risk Archives - Recon Bee

North Korea’s Lazarus Group Suspected in $31 Million CoinEx Heist

18Sep

By RBNo Comments

News

North Korea’s Lazarus Group Suspected in $31 Million CoinEx Heist

Since June 2023, the Lazarus Group, which has ties to North Korea, has stolen approximately $240 million in cryptocurrencies, a huge increase in its hacking activity. The famed hacker squad is allegedly suspected of stealing $31 million in digital assets from the CoinEx exchange on September 12, 2023, according to numerous reports from Certik, Elliptic, and ZachXBT. The crypto robbery intended for CoinEx is the latest in a succession of recent attacks that also cost $100 million for Atomic Wallet, $37.3 million for CoinsPaid, $60 million for Alphapo, and 41 million for Stake.com. Some of the CoinEx money that was stolen was sent to an address that the Lazarus gang had previously used to launder money from Stake.com read more North Korea's Lazarus Group Suspected in $31 Million Co...

Iranian hackers breach defense orgs in password spray attacks

15Sep

By RBNo Comments

News

Iranian hackers breach defense orgs in password spray attacks

Since February 2023, Microsoft claims that a threat group with Iranian support has launched password spray assaults against hundreds of companies in the United States and around the world. Additionally, a small number of victims in the pharmaceutical, satellite, and defense industries had their private information stolen by state hackers. The cyberspy organization known as APT33 (also known as Peach Sandstorm, HOLMIUM, or Refined Kitten) has been active since at least 2013, attacking targets in the US, Saudi Arabia, and South Korea. These targets include government, defense, research, finance, and engineering organizations. The Microsoft Threat Intelligence team reported that Peach Sandstorm carried out a wave of password spray assaults between February and July 2023 in an effort...

Russian Journalist’s iPhone Compromised by NSO Group’s Zero-Click Spyware

15Sep

By RBNo Comments

News

Russian Journalist’s iPhone Compromised by NSO Group’s Zero-Click Spyware

According to a recent joint study by Access Now and the Citizen Lab, Galina Timchenko's iPhone was infected with NSO Group's Pegasus spyware. Timchenko is a well-known Russian journalist and government critic. According to reports, the intrusion took place on or about February 10, 2023. Timchenko is the publisher, executive editor, and proprietor of the independent Latvian news outlet Meduza. Right now, it's unclear who installed the spyware on the gadget. According to an unnamed individual familiar with the business affairs of NSO Group, the Russian government is not one of the company's clients read more Russian Journalist's iPhone Compromised by NSO Group's Zero-Click Spyware. Stay informed with the best cybersecurity news and raise your cybersecurity awareness with our compre...

Hackers steal $53 million worth of cryptocurrency from CoinEx

14Sep

By RBNo Comments

News

Hackers steal $53 million worth of cryptocurrency from CoinEx

A substantial quantity of digital assets that were used to fund the platform's operations were stolen from vast amounts of hot wallets at the major cryptocurrency exchange CoinEX, according to an announcement. The issue happened on September 12 and preliminary investigation findings indicate that cryptocurrencies from Tron, Polygon, and Ethereum were used in the illicit transactions. Since the inquiry has not yet determined the full extent of the losses, CoinEx has not disclosed any information regarding the financial effect sustained. According to a report by the blockchain security company PeckShield, CoinEx lost over $19 million in ETH, $11 million in TRON, $6.4 million in Smart Chain Coin ($BSC), $6 million in Bitcoin (BTC), and roughly $295,000 in (MATIC) as a result of the ...

Beware: MetaStealer Malware Targets Apple macOS in Recent Attacks

13Sep

By RBNo Comments

News

Beware: MetaStealer Malware Targets Apple macOS in Recent Attacks

After MacStealer, Pureland, Atomic Stealer, and Realst, a brand-new information-stealing malware family by the name of MetaStealer has its eyes set on the Apple macOS operating system. According to a Monday investigation by SentinelOne security researcher Phil Stokes, "threat actors are actively targeting macOS businesses by posing as fake clients in order to socially engineer victims into launching malicious payloads." The targets of these assaults are approached by threat actors posing as potential design clients in order to share a password-protected ZIP package containing the DMG file, which is how MetaStealer is transmitted in these attacks read more MetaStealer Malware Targets Apple macOS in Recent Attacks. Stay informed with the best cybersecurity news and raise your cyber...

Mac Users Beware: Malvertising Campaign Spreads Atomic Stealer macOS Malware

8Sep

By RBNo Comments

News

Mac Users Beware: Malvertising Campaign Spreads Atomic Stealer macOS Malware

An updated version of the Atomic Stealer (or AMOS) macOS stealer malware has been seen being distributed through a fresh malvertising operation, showing that its creator is still actively maintaining it. Atomic Stealer, a ready-made Golang malware that costs $1,000 a month, first came to light in April 2023. Soon after, other variations that targeted bitcoin users and gamers were discovered in the wild. These variants had an expanded set of information-gathering functions. Google Ads have been identified as the main distribution channel for malicious advertisements, which are displayed to users who are looking for popular software on search engines, either legally or illegally, and which link to websites that hold malicious installations read more Malvertising Campaign Spreads Atomi...

Zero-Day Alert: Latest Android Patch Update Includes Fix for Newly Actively Exploited Flaw

7Sep

By RBNo Comments

News

Zero-Day Alert: Latest Android Patch Update Includes Fix for Newly Actively Exploited Flaw

For Android, Google has released monthly security updates to fix a variety of bugs, including a zero-day bug that the company believes may have already been used in the wild. The high-severity vulnerability, identified as CVE-2023-35674, is characterized as a case of privilege escalation affecting the Android Framework. Without going into more detail, the company stated in its Android Security Bulletin for September 2023 that "There are indications that CVE-2023-35674 may be under limited, targeted exploitation." The update also fixes three other privilege escalation bugs in Framework. According to the search engine giant, the worst of these bugs "could lead to local escalation of privilege with no additional execution privileges needed" without user engagement read more Latest A...

Crypto casino Stake.com loses $41 million to hot wallet hackers

6Sep

By RBNo Comments

News

Crypto casino Stake.com loses $41 million to hot wallet hackers

Stake.com, an online cryptocurrency casino, disclosed that over $40 million in bitcoin was purportedly stolen when its ETH/BSC hot wallets were hijacked to carry out illicit transactions. Users were instantly reassured by the platform that their money was secure, and all other wallets that were not specifically targeted by the attack, including as those carrying BTC, LTC, XRP, EOS, and TRX, continued to function normally. Several users stated on X that they were impacted by the circumstance and were unable to deposit or withdraw on Stake.com during that time. Stake.com said today that its services have been restored and that users can once more deposit and withdraw funds in all currencies read more Crypto casino Stake.com loses $41 million to hot wallet hackers. Stay informed wit...

Freecycle confirms massive data breach impacting 7 million users

5Sep

By RBNo Comments

News

Freecycle confirms massive data breach impacting 7 million users

Over 7 million users were impacted by a significant data breach, according to Freecycle, a website that promotes trading used products rather than throwing them away. According to the nonprofit, the breach was detected on Wednesday, weeks after a threat actor posted the stolen data for sale on a hacking site on May 30 and advised anybody affected to change their passwords right away.According to Freecycle, the stolen data only contains usernames, User IDs, email addresses, and passwords that have been MD5 hashed. Deron Beal, the creator and executive director of Freecycle, had his credentials taken in the incident, according to screenshots given by the threat actor who is selling the stolen data. This gave the threat actor complete access to forum postings and member information rea...

Vietnamese Cybercriminals Targeting Facebook Business Accounts with Malvertising

5Sep

By RBNo Comments

News

Vietnamese Cybercriminals Targeting Facebook Business Accounts with Malvertising

Advertising-as-a-vector on social media sites like Facebook, which is owned by Meta, is being used by malicious actors connected to the Vietnamese cybercrime ecosystem to spread malware. According to WithSecure analyst Mohammad Kazem Hassan Nejad, "threat actors have long used fraudulent ads as a vector to target victims with scams, malvertising, and more." And now that companies are using social media to advertise, attackers have a brand-new, extremely lucrative sort of assault to add to their toolbox: taking over corporate accounts. Due to activity clusters like Ducktail and NodeStealer, which are known to target Facebook users and businesses, cyber attacks on Meta Business and Facebook accounts have become more prevalent over the past year read more Vietnamese Cybercriminals Targ...