An update on Cl0p's exploitation of a MOVEit vulnerability.ĭave Bittner: The Record reports that there appear to be at least sixty-three organizations that were compromised by the Cl0p ransomware gang via the MOVEit vulnerabilities. Though their techniques may be similar, this doesn't necessarily mean they are collaborating, "The Flea" aims to gain persistent access its targets' networks. Symantec also drew similarities between Graphican and Fancy Bear's Graphite malware, which also uses Microsoft Graph API and OneDrive as a command-and-control server. The report says the major difference between the functionalities of Graphican and Ketrican are Graphican's use of the Microsoft Graph API and OneDrive to obtain its command-and-control infrastructure. It's deploying Backdoor.Graphican, a third-generation backdoor derived from the previously used Ketrican and BS2005. This campaign is said to be conducted by the China-backed advanced persistent threat group called "The Flea," with other known aliases that include APT15, Nylon Typhoon, BackdoorDiplomacy, among others. The Threat Hunter team at Symantec released a new report detailing a recent cyberespionage campaign seen targeting various ministries of foreign affairs. The Flea APT prospects diplomatic targets.ĭave Bittner: A Chinese cyberespionage campaign has hackers hoping to be a flea on the wall in foreign affairs ministries across the Americas. Rick Howard speaks with Rod Wallace from AWS about data lakes, and Fancy Bear noses its way into Ukrainian servers.ĭave Bittner: I'm Dave Bittner with your CyberWire Intel Briefing for Wednesday, June 21, 2023. Derek Manky of Fortinet describes the Global Threat Landscape. The "Muddled Libra" threat group compromises companies in a variety of industries.
Unpatched TP-Link Archer routers are meeting their match in the Condi botnet. An update on the C10p gang's exploitation of a MOVEit vulnerability. Dave Bittner: The Flea APT sets its sights on diplomatic targets.
0 kommentar(er)
