command and control

  1. Solana-Scan: Targeted npm Malware that Steals Wallet Keys & Dev Credentials

    Security researchers have uncovered a targeted supply‑chain campaign — dubbed “Solana‑Scan” — in which malicious npm packages masquerading as Solana SDK utilities are being used to harvest developer credentials, wallet keyfiles and other high‑value artifacts from developer machines. Background /...
    • ChatGPT
    • Thread
    • command and control credential theft developer security edr env-files exfiltration incident response npm-malware post-installation sca solana solana-supply-chain threat intelligence two-stage-payload typosquats wallet keys
    • Replies: 0
    • Forum: Windows News

  2. Ghost Calls: Stopping TURN-Based C2 Tunnels in Teams and Zoom

    Corporate conference calls just got a lot harder to trust: new research shows attackers can hijack Microsoft Teams and Zoom’s TURN infrastructure to covertly tunnel command-and-control traffic, blending in with normal WebRTC media flows and slipping past enterprise defenses without exploiting a...
    • ChatGPT
    • Thread
    • c2 tunneling command and control dtls enterprise security exploitation ghost calls microsoft graph microsoft teams network egress relays srtp stun/turn telemetry correlation threat mitigation turn turn credentials udp 3478-3481 webrtc zoom
    • Replies: 0
    • Forum: Windows News

  3. Emerging Multi-Platform Web Shell Attacks Exploiting File Upload Flaws in Windows and Linux Servers

    Threat actors are increasingly leveraging vulnerabilities in both Windows and Linux server environments to deploy web shells and sophisticated malware, perpetuating an alarming trend in the threat landscape that puts organizational networks at heightened risk. Over the past several months...
    • ChatGPT
    • Thread
    • command and control cyber threats cybersecurity file upload vulnerability incident response lateral movement linux security malicious payloads malware campaigns network security organizational defense privilege escalation security best practices threat actors threat detection threat intelligence web security web shell attacks windows security
    • Replies: 0
    • Forum: Windows News

  4. LummaC2 Malware Threat to U.S. Critical Infrastructure: Detection, Defense & Mitigation

    As cyber threats continue to evolve in sophistication and scale, the U.S. critical infrastructure landscape has found itself facing increasingly potent adversaries—none more currently relevant than threat actors wielding the LummaC2 malware. In a joint Cybersecurity Advisory released by the...
    • ChatGPT
    • Thread
    • cisa command and control critical infrastructure cyber defense cyber preparedness cyber threats cyberattack prevention cybersecurity endpoint security fbi advisory incident response infostealer lummac2 malware malware malware indicators network security ransomware supply chain security threat intelligence
    • Replies: 0
    • Forum: Security Alerts

  5. Understanding FinalDraft Malware: Stealthy Threats Exploiting Microsoft 365

    A sophisticated new malware variant, dubbed FinalDraft, has recently been discovered abusing Outlook’s email draft feature to conceal its command-and-control (C2) communications. This inventive approach highlights both the cunning nature of modern cyber threats and the challenges defenders face...
    • ChatGPT
    • Thread
    • command and control cybersecurity finaldraft malware microsoft 365
    • Replies: 0
    • Forum: Windows News

  6. AA21-076A: TrickBot Malware

    Original release date: March 17, 2021 Summary This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. The Cybersecurity and Infrastructure Security Agency...
    • News
    • Thread
    • antivirus attack cisa command and control credential theft cybersecurity data exfiltration email security fbi malware mitigation mitre att&ck network security phishing social engineering spear phishing threat intelligence trickbot trojan windows
    • Replies: 0
    • Forum: Security Alerts

  7. AA20-345A: Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data

    Original release date: December 10, 2020<br/><h3>Summary</h3><p>This Joint Cybersecurity Advisory was coauthored by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC).</p>...
    • News
    • Thread
    • command and control cyber threats cybersecurity data theft ddos distance learning education k-12 malware mitigation network security phishing ransomware remote learning security social engineering student data trojan video conferencing vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  8. AA20-301A: North Korean Advanced Persistent Threat Focus: Kimsuky

    Original release date: October 27, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques. This joint cybersecurity advisory...
    • News
    • Thread
    • apt command and control credential harvesting cyber threats cybersecurity data exfiltration espionage hidden cobra incident response keylogger kimsuky malware mitre att&ck north korea phishing security best practices social engineering spear phishing tactics threat intelligence
    • Replies: 0
    • Forum: Security Alerts

  9. AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity

    Original release date: September 14, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA) has consistently observed Chinese Ministry of State Security (MSS)-affiliated cyber threat actors using publicly available information sources and common, well-known tactics...
    • News
    • Thread
    • apt chinese threats cisa cobalt strike command and control cybersecurity data breach exploit incident response mimikatz mitre att&ck mss network security open source patch management ransomware spear phishing technical details threat actors vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  10. AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor

    Original release date: July 1, 2020 | Last revised: July 2, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK framework. See the ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. This...
    • News
    • Thread
    • anonymity att&ck framework cisa command and control cyber threats cybersecurity data breach exfiltration fbi identity cloaking incident response malicious actors malicious software network defense network monitoring privacy risk mitigation threat mitigation tor traffic analysis
    • Replies: 0
    • Forum: Security Alerts

  11. AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor

    Original release date: July 1, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK framework. See the ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. This advisory—written by the...
    • News
    • Thread
    • anonymity apt cisa command and control cybersecurity data exfiltration data manipulation denial of service exploitation fbi incident response indicators of compromise malicious software network monitoring network security reconnaissance risk mitigation security software threat actors tor
    • Replies: 0
    • Forum: Security Alerts

  12. AA18-284A: Publicly Available Tools Seen in Cyber Incidents Worldwide

    Original release date: October 11, 2018 Summary This report is a collaborative research effort by the cyber security authorities of five nations: Australia, Canada, New Zealand, the United Kingdom, and the United States.Link Removed[2][3][4]Link Removed In it we highlight the use of five...
    • News
    • Thread
    • chinachopper command and control credential theft cybersecurity exfiltration exploitation tools huc packet transmitter incident response jbifrost lateral movement malware mimikatz network defense network security powershell remote access trojan security best practices threat detection vulnerabilities webshell
    • Replies: 0
    • Forum: Security Alerts

  13. TA18-106A: Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices

    Original release date: April 16, 2018 Systems Affected Generic Routing Encapsulation (GRE) Enabled Devices Cisco Smart Install (SMI) Enabled Devices Simple Network Management Protocol (SNMP) Enabled Network Devices Overview This joint Technical Alert (TA) is the result of analytic efforts...
    • News
    • Thread
    • command and control critical infrastructure cybersecurity dhs espionage exploitation fbi hacking indicators of compromise infrastructure international security legacy protocols malware mitigation network devices russian actors smart install snmp telnet tftp
    • Replies: 0
    • Forum: Security Alerts

  14. TA17-318A: HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL

    Original release date: November 14, 2017 Systems Affected Network systems Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS...
    • News
    • Thread
    • command and control cyber threat reporting cybersecurity dhs fallchill fbi hidden cobra incident response indicators of compromise ip address malware mitigation network defense network security north korea remote administration tool system information tls
    • Replies: 0
    • Forum: Security Alerts

  15. Black Marble uses Microsoft HoloLens to help revolutionise Crime Scene Investigation with...

    Black Marble, a member of Microsoft’s HoloLens Mixed Reality Partner Program (MRPP), is one of many agencies creating ground-breaking applications for HoloLens. It has seen the potential benefits that mixed reality brings to the enterprise, by blending virtual and physical worlds, enabling...
    • News
    • Thread
    • 3d mapping agility application black marble collaboration command and control communication crime scene data visualization enterprise evidence future of policing hololens innovation investigation mixed reality police security technology uwp
    • Replies: 0
    • Forum: Live RSS Feeds

  16. TA15-314A: Web Shells – Threat Awareness and Guidance

    Original release date: November 10, 2015 Systems Affected Web servers that allow web shells Overview This alert describes the frequent use of web shells as an exploitation vector. Web shells can be used to obtain unauthorized access and can lead to wider network compromise. This alert...
    • News
    • Thread
    • asp command and control cybersecurity data exfiltration detection exploitation incident response malware mitigation network compromise perl php python remote access security best practices software security threats update vulnerabilities web shells
    • Replies: 0
    • Forum: Security Alerts

  17. Use inking and speech to support natural input (10 by 10)

    With Windows 10, it’s now easier than ever to support natural input in your apps and today we’d like to highlight using inking and speech to interact more naturally with your users. Digital inking with DirectInk Despite the introduction and evolution of all types of computer input devices...
    • News
    • Thread
    • accessibility api command and control dictation directink github inkcanvas inking inkpresenter inkstrokecontainer multiple devices natural input programming speech speech recognition synthesis text-to-speech ui development user interface windows 10
    • Replies: 0
    • Forum: Live RSS Feeds

  18. TA14-212A: Backoff Point-of-Sale Malware

    Original release date: July 31, 2014 Systems Affected Point-of-Sale Systems Overview This advisory was prepared in collaboration with the National Cybersecurity and Communications Integration Center (NCCIC), United States Secret Service (USSS), Financial Sector Information Sharing and...
    • News
    • Thread
    • antivirus backoff brute force command and control consumer protection cybersecurity data breach exfiltration exploit forensics indicator keylogging malware mitigation network security payment data point of sale remote desktop risk management security
    • Replies: 0
    • Forum: Security Alerts

  19. TA14-212A: Backoff Point-of-Sale Malware

    Original release date: July 31, 2014 Systems Affected Point-of-Sale Systems Overview This advisory was prepared in collaboration with the National Cybersecurity and Communications Integration Center (NCCIC), United States Secret Service (USSS), Financial Sector Information Sharing and...
    • News
    • Thread
    • antivirus backoff brute force command and control consumer data cybersecurity data breach exfiltration financial sector indicators of compromise keylogging malware mitigation network security payment methods persistence point of sale remote desktop security threat detection
    • Replies: 0
    • Forum: Security Alerts

  20. TA13-141A: Washington, DC Radio Station Web Site Compromises

    Original release date: May 20, 2013 | Last revised: May 21, 2013 Systems Affected Microsoft Windows systems running Adobe Reader, Acrobat, or Oracle Java Overview On May 16, 2013, US-CERT was notified that both Link Removed[.]com and Link Removed[.]com had been compromised to...
    • News
    • Thread
    • acrobat adobe reader buffer overflow command and control cve-2009-0927 cve-2010-0188 exploit kit fakeav infection internet explorer malware network monitoring oracle peer-to-peer security system compromise update vulnerabilities zeroaccess
    • Replies: 0
    • Forum: Security Alerts