Cybercrime & Digital Threats

The Sodinokibi ransomware ended the year with a bang by launching a new round of attacks aimed at multiple organizations, including the Albany International Airport and the foreign exchange company Travelex.

The cryptocurrency-miner, a multi-component threat comprised of different Perl and Bash scripts, miner binaries, the application hider Xhide, and a scanner tool, propagates by scanning vulnerable machines and brute-forcing (primarily default) credentials.

As the new year rolls in, new developments in different ransomware strains have emerged. Here we discuss the different techniques that Clop, DeathRansom, and Maze ransomware use and the ways users and organizations can protect themselves against infection.

Financial applications are closely connected or even directly tied to a user’s finances, making them prime targets for cybercriminals. We provide simple steps and guidelines on how to protect mobile banking apps from common scams and malicious actors.

We take a closer look at an incident involving the MyKings botnet to show how the MITRE ATT&CK framework helps with threat investigation.

The city of Frankfurt, Germany, became the latest victim of Emotet after an infection forced it to close its IT network.

We have recently spotted a Negasteal/Agent Tesla variant (detected by Trend Micro as Worm.Win32.NEGASTEAL.B) that uses a new delivery vector: removable drives.

We listed a rundown of PoCs and real-life attacks where machine learning was weaponized to get a clearer picture of what is possible and what is already a reality with regard to machine learning-powered cyberthreats.

Multiple government procurement services were targeted by a credential harvesting campaign that uses bogus pages to steal login credentials.