Securelist

"The equipment they use is unlike what you find in a typical IT environment,” explains Emad Haffar, META’s Head of Tech Experts. “Heavy-duty, industrial machinery is integral to moving cargo and coordinating logistics. If even one of these machines is compromised, it could disrupt entire operations."

Read the full interview with our expert Emad Haffar to discover how Kaspersky empowered a regional port to defend its critical operations: edgemiddleeast.com/security/how-k…

We've written extensively about the Lazarus APT and its BlueNoroff subgroup here at Kaspersky and they're often at the forefront of APT innovation and experimentation.

Recently we detected a new Manuscrypt infection on the personal computer of a person living in Russia. This is interesting as Lazarus tend to target businesses, not individuals.

What we found was prior to the detection of Manuscrypt, our technologies also detected exploitation of the Google Chrome web browser originating from the website detankzone[.]com. A decentralized finance (DeFi) NFT-based (non-fungible token) multiplayer online battle arena (MOBA) tank game.

However, under the hood we discovered that there was a hidden script which ran in the user’s Google Chrome browser, launching a zero-day exploit and giving the attackers complete control over the victim’s PC.

Additionally, the work that Lazarus put into the social engineering side of the campaign should be recognised: for several months, they were built a social media presence, made regular posts on X from multiple accounts and promoted their game with content produced by #GenerativeAI and graphic designers.

Finally - the game that was used as bait, was actually found to work! Whilst rudimentary, it could very well be the first game created by an APT group.

Learn more: securelist.com/lazarus-apt-st… #TheSAS2024

Grandoreiro is a well-known Brazilian banking trojan, which forms part of the Tetrade umbrella has been active since at least 2016.

INTERPOL and law enforcement agencies across the globe continue to fight against it, and we're proud to be a big part in that fight, sharing TTPs and IoCs with law-enforcement agencies across the globe.

In our latest article we look at how the gang operates, its evolution over time, and the new tricks that have been adopted by the malware (such as the usage of 3 DGAs (domain generation algorithm) in its C2 comms.)

Learn more: securelist.com/grandoreiro-ba…

We've written extensively about the Lazarus APT and its BlueNoroff subgroup here at Kaspersky and they're often at the forefront of APT innovation and experimentation.

Recently we detected a new Manuscrypt infection on the personal computer of a person living in Russia. This is interesting as Lazarus tend to target businesses, not individuals.

What we found was prior to the detection of Manuscrypt, our technologies also detected exploitation of the Google Chrome web browser originating from the website detankzone[.]com. A decentralized finance (DeFi) NFT-based (non-fungible token) multiplayer online battle arena (MOBA) tank game.

However, under the hood we discovered that there was a hidden script which ran in the user’s Google Chrome browser, launching a zero-day exploit and giving the attackers complete control over the victim’s PC.

Additionally, the work that Lazarus put into the social engineering side of the campaign should be recognised: for several months, they were built a social media presence, made regular posts on X from multiple accounts and promoted their game with content produced by #GenerativeAI and graphic designers.

Finally - the game that was used as bait, was actually found to work! Whilst rudimentary, it could very well be the first game created by an APT group.

Learn more: securelist.com/lazarus-apt-st… #TheSAS2024

Grandoreiro is a well-known Brazilian banking trojan, which forms part of the Tetrade umbrella has been active since at least 2016.

INTERPOL and law enforcement agencies across the globe continue to fight against it, and we're proud to be a big part in that fight, sharing TTPs and IoCs with law-enforcement agencies across the globe.

In our latest article we look at how the gang operates, its evolution over time, and the new tricks that have been adopted by the malware (such as the usage of 3 DGAs (domain generation algorithm) in its C2 comms.)

Learn more: securelist.com/grandoreiro-ba…