NB, has recently identified a targeted cyber attack attributed to the UAC-0188 employing remote management software. Adversaries were observed gaining unauthorized […]
Continuously Stream Selected Detection Content from the SOC Prime Platform to Your GitHub Repository SOC Prime launches integration with GitHub, enabling security engineers to automatically push prioritized detection content directly to a private GitHub repository. By enabling this capability, teams can stream detection algorithms that match predefined criteria and their current security needs to the […]
Defenders have uncovered the increasing malicious activity of the Void Manticore group linked to Iran’s Ministry of Intelligence and Security (MOIS). Adversaries, also known as Storm-842, are behind a series of destructive cyber attacks against Israel. Void Manticore is also tracked under the monikers Homeland Justice and Karma, expanding the scope of its intrusions beyond […]
Heads up! The nefarious cyber-espionage group Kimsuky APT, aka Springtail, enriches its offensive toolkit with a novel malware variant dubbed Linux.Gomir. The novel backdoor, which is considered to be a Linux iteration of the GoBear malware, is leveraged by adversaries in the ongoing cyber attacks against South Korean organizations. Detect Gomir Backdoor Delivered by Kimsuky […]
With the global digitalization of the financial sector, organizations are exposed to escalating risks in numerous sophisticated financially-motivated cyber attacks. Throughout April, cybersecurity researchers have identified a surge in malicious operations attributed to the nefarious russia’s hacking collective known as FIN7 massively targeting organizations worldwide for financial gain. Adversaries have been observed abusing weaponized Google […]