APT:SabPub

SabPub
STATUS:Inactive since 2012
TYPE:Backdoor
DISCOVERY:April 2012
TARGETED PLATFORMS:OS X
FIRST KNOWN SAMPLE:2012
NUMBER OF TARGETS:11-100

TOP TARGETED COUNTRIES:
India, USA, Western Europe

SPECIAL FEATURES:
MacOS X backdoor
SabPub targeted Dalai-Lama and Tibetan community

TARGETS:
Activists

APT:Regin

Regin
STATUS:Active
TYPE:Complex cyberattack platform, Trojan, Rootkit
DISCOVERY:spring of 2012
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:2003
NUMBER OF TARGETS:11-100

Top Targeted countries:
Algeria, Afghanistan, Belgium, Brazil, Fiji, Germany, Iran, India, Indonesia, Kiribati, Malaysia, Pakistan, Syria, Russia

Special Features:
Regin – the first cyber-attack platform known to penetrate and monitor GSM networks in addition to other “standard” spying tasks.
One particular Regin module is capable of monitoring GSM base station controllers, collecting data about GSM cells and the network infrastructure.
The Regin platform uses an incredibly complex communication method between infected networks and command and control servers, allowing remote control and data transmission by stealth.
Specific Regin targets include individuals involved in advanced mathematical/cryptographical research

TARGETS
Telecoms
Government entities
Multi-national political bodies
Financial institutions
Academia/Research
Specific individuals

APT: NetTraveler

NetTraveler
STATUS:Active
TYPE:Cyberespionage toolkit
DISCOVERY:2013
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:2004
NUMBER OF TARGETS:101-500

Top targeted countries:
Mongolia, India, Russia. In total, infections were identified in 40 countries.

Special Features:
The crew behind NetTraveler specifically targets Tibetan/Uyghur activists.
NetTraveler infects high-profile targets: space exploration, nanotechnology, energy production, nuclear power, lasers, medicine and communications.
More than 22 gigabytes of stolen data is stored on NetTraveler’s C&C servers.
Office and Java exploits were used.


Targets:
Activists
Energy, oil and gas companies
Academia/Research
Private companies
Government entities
Diplomatic organizations/embassies
Military

APT: Equation

Equation:
STATUS:Active
TYPE:Complex cyberattack platform
DISCOVERY:2014
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:2002
NUMBER OF TARGETS:500-1,000

Top Targeted countries:
Iran, Russia, Pakistan, Afghanistan, India, China, Syria, Mali, Lebanon, Yemen

Special Features:
The ability to infect the hard drive firmware
The use of “interdiction” technique to infect victims
Mimicking to criminal malware.

Targets:
Nanotechnology
Financial institutions
Nuclear industry
Activists
Academia/Research
Government entities
Energy, oil and gas companies
Military
Telecoms
Diplomatic organizations/embassies
Trade and commerce
Aerospace
Mass media and TV
High technology companies
Education
Transportation

APT - Hellsing

Hellsing:
STATUS:Active
TYPE:Remote administration tool
DISCOVERY:Summer 2014
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:2012
NUMBER OF TARGETS:11-100

Top Targeted countries:
Malaysia, Philippines, India, Indonesia, USA

Targets:
Government entities
Diplomatic organizations/embassies

APT: Carbanak

Carbanak:
STATUS:Active
TYPE:Backdoor
DISCOVERY:2014
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:2013
NUMBER OF TARGETS:11-100


Special features:
First ever criminal APT.
Carbanak cybergang was able to steal $1bn from 100 financial institutions worldwide.
The plot marks the beginning of a new stage in the evolution of cybercriminal activity, where malicious users steal money directly from banks, and avoid targeting end users.
The largest sums were grabbed by hacking into banks and stealing up to ten million dollars in each raid.


Top 10 countries:
Russia, USA, Germany, China, Ukraine, Canada, Taiwan, Hong-Kong, United Kingdom, Spain, Norway, India, France, Poland, Pakistan, Nepal, Morocco, The Czech Republic, Switzerland, Bulgaria, Australia, Iceland, Brazil

Targets:
Financial institutions

APT: CosmicDuke

CosmicDuke:
STATUS:Active
TYPE:Backdoor
DISCOVERY:2013
TARGETED PLATFORMS:Windows
FIRST KNOWN SAMPLE:April 2012
NUMBER OF TARGETS:101-500

Special features:
The TinyBaron/CosmicDuke custom backdoor is compiled using a customizable framework called "BotGenStudio", which has sufficient flexibility to enable/disable components when the bot is constructed.
The attackers use strong self-protection to prevent antimalware solutions from analyzing the implant and detecting its malicious functionality via an emulator. It also complicates malware analysis.
CosmicDuke targets individuals involved in the traffic and selling of illegal and controlled substances. These victims have been observed only in Russia.

Top 10 countries affected:
 Georgia, Russia, USA, Great Britain, Kazakhstan, India, Belarus, Cyprus, Ukraine, Lithuania. Others include Azerbaijan, Greece and Ukraine.

Targets:
Diplomatic organizations/embassies
Energy, oil and gas companies
Telecoms
Military
Specific individuals

What is persistent in the context of malware or cyber security?

Persistent – Operators give priority to a specific task, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.

Skype worm reloaded:

 Skype worm reloaded again. The same old scenario is used to propagate. It all started with a message from the infected system and posing a legit link and seems to be a funny video. But at the end, it will ask you install add-ons or plugins to play that video.

Once you installed it, that is it. Your skype will send the same kind of message to your friends.

list of malicious domain related with this skype worm:

 please don't visit it: ( #skypeworm )

hxxp://24onlineskyvideo.info
hxxp://24videotur.in.ua
hxxp://deepskype.net
hxxp://factorygood.net
hxxp://ironskype.net
hxxp://letitskype.info
hxxp://letskype.net
hxxp://popskypevideo.net
hxxp://popvideoskype.com
hxxp://popvideoskype.info
hxxp://popvideoskype.net
hxxp://skypepopvideo.net
hxxp://skypepopvideo.net
hxxp://skyvideo24.in.ua
hxxp://skyvideo24online.in.ua
hxxp://skyvideo24online.ru
hxxp://skyvideotape.in.ua
hxxp://skyvideotape.ru
hxxp://someskype.com
hxxp://someskype.net
hxxp://techine.info
hxxp://techine.net
hxxp://videosk.in.ua
hxxp://videosk.info
hxxp://videoskype.ru
hxxp://videoskype24.ru
hxxp://videoss.in.ua

Post by
newWorld

Job Scam Emails: (Infosys JOB)

 Today I want to share a post on job scams via email. Earlier, I posted on nigerian scams or online frauds. 

Let see the scam:

content of the email:

Infosys Recruitment 2015

Kindly send your update Curriculum Vitae/Resume for job description.

James Carrick
Hr Executive


I checked the send address details:

from: Infosys <cardimen@oakland.edu>
reply-to: hr@infosys-tech.co.in

to:
bcc: ******@gmail.com
date: 12 January 2015 at 05:03
subject: Infosys
mailed-by: oakland.edu
Signed by: oakland.edu
- Important mainly because of the people in the conversation.


It looks suspicious to me, because of the send address and the mail formats. So I replied them to look forward any attachments. I received a word doc. Scanned the word doc with officemalscanner for any malicious codes. But, nothing found. Still, I viewed that doc in controlled environment.

Content of the doc:

They also mentioned that salary range is from Rs.98,981.00/- Rs.400982/-. For the interview process, they asked as to pay 26000/-. I am very sure about that no IT company will ask these kind of silly stuffs.

All we need small amount of seriousness and little awareness about the cyber security threats.
Please share this information with your friends and family and stay away from these kinds of scams.

Post made by
newWorld

The Pirate Bay Co-Founder Arrested:

The Pirate Bay is most visited torrent site in the world and it uses bit torrent protocol for peer to peer file sharing.
"Hans Fredrik Lennart Neij, known to hackers as TiAMO, was detained in the north-eastern Thai town of Nong Khai."- BBC

source: BBC

"Another Pirate Bay co-founder, Gottfrid Warg, was arrested in Cambodia in 2012 and sent back to Sweden to serve his sentence for the same conviction, as well as face a separate hacking trial in Denmark." -BBC



Post by
newWorld