Hacks

GoDaddy, the world’s largest domain registrar and hosting provider announced a data breach that impacts web hosting account credentials. The company notified unauthorized party access to their web hosting account credentials used to connect via SSH. GoDaddy Hack Godaddy found that the incident took place on October 19, 2019, was discovered on April 23, 2020, by GoDaddy security who found an SSH file altered in the hosting environment. “We recently identified suspicious activity on a subset of our servers and immediately began an investigation,” the company said in a data-breach notice filed with the California Attorney General, obtained by media. The company notified to the customers in an email signed by GoDaddy CISO and vice-president of engineering, Demetrius Comes, revealed that the security incident in question came to light after suspicious activity identified. The email notification  revealed  an “an unauthorized individual had access to your login infor...

As developers increasingly embrace off-the-shelf software components into their apps and services, threat actors are abusing open-source repositories such as RubyGems to distribute malicious packages, intended to compromise their computers or backdoor software projects they work on. In the latest research shared with The Hacker News, cybersecurity experts at ReversingLabs revealed over  700 malicious gems  — packages written in Ruby programming language — that supply chain attackers were caught recently distributing through the RubyGems repository. The malicious campaign leveraged the  typosquatting technique  where attackers uploaded intentionally misspelled legitimate packages in hopes that unwitting developers will mistype the name and unintentionally install the malicious library instead. ReversingLabs said the typosquatted packages in question were uploaded to RubyGems between February 16 and February 25, and that most of them have been designed to secretly ...

Pawn Storm having a group also known as  APT28 , Strontium, and  Fancy Bear  active since at least 2004, the group has targeted many organizations globally. The threat actors behind the hacking group use sophisticated social engineering lures, data-stealing malware, several zero-days, and even a private exploit kit. Attack on Webmail servers According to a new report from Trend Micro, the hacker group searches for vulnerable mail servers, for the past 2 years to launch sophisticated phishing campaigns. Starting from 2019 the group probes on several email servers and Microsoft Exchange services around the world. Threat actors aimed at TCP port 443 (used by webmail and Microsoft Exchange Autodiscover services), IMAP port (143, 993), PoP3 port (110, 995) and SMTP port(465, 587) are checked. Pawn Storm Phishing Campaign The attack was conducted aiming to exfiltrate data such as vulnerable systems, brute force credentials, exfiltrate email data, and send out...

Researchers discovered a new malicious activity that involved by Russian APT hackers to attack Government and Military officials in Ukrainian entities. The attacker’s targets are not limited but they also infect various individuals who is part of the government and Law enforcement, Journalists, Diplomats, NGO and the Ministry of Foreign Affairs. Researchers believe that the campaign attributed to Gamaredon activity in which attackers using Dynamic Domain Name Server as C2 server, VBA macro, and VBA script as a part of this attack. Threat actors using weaponized DOCX files during the intelligence collection in the target and its distributed via spearphishing emails. Gamaredon is using weaponized documents, sometimes retrieved from legitimate sources as the initial infection vector. Researchers observed the malicious sample that reveals the APT activity from at least September 2019 to November 25, 2019. Malware infection Process Researchers observed some of the lure do...