The US President restricts investment in Chinese tech companies

andreasc
-
0
The US President restricts investment in Chinese tech companies
[ad_1]

The US President, Joe Biden, signed an executive order which restricts investment in specific types of Chinese tech firms. Why? Well, national security is cited, as there are certain risks present.

The US President signed an executive order that restricts investment in Chinese tech firms

This executive order is aimed at companies that handle “sensitive technologies”. Companies that handle semiconductors, quantum computing, and artificial intelligence.

This is what it says in the executive order itself: “Advancements in sensitive technologies and products in these sectors will accelerate the development of advanced computational capabilities that will enable new applications that pose significant national security risks, such as the development of more sophisticated weapons systems, breaking of cryptographic codes, and other applications that could provide these countries with military advantages”.

The White House says that this move is “narrowly targeted”. It’s supposed to restrict investments in specific companies, the ones that handle sensitive tech, as previously stated. One thing to note is that this order won’t go into effect until next year.

When we see China-related restrictions, Huawei does come to mind

Now, this is not the first time the US decided to impose such restrictions when China is concerned. Not even close. The best example is probably Huawei, whose business was damaged by the US ban.

Huawei is not allowed to use Google services on its phones, and it also doesn’t have access to 5G processors at the moment. There were several waves of bans regarding the company, and that has been going on for years.

Having said that, the White House also limited the sale of supercomputing technology to Chinese firms. Those are just some examples. It seems like a lot is going on behind the scenes when it comes to the US and China.

It remains to be seen what will the future bring. Tech companies are starting to rely heavily on AI, and its development is in full swing. Such tech could increase (national) security concerns.


[ad_2]
Source link

Researchers Tricked Hackers into Reveal Their Secrets Using Honeypot

andreasc
-
0
Researchers Tricked Hackers into Reveal Their Secrets Using Honeypot
[ad_1]

In the last three years, hackers unknowingly seeking data or malware deployment have found a seemingly vulnerable virtual machine that is hosted in the U.S., which in reality, is a cleverly designed trap.

While this cleverly designed, trap has been implanted by cybersecurity researchers to trick the hackers and make them reveal their dark secrets with the help of a honeypot.

Over 2,000 hackers breached a machine, letting GoSecure experts invisibly record their actions, including:-

  • Screen activity
  • Mouse clicks
  • Data grabs
  • Metadata

Trap for Hackers

Using their RDP interception tool, GoSecure gathered extensive info on attackers, shared in a groundbreaking presentation at BlackHat USA:-

  • I Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers’ Tradecraft

While this story includes luring, understanding, characterizing, and dealing with threat actors to shift focus to advanced threats.

Threat actors like ransomware groups, exploit Remote Desktop Protocol (RDP) actively. That’s why to examine this; experts have crafted PyRDP, an open-source interception tool with the following key capabilities:-

  • Unmatched screen
  • Track Keyboard
  • Monitor mouseclicks
  • Clipboard data collection
  • File collection
Document
FREE Webinar

API Attacks Have Increased by 400% – Understand the Fundamentals of Protecting Your APIs with a Positive Security Model – Register Now for a Free Webinar

Data captured

Moreover, security researchers at GoSecure built and set up a custom-designed cloud-based honeynet trap with RDP Windows servers and then ran them for 3-years.

Within a span of 3-years, they managed to accumulate several essential data and more than 190 million events which include:- 

  • 100 hours of video footage
  • 470 files collected from threat actors
  • Over 20,000 RDP captures 

Grouping Hackers

All the data that are gathered by the security analysts are used to categorize the hackers into different specified groups based on their behavior.

Here below we have mentioned all the groupings of the hackers:-

  • Rangers: This group extensively explores folders, assesses performance, and conducts reconnaissance through clicks or scripts, likely assessing compromised systems for future attacks.

Watch them in action:-

  • Thieves: This group exploits RDP access, taking control by altering credentials and engaging in various monetization activities, including traffmonetizer, pay-to-surf browsers, crypto miners, and Android emulators for mobile fraud.
  • Barbarians: This group employs a diverse toolkit for widespread brute-force attacks, leveraging compromised systems with IP lists, usernames, and passwords.
  • Wizards: This group cleverly uses RDP access as a portal for connecting to other similarly compromised computers, enhancing their operational security. Skillfully leveraging ‘living off the land’ techniques, so, monitoring them is important for in-depth threat intel.

Watch them in action:-

  • Bards: This group lacks hacking skills and uses the system for simple tasks, possibly buying RDP access from Initial Access Brokers (IABs) who compromise it.

However, this GoSecure showcase highlights the vast potential of RDP for research, law enforcement, and defense teams. Legal interception of ransomware RDP setups aids investigations through recorded session intelligence.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.


[ad_2]
Source link

Galaxy Z Flip 5 folded 400,000 times in a week-long durability test

andreasc
-
0
Galaxy Z Flip 5 folded 400,000 times in a week-long durability test
[ad_1]

Samsung‘s latest clamshell foldable, the Galaxy Z Flip 5, has turned out to be a lot tougher than expected. A YouTuber subjected the device to a week-long, rigorous durability test and it came out with flying colors. The new Flip survived more than 400,000 folds, double the company’s official rating of 200,000 folds. This is despite it being submerged under the water, heated to over 160°F/70°C, and put in a bag of dust.

This marathon run began on August 2, with the YouTube channel Mrkeybrd pitting the Galaxy Z Flip 5 against the Motorola Razr Plus (known as the Razr 40 Ultra in some markets) in a durability face-off of clamshell foldables. The test was carried out by hand to factor in the varying speed and force humans apply while folding and unfolding the devices in real life. Automated machine tests don’t reflect the kinds of stress people give to their phones.

Unfortunately, the Razr was no competition to the new Galaxy. The Motorola foldable experienced its first hinge failure around 40,000 folds. By around 64,000 folds, its hinge started creaking. It eventually gave out shortly after crossing 126,000 folds. The Razr Plus’ screen broke at that point, and it was officially out of the race. That was shortly after both foldables were put in a bag of dust (at around 100,000 folds).

The Galaxy Z Flip 5 crossed Samsung’s fold rating without any issue

The Galaxy Z Flip 5, on the other hand, continued to go strong without any hinge or display issues. The YouTuber folded and unfolded it underwater after crossing the 200,000 fold mark. The phone remained submerged in water for half an hour, with the tester folding/infolding it almost 700 times during this period. The foldable developed minor hinge issues after that, though the first notable problem didn’t surface until around 223,000 folds.

Even then, the Galaxy Z Flip 5 was still working fine. At 276,000 folds, the YouTuber started folding the phone inside a food heater. The temperature inside the chamber rose over 160°F/70°C, yet the foldable suffered no damage. Neither the hinge nor the display failed catastrophically. The device was limping, but it continued to work for almost 130,000 more folds. Even at 400,000 folds, the Galaxy Z Flip 5 was going fairly strong.

But at this point, the YouTuber decided to cover the phone entirely in flour, eggs, cornmeal, and sugar. That proved to be a little too much and the Galaxy Z Flip 5 gave out shortly. By the time the YouTuber officially called an end to the test, the new Samsung foldable had been folded and unfolded a whopping 401,146 times. Quite clearly, it’s a tough foldable that can survive the everyday stresses and strains of the real world.


[ad_2]
Source link

Embracing Bitcoin ATMs: The key motivations

andreasc
-
0
Embracing Bitcoin ATMs: The key motivations
[ad_1]

Discover the undeniable advantages of Bitcoin ATMs in this article. From instant and private transactions to financial empowerment, explore why these user-friendly machines are revolutionizing the cryptocurrency landscape. If you’re new to crypto trading, give Granimator a try! It’s an exceptional online trading platform that offers a seamless trading experience.

Secure and Reliable Transactions

In the world of cryptocurrencies, security and reliability are of utmost importance. Bitcoin ATMs have emerged as a trusted solution, offering a seamless and secure way to transact with Bitcoin. One of the key features that make Bitcoin ATMs stand out is the implementation of robust security measures. These machines are equipped with advanced technology, ensuring that each transaction is conducted with utmost safety.

At the core of Bitcoin’s security is its utilization of blockchain technology. Every transaction made through a Bitcoin ATM is recorded on the blockchain, creating a decentralized and tamper-resistant ledger. This not only guarantees the transparency of transactions but also makes it extremely challenging for any unauthorized parties to manipulate or alter the records.

Moreover, Bitcoin ATMs are designed to operate independently, functioning without the need for a central authority. This decentralized nature further enhances the reliability of transactions, reducing the risk of system failures or disruptions. Users can have peace of mind knowing that their transactions are not subject to the vulnerabilities often associated with centralized systems.

The convenience of using Bitcoin ATMs also adds to their reliability. With these machines available 24/7, users can transact at their own convenience, regardless of traditional banking hours. This accessibility ensures that users can buy or sell Bitcoin whenever the need arises, without any delays.

Access to a Growing Cryptocurrency Ecosystem

Bitcoin ATMs are not just limited to facilitating Bitcoin transactions; they have evolved to cater to the growing demand for various other cryptocurrencies. As the cryptocurrency market expands, these ATMs have adapted to offer support for a wide array of altcoins, opening up new possibilities for users seeking to diversify their digital asset portfolio.

The inclusion of multiple cryptocurrencies in Bitcoin ATMs allows users to explore and invest in promising altcoins beyond the popular Bitcoin. This newfound accessibility empowers users to take advantage of the potential growth and utility of these emerging digital currencies. Whether it’s Ripple, Litecoin, or any other altcoin, Bitcoin ATMs serve as gateways to a diverse and ever-expanding cryptocurrency ecosystem.

Moreover, Bitcoin ATMs play a crucial role in democratizing access to these altcoins. Traditionally, acquiring certain cryptocurrencies could be a complex process, requiring users to navigate various exchanges and sometimes encounter registration hurdles. However, with Bitcoin ATMs, users can easily purchase these altcoins using cash, eliminating the need for extensive documentation or complicated procedures.

The ability to access a growing cryptocurrency ecosystem through Bitcoin ATMs not only benefits seasoned investors but also encourages newcomers to explore the diverse world of digital currencies. These machines serve as educational tools, introducing users to various cryptocurrencies and fostering a deeper understanding of the broader blockchain technology landscape.

Financial Inclusion and Empowerment

In a world where access to financial services is not universal, Bitcoin ATMs have emerged as powerful tools for promoting financial inclusion and empowerment. These machines are breaking down barriers, particularly for the unbanked and underbanked populations, by offering an entry point into the world of digital assets and financial independence.

For those without access to traditional banking services, Bitcoin ATMs provide a lifeline to participate in the global economy. These individuals often face challenges in opening bank accounts due to lack of identification or proximity to physical bank branches. However, with Bitcoin ATMs, they can conveniently buy or sell Bitcoin using cash, thus gaining access to digital financial services without the need for a bank account.

Moreover, Bitcoin ATMs are strategically placed in various locations, including underserved areas, to cater to populations traditionally excluded from financial systems. This outreach ensures that communities with limited access to banking facilities can still engage in secure and convenient cryptocurrency transactions, empowering them with newfound financial opportunities.

By leveraging the anonymity feature of Bitcoin ATMs, users can conduct transactions without the need to disclose personal information, ensuring a level of privacy and protection not always available in traditional financial setups. This aspect is particularly important in regions where concerns about data breaches and identity theft are prevalent.

Financial empowerment is at the heart of Bitcoin ATMs’ mission. By enabling individuals to access digital assets and conduct transactions autonomously, these machines provide a sense of control over one’s finances. They offer opportunities for wealth preservation, investment diversification, and greater financial freedom, empowering users to make informed decisions about their money.

Conclusion

Embrace the future of cryptocurrency with Bitcoin ATMs. Experience the convenience, security, and financial inclusivity they offer. Take the first step towards a seamless crypto journey today!


[ad_2]
Source link

Microsoft Patch Tuesday For August ’23 Addresses 84 Flaws

andreasc
-
0
Microsoft Patch Tuesday For August ’23 Addresses 84 Flaws
[ad_1]

Microsoft has rolled out the scheduled Patch Tuesday updates for August 2023, ensuring automatic updates for all devices. Yet, users should still check for system updates manually to ensure receiving all security fixes timely. This month’s update bundle is important because it addresses two critical zero-day vulnerabilities alongside other security flaws.

Important Security Fixes With Microsoft Patch Tuesday August

This month’s update bundle addresses two severe zero-day vulnerabilities that allowed remote code execution attacks.

The first includes CVE-2023-36884 – a high-severity zero-day flaw that became publicly disclosed before receiving a patch. Also, the researchers found it under active attack, particularly for cyberespionage purposes. The latest exploitation of this flaw appeared in the RomCom Threat Group attacks targeting the NATO Summit.

Microsoft admitted detecting the flaw’s exploitation and even released a fix with July 2023 updates. However, with August updates, the tech giant has released another update as a “defense in depth” measure to “break the chain” of exploitation.

The next significant security fix this month addresses an important severity denial of service vulnerability in .NET and Visual Studio. Exploiting this flaw (CVE-2023-38180). While Microsoft stated no public disclosure of this vulnerability, it did admit detecting its active exploitation before the fix could arrive.

Alongside these fixes, Microsoft has also addressed six critical severity vulnerabilities, all of which could allow remote code execution attacks when exploited. These vulnerabilities affect Microsoft Office (CVE-2023-36895), Microsoft Teams (CVE-2023-29328 and CVE-2023-29330), and Microsoft Message Queuing (CVE-2023-35385, CVE-2023-36910, and CVE-2023-36911).

Besides, this month’s update bundle addressed 79 other important and low-severity vulnerabilities that include 17 RCE flaws, 18 privilege escalation vulnerabilities, 12 spoofing vulnerabilities, 10 information disclosure issues, 7 vulnerabilities triggering denial-of-service, and 3 security feature bypass flaws.

While the tech giant has rolled out all the updates automatically for all devices, users should ensure to enable auto-updates on their systems to receive the patches in time. Whereas, for devices where automatic updates aren’t feasible, users should manually install the updates at the earliest to avoid potential threats.

Let us know your thoughts in the comments.


[ad_2]
Source link

Xiaomi MIX Fold 3 design officially confirmed: Gallery

andreasc
-
0
Xiaomi MIX Fold 3 design officially confirmed: Gallery
[ad_1]

The Xiaomi MIX Fold 3 design has been officially confirmed by the company’s CEO. Lei Jun decided to share a bunch of images of the device ahead of launch. This came following yesterday’s launch date announcement, and video teaser.

Before we get down to the images, do note that the Xiaomi MIX Fold 3 will launch on August 14. This will become the third-gen book-style foldable from the company, and the company says that this will be a no-compromise device.

The Xiaomi MIX Fold 3 design gets officially confirmed by the company’s CEO

In the gallery at the bottom of the article, you can check out the device itself. You can clearly see it will be quite thin, in both its folded and unfolded states. That is not surprising, as the MIX Fold 2 was as well.

The question remains, however, whether will it be able to trump the HONOR Magic V2 in that regard. Its sides will be flat, but with chamfered edges, for comfort. A display camera hole will sit on the cover display, while we’re not sure about the main panel.

Four cameras will be included on the back of this phone. Those cameras will be backed by Leica, as the two companies are partnered up still. By the shape of one of the sensors on the back, we can see that we’ll get a periscope telephoto camera here

The phone is also expected to offer a truly compelling set of cameras

In addition to that, the Xiaomi MIX Fold 3 will likely deliver a wide-angle (main) camera, an ultrawide unit, and a telephoto camera. Based on rumors, we’re getting a telephoto camera with 3.2x optical zoom, and a periscope telephoto unit with a 5x optical zoom.

You can see that at least this black-colored model of the MIX Fold 3 has an eco-leather backplate. I much appreciate that, especially on foldables, as it helps with the grip quite a bit.

The phone is also tipped to include the Snapdragon 8 Gen 2 SoC, LPDDR5X RAM, UFS 4.0 flash storage, and two 120Hz OLED display. Those two panels are said to measure 8.02 and 6.5 inches. 67W wired, and 50W wireless charging was also mentioned in rumors. We’re still not sure if this phone will make it to markets outside of China, its predecessors did not.


[ad_2]
Source link

WhatsApp might introduce passkeys soon: one less password to remember

andreasc
-
0
WhatsApp might introduce passkeys soon: one less password to remember
[ad_1]
Creating a secure password by following the rules (uppercase, numbers, special characters, etc.) isn’t a cakewalk, and let’s be real, it’s not exactly fun. Maybe it’s a tad amusing if you’re into playing the online trend, the Password game, but other than that, it’s not exactly a favorite pastime for most of us. And the whole memory struggle? Don’t even get me started – it’s a whole new level of annoyance. So, if you’re feeling the same way, passkeys could be right up your alley.Passkeys are becoming more common in different services, and it looks like WhatsApp is jumping on the trend. WABetaInfo reports that WhatsApp might soon let users use passkeys to log into their accounts. These passkeys will be stored in Google Password Manager, based on the latest WhatsApp beta for Android 2.23.17.5 update.

Opting for passkeys offers a heightened level of security compared to traditional passwords, which can be susceptible to hacking and used for unauthorized access to your profile and data. Passkeys are like unique codes, phrases, or elements functioning as digital keys to unlock secure systems. For example, you can use your fingerprint or face, which are difficult to replicate. With this WhatsApp update, security is getting a solid boost.

Moreover, passkeys aren’t just more secure, they’re also significantly more user-friendly compared to traditional passwords. These passkeys will be securely stored in Google Password Manager, eliminating the need for memorization. Switching to a passkey for logging into your WhatsApp account offers exceptional convenience, especially when managing various accounts or using multiple devices.

Passkeys were introduced on iOS 16 in 2022, and soon after, Google also embraced them. Since then, various services such as Best Buy, eBay, and PayPal have started employing passkeys as an authentication method. Even social media platforms are hopping on board – TikTok recently rolled out passkey login for iOS users, while Facebook offers the option to use a passkey alongside the traditional password for logging in.

The precise launch date for WhatsApp’s official passkey support remains uncertain, but given its current beta status, the rollout may be pretty soon. The messaging app under Meta’s umbrella has recently introduced various updates, such as screen-sharing during video calls. With the upcoming passkey support, the app is likely to enhance the satisfaction – or at the very least, reduce stress – for its 2.7 billion users, alleviating the need to remember yet another password.


[ad_2]
Source link

Apple’s A17 chip will run up to 3.7GHz in iPhone 15

andreasc
-
0
Apple’s A17 chip will run up to 3.7GHz in iPhone 15
[ad_1]

The chipset that Apple will use inside the iPhone 15 (likely just the Pro models), has just leaked out. And it’s looking like a pretty big upgrade for the iPhone 15 this year.

The A17 CPU will be made using the 3nm manufacturing process. It will also have a 6-core CPU and a 6-core GPU. Those CPU cores will run at up to 3.7GHz. Making it a pretty fast processor, and keeping Apple’s lead over Qualcomm, MediaTek and Samsung. Finally, it’ll support up to 6GB of RAM. So it looks like the hopes for 8GB of RAM in the iPhone 15 Pro, is not happening.

This will be the first chipset for iPhone made using the 3nm process, which is going to bring about a 10-15 percent boost in performance and power consumption should drop by about 30 percent. That should bring us more performance and with the larger batteries in the iPhone 15, some pretty substantial gains in battery life. Definitely good on both fronts.

iPhone 15 is expected to be announced on September 12

September 12 is rumored to be the announcement date for the iPhone 15 series, with the Pro models being delayed a couple of weeks and thus shipping in October. Which means the launch is right around the corner.

While it sounded like the iPhone 15 would be a pretty small update this year, it is turning out to be a much larger update than any of us had anticipated. Of course, the big thing is going to be USB-C, finally. And we can thank the EU for that. Additionally, the iPhone 15 and 15 Plus are going to get dynamic island, which means no more notches on new iPhones – at least until a new SE comes out.

Now as for the A17 chipset here, if Apple continues to do what they did with the iPhone 14 series, it looks like it will only be available on the Pro models. So that’s iPhone 15 Pro and iPhone 15 Pro Max. We’ll have to wait for September 12 to find out for sure.


[ad_2]
Source link

Unveiling Bitcoin’s baffling correlation puzzle

andreasc
-
0
Unveiling Bitcoin’s baffling correlation puzzle
[ad_1]

Discover the intriguing world of Bitcoin’s correlation with other financial assets in this article. Unravel the mystery behind its unparalleled relationship with traditional markets, cryptocurrencies, and macroeconomic indicators. If you’re searching for a dependable and trustworthy platform to invest in Bitcoin, consider turning to The News Spy trading platform for a smooth and secure experience.

Unraveling the Mystery: Why is Bitcoin’s Correlation Unique

Welcome to an eye-opening exploration of Bitcoin’s correlation mysteries! As the world delves deeper into the realm of digital currencies, Bitcoin has emerged as a standout player, captivating investors and enthusiasts alike. Among its intriguing aspects is its correlation with various financial assets.

Before we delve into the enigma surrounding Bitcoin’s correlation, let’s grasp the essence of correlation in finance. In the world of investments, correlation measures the statistical relationship between two or more assets. It helps investors understand how these assets move in relation to each other. Correlation coefficients can vary between -1 and +1, where -1 indicates a perfect negative correlation, +1 denotes a perfect positive correlation, and 0 signifies no correlation.

Bitcoin’s journey as a digital asset has been intertwined with the traditional financial ecosystem. Over time, researchers and analysts have explored its correlation with major stock market indices like the S&P 500 and the Dow Jones. The results have been intriguing, revealing both periods of positive and negative correlation. Similarly, the relationship between Bitcoin and gold prices has also been a subject of fascination for financial experts.

In the vibrant and ever-changing crypto market, Bitcoin is not alone. There are numerous other cryptocurrencies, each with its unique attributes. Understanding how Bitcoin correlates with these alternative digital assets is crucial for comprehending the broader market dynamics. Factors like market sentiment and technological developments significantly influence these interconnections.

The macroeconomic landscape has a profound impact on financial markets, and Bitcoin is no exception. As an asset that emerged in response to the 2008 financial crisis, Bitcoin’s correlation with macroeconomic indicators like inflation rates and interest rates is worth exploring.

Investing Strategies Amidst Bitcoin’s Correlation Trends

One common investment strategy in the context of Bitcoin’s correlation trends is portfolio diversification. Diversification involves spreading investments across different assets to reduce overall risk. As Bitcoin has shown periods of low correlation with traditional assets like stocks and bonds, some investors view it as an effective diversifier. During times of market turbulence or economic uncertainty, Bitcoin’s performance might deviate from that of traditional assets, potentially offering a hedge against downturns in other markets.

However, it is crucial to recognize that while Bitcoin’s correlation might be low during certain periods, it can change rapidly. The cryptocurrency market is highly volatile, and correlations can shift unexpectedly. Therefore, investors should not solely rely on Bitcoin for diversification but rather maintain a well-balanced and diversified portfolio.

Moreover, investors should consider their risk tolerance and investment goals when incorporating Bitcoin into their strategies. As Bitcoin is still a relatively young asset, it can experience sharp price fluctuations, leading to substantial gains or losses.

Another strategy to consider amidst Bitcoin’s correlation trends is tactical asset allocation. This approach involves actively adjusting the allocation of assets in response to changing market conditions. When Bitcoin’s correlation with traditional assets is low, investors might allocate more funds to it. Conversely, when its correlation rises, they may reduce exposure and reallocate to assets with better diversification potential.

However, implementing tactical asset allocation requires a deep understanding of market trends and the ability to make timely decisions. It is a more active approach to investing and may not be suitable for all investors, especially those with a long-term investment horizon.

Additionally, investors should be vigilant about ongoing research and analysis of Bitcoin’s correlation trends. Monitoring the market sentiment and macroeconomic indicators can provide valuable insights into potential shifts in correlation patterns. Staying informed about regulatory developments and institutional adoption can also offer clues on how Bitcoin’s correlation with traditional markets may evolve.

Lastly, a prudent approach is to avoid making investment decisions based solely on short-term correlation trends. Correlation does not necessarily imply causation, and reacting hastily to temporary correlation changes can lead to costly mistakes. Instead, investors should focus on the underlying fundamentals and long-term prospects of Bitcoin as a digital asset.

Investing in Bitcoin amidst its correlation trends requires a well-thought-out strategy tailored to individual risk tolerance and investment goals. While Bitcoin’s unique correlation behavior can present opportunities for diversification and potential gains, it also entails higher risks due to its volatility.

Conclusion

As Bitcoin continues to captivate investors worldwide, understanding its correlation with various assets becomes paramount. The evolution from speculation to store of value, along with institutional adoption and regulatory changes, has shaped its unique correlation behavior. Embrace these insights to make informed investment decisions as Bitcoin’s journey unfolds.


[ad_2]
Source link

TargetCompany Ransomware Deploy Fully Undetectable Malware

andreasc
-
0
TargetCompany Ransomware Deploy Fully Undetectable Malware
[ad_1]

The TargetCompany ransomware (aka Mallox, Fargo, and Tohnichi) is actively targeting the organizations that are using or running vulnerable SQL servers.

Apart from this, recently, the TargetCompany ransomware unveiled a new variant of malware along with several malicious tools for persistence and covert operations that are gaining traction rapidly.

Cybersecurity researchers at Trend Micro discovered a recent active campaign linking Remcos RAT and TargetCompany ransomware and compared to past samples, the new deployments use fully undetectable packers. 

The telemetry data and the external hunting sources provided the early samples during development. Meanwhile, researchers identified a victim subjected to this targeted technique.

Ransomware Infection chain

Similar to previous cases, the latest TargetCompany ransomware exploits weak SQL servers for initial stage deployment, aiming for persistence via diverse methods, including altering URLs or paths until Remcos RAT execution succeeds.

Infection Chain (Source – Trend Micro)

After initial attempts were stopped, threat actors turned to FUD-packed binaries. Remcos and TargetCompany ransomware’s FUD packer mirrors BatCloak’s style:-

Batch file outer layer, followed by PowerShell for decoding and LOLBins execution.

PowerShell execution of the Remcos RAT (Source – Trend Micro)

Remarkably, this variant incorporates Metasploit (Meterpreter), which is a surprising move for this group. Their usage is quite interesting, serving purposes like:-

  • Query/Add a local account
  • Deploy GMER
  • Deploy IObit Unlocker
  • Deploy PowerTool (or PowTool)

Later, Remcos RAT proceeds to its last phase, downloading and activating TargetCompany ransomware with FUD packing intact.

FUD Packing

An earlier wave exploiting OneNote caught the attention for its new technique involving PowLoad and CMDFile with actual payload. The ‘cmd x PowerShell loader gained popularity and was eventually adopted by TargetCompany ransomware operators in February 2022.

Activity graph (Source – Trend Micro)

The CMDFiles seemed similar initially, used by malware families like:-

  • AsyncRAT
  • Remcos
  • TargetCompany ransomware

Here the differences arise during execution since the AsyncRAT uses decompression and decryption. While the Remcos and TargetCompany loaders solely decompress the payloads.

The examination of PowerShell-related network links reveals a fresh TargetCompany ransomware variant, linked to the second version with ‘/ap.php’ C&C connection.

With the use of FUD, malware threat actors can prevent or evade the security solutions for this new technique, particularly off-the-shelf tech prone to broader threats.

However, it’s been speculated that more packers could emerge. So, early detection aids in preventing FUD packers due to their unusual coding flow.

Recommendations

Here Below we have mentioned all the recommendations:-

  • Enable firewall protection.
  • Ensure limiting access.
  • Make sure to change the default port.
  • Secure Account Management.
  • Always use strong Passwords.
  • Implement account lockout policies.
  • Frequently review and deactivate the unwanted SQL CLR assemblies.
  • Always encrypt data in transit.
  • Make sure to monitor the SQL server activity.
  • Always keep the system and installed software updated with the latest updates and patches.

IoCs

IoCs (Source – Trend Micro)

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.


[ad_2]
Source link
1...1,0191,0201,021...1,482Page 1,020 of 1,482