cobalt strike – Page 2 – Computer Security Articles

Credit to Author: Threat Intelligence Team| Date: Wed, 13 Jul 2022 16:17:09 +0000

While the war in Ukraine still rages, various threat actors continue to launch cyber attacks against its government entities. In this blog we review the latest campaign from the UAC-0056 threat group.

The post Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign appeared first on Malwarebytes Labs.

Security Sophos

Telerik UI exploitation leads to cryptominer, Cobalt Strike infections

June 15, 2022 admin cobalt strike, cryptomining, cve-2017-11357, cve-2017-1137, cve-2019-18935, Powershell, security operations, SophosLabs Uncut, telerik, threat research, XMRig

Credit to Author: Matt Wixey| Date: Wed, 15 Jun 2022 11:00:05 +0000

Attacker targets bugs in a popular web application graphical interface development tool

MalwareBytes Security

Karakurt extortion group: Threat profile

June 14, 2022 admin accenture security, advanced intel, anydesk, chainalysis, cirt, cisa, cobalt strike, conti ransomware, cyber incident response team, cybercrime, cybersecurity and infrastructure security agency, diavol, diavol ransomware, dridex, evil corp., FBI, Federal Bureau of Investigation, filezilla, karakurt, karakurt extortion group, karakurt lair, karakurt team, kimberly goody, Mandiant, mega.io, mfa, Mimikatz, multi-factor authentication, ncc, ransomhouse, ransomware, ransomware syndicate, rclone, tetra defense, virtual private network, VPN, Wall Street Journal

Credit to Author: Jovi Umawing| Date: Tue, 14 Jun 2022 16:00:29 +0000

An obscure group called Karakurt has extorted organizations in the US and elsewhere. Know how to keep it away from your network.

The post Karakurt extortion group: Threat profile appeared first on Malwarebytes Labs.

Security Sophos

The Active Adversary Playbook 2022

June 7, 2022 admin active adversary, artifacts, attack tools, cobalt strike, cryptomining, cyberattacks, cyberthreats, dwell time, exploit, Featured, initial access broker, malware delivery system, MITRE, proxylogon, proxyshell, ransomware, Ransomware as a Service, security operations, sophos rapid response, Vulnerability

Credit to Author: Tilly Travers| Date: Tue, 07 Jun 2022 11:02:43 +0000

Cyberattacker behaviors, tactics and tools seen on the frontline of incident response during 2021

MalwareBytes Security

[updated]Unpatched Atlassian Confluence vulnerability is actively exploited

June 3, 2022 admin atlassian, behinder, China Chopper, cobalt strike, confluence, cve-2022-26134, Exploits and vulnerabilities, Meterpreter, Web Shell

Credit to Author: Pieter Arntz| Date: Fri, 03 Jun 2022 14:41:58 +0000

A vulnerability in Atlassian Confluence was found by performing an incident response investigation on a compromised server. The vulnerability is not yet patched.

The post [updated]Unpatched Atlassian Confluence vulnerability is actively exploited appeared first on Malwarebytes Labs.

MalwareBytes Security

Unpatched Atlassian Confluence vulnerability is actively exploited

June 3, 2022 admin atlassian, behinder, China Chopper, cobalt strike, confluence, cve-2022-26134, Exploits and vulnerabilities, Meterpreter, Web Shell

Credit to Author: Pieter Arntz| Date: Fri, 03 Jun 2022 14:41:58 +0000

A vulnerability in Atlassian Confluence was found by performing an incident response investigation on a compromised server. The vulnerability is not yet patched.

The post Unpatched Atlassian Confluence vulnerability is actively exploited appeared first on Malwarebytes Labs.

Independent Krebs

Conti Ransomware Group Diaries, Part III: Weaponry

March 4, 2022 admin A Little Sunshine, alarm, bentley, bio, bloodrush, chainalysis, cobalt strike, conti, grant, kaktus, lemans corporation, Ne'er-Do-Well News, pin, ransomware, reshaev, revers, salamandra, skippy, the spaniard, tramp, trickbotleaks, Trump

Credit to Author: BrianKrebs| Date: Fri, 04 Mar 2022 20:20:29 +0000

Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what it’s like to be an employee of Conti’s sprawling organization. Today’s Part III looks at how Conti abused a panoply of popular commercial security services to undermine the security of their targets, as well as how the team’s leaders strategized for the upper hand in ransom negotiations with victims.

Security Sophos

Conti and Karma actors attack healthcare provider at same time through ProxyShell exploits

February 28, 2022 admin bazar, cobalt strike, conti, Featured, karma, proxyshell, ransomware, SophosLabs Uncut, threat research

Credit to Author: gallagherseanm| Date: Mon, 28 Feb 2022 12:30:19 +0000

An unpatched Microsoft Exchange Server let both ransomware actors in; Karma just stole data, while Conti encrypted.