Those two phones are tipped to arrive on July 10. That’s the rumored launch date. Samsung is seemingly planning to host it that early for several reasons. The Olympics are starting on July 26, and they’re taking place in Paris, where the Unpacked event is also tipped to take place. Both of those days are Wednesdays, by the way.
We’re not sure why Samsung decided to launch the budget Galaxy Z Fold 6 separately, but there you go. Based on this report, it’s coming later on. The company is not aiming at extremely high sales numbers either.
Samsung is not planning to ship out many units of this phone
Samsung is planning to ship out around 200,000-300,000 Galaxy Z Fold 6 FE models. Do note that it’s possible the company will use a different name for the product.
This foldable will launch around the same time the iPhone 16 models are coming. Samsung is probably hoping that it will be able to grab some attention away from Apple’s new devices.
The budget Galaxy Z Fold 6 model is said to be thinner than the regular one, and the regular one will be thinner than the Galaxy Z Fold 5. It’s about time, as other companies have trumped Samsung in that regard at this point, by quite a margin.
The budget variant of the Galaxy Z Fold 6 also won’t come with the S Pen support, unlike the Galaxy Z Fold 6.
Over 900 websites inadvertently expose over 10 million passwords, many of which are in plaintext, alongside sensitive billing information and personally identifiable information (PII) of approximately 125 million users.
This massive data exposure is attributed to misconfigured Firebase instances, a popular development platform for creating mobile and web applications, which, due to its ease of use, has led to widespread security oversights.
The Root of the Problem: Firebase Misconfigurations
Firebase, known for its comprehensive suite of tools that aid developers in building, managing, and growing their apps, has a critical flaw in its security rules configuration.
Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.:
The problem of vulnerability fatigue today
Difference between CVSS-specific vulnerability vs risk-based vulnerability
Evaluating vulnerabilities based on the business impact/risk
Automation to reduce alert fatigue and enhance security posture significantly
AcuRisQ, that helps you to quantify risk accurately:
The platform allows for easy misconfiguration with zero warnings, leading to hundreds of sites exposing user records.
This issue came into the spotlight following the initial investigation into Chattr.ai, prompting a more extensive scan for exposed PII across the internet due to misconfigured Firebase instances.
The Hunt for Exposed Data
The quest to uncover the extent of this exposure began with a rudimentary scanner developed in Python, designed to check for Firebase configuration variables in websites or their loaded JavaScript bundles.
However, this approach quickly hit a roadblock as the program began to run out of memory within an hour of its operation.
A subsequent version of the scanner, rewritten in Go by a team member known as Logykk, proved more efficient, not suffering from the memory leak issues of its predecessor.
Despite the improved efficiency, the scanning process was a waiting game. It was initially estimated to take around 11 days but extended to 2-3 weeks to comb through 5 1/2 million domains.
The team also undertook the painstaking task of manually checking each domain, a time-consuming and repetitive process.
A recent report by env has revealed that around 900 websites have inadvertently exposed over 10 million passwords, including sensitive billing information and personally identifiable information (PII) of approximately 125 million users.
Catalyst: The Secondary Scanner
The breakthrough came with the introduction of Catalyst. This secondary scanner automated checking for read access to common Firebase collections and those explicitly mentioned in the JavaScript itself.
Private database table
This tool not only identified accessible collections but also assessed the impact of the exposed data by sampling 100 records and extrapolating the findings across the total size of the collection.
The findings were stored in a database using Supabase, an open-source competitor to Firebase, chosen with a touch of irony.
The database contained detailed records of the exposed data, including project IDs, website URLs, counts of names, emails, phone numbers, hashed passwords, plaintext passwords, and billing information.
The Alarming Numbers
The scan revealed staggering numbers:
Total records exposed: 124,605,664
Names: 84,221,169
Emails: 106,266,766
Phone Numbers: 33,559,863
Passwords: 20,185,831 (with a significant portion in plaintext)
Billing Info: 27,487,924
Notable Sites Affected
Among the most affected were:
Silid LMS: A learning platform with 27 million affected users, leading in total exposed user records.
Silid LMS
Online gambling network: Featuring rigged games and the most exposed bank account details and plaintext passwords.
Online gambling network
Lead Carrot: An online lead generator with 22 million affected people.
Lead Carrot
MyChefTool: A restaurant business management app, leading in exposed names and emails.
MyChefTool
The team’s efforts to notify the affected sites resulted in 842 emails sent over 13 days, with an 85% delivery rate.
However, only 24% of site owners fixed the misconfiguration, and only 1% responded to the emails.
Alarmingly, only two site owners offered a bug bounty in response to the findings.
This extensive investigation illuminates the critical need for better security practices and awareness among developers using platforms like Firebase.
It also underscores the importance of automated tools in identifying and mitigating data exposure risks on the Internet.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
A 42-year-old manager at an unnamed telecommunications company has admitted SIM swapping customers at his store.
SIM swapping, also known as SIM jacking, is the act of illegally taking over a target’s cell phone number and re-routing it to a phone under the attacker’s control.
Once an attacker has successfully hijacked their victim’s mobile number, they can use it to send and receive calls and messages (and the victim can’t). For that reason, SIM swapping can be used to get around two-factor authentication (2FA) codes sent by SMS message. Armed with an email and password—which are easily bought online— and the 2FA code, an attacker could take over the victim’s online accounts.
SIM swapping can be done in a number of ways, but perhaps the most common involves a social engineering attack on the victim’s carrier. However, if you have a telecoms manager on your payroll then there’s no need for social engineering—they can just do the SIM swap for you.
In May 2021, Jonathan Katz, aka “Luna” was employed as a manager at a telecoms store. Using managerial credentials, he swapped the SIM numbers associated with customers’ phone numbers into mobile devices controlled by another individual, enabling this person to control the customers’ phones and access the customers’ electronic accounts – including email, social media, and cryptocurrency accounts.
In exchange, Katz received $1,000 per SIM swap and a percentage of the revenue from the compromised phone number. He was paid in Bitcoin, which was traced back to Katz’s cryptocurrency account.
Katz pleaded guilty before Chief U.S. District Judge Renée Marie Bumb in Camden federal court on March 12, 2024, to a charge of conspiracy to gain unauthorized access to a protected computer.
Katz was charged for SIM swapping five numbers. He’s now facing a statutory maximum of five years in prison and a fine of up to $250,000. Sentencing is scheduled to take place on July 16, 2024.
What to do if you are a victim of SIM swapping
In this case, being careful online would not have helped the victims to prevent the SIM swap. However there are some things that are tell-tale signs of a SIM swapping attack and some things you can do to limit the consequential damage.
If your mobile number suddenly is inactive or out of range, call your mobile operator immediately.
Check your online accounts immediately if you receive a notification about unusual activity. Contact the account provider if you find you no longer have access yourself.
If you can, register for email alerts as well as SMS for your banking transactions, so you continue to receive alerts via your email in case your SIM is deactivated.
If you fall victim to a SIM hijacking attempt, change the passwords for services like your online banking and email immediately.
If you notice irregular transactions, contact your bank to have your account blocked and avoid further fraud.
Contact your cellular service provider so they can stop the attacker by cutting off their access to the mobile network.
Consider setting up 2FA on dedicated authentication apps (such as Google Authenticator) or hardware, rather than using SMS.
If you want to find out how much of your data has been exposed online, you can try our free Digital Footprint scan. Fill in the email address you’re curious about (it’s best to submit the one you most frequently use) and we’ll send you a free report.
We don’t just report on threats – we help safeguard your entire digital identity
Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using Malwarebytes Identity Theft Protection.
Reddit’s involvement with the Federal Trade Commission (FTC) over its AI data licensing programs marked a significant event, as the company acknowledged the FTC’s scrutiny ahead of its anticipated initial public offering (IPO). The FTC’s probe into Reddit’s AI data licensing practices, encompassing concerns over whether these activities constitute unfair or deceptive practices under Section 5 of the FTC Act, became a focal point for the tech and investing communities alike.
This investigation by the FTC, sparked by unique concerns regarding the novel nature of AI technologies and their commercial agreements, not only sheds light on Reddit’s operational practices but also underscores the broader industry’s challenges at the intersection of AI, data privacy, and competition. With other companies also receiving ‘hold letters’ from the FTC, the probe into Reddit’s AI data licensing schemes represents a crucial juncture for regulatory oversight in the rapidly evolving digital landscape.
Background of Reddit’s IPO and FTC inquiry
Reddit plans to price its shares between $31 and $34 in its IPO, targeting a valuation of approximately $6.5 billion. Moreover, The company aims to raise $748 million through the IPO, which could be influenced by the ongoing FTC inquiry.
The FTC is investigating Reddit’s AI data-licensing practices, particularly the sale, licensing, or sharing of user-generated content with third parties for AI model training. Furthermore, concerns revolve around whether these practices constitute unfair or deceptive practices under Section 5 of the FTC Act.
Reddit has entered into a significant $60 million-a-year deal with Google for data sharing aimed at AI model training. Certainly, despite the FTC’s investigation potentially affecting Reddit’s partnerships with AI companies, the company views sharing content with AI entities as a promising new revenue stream.
Impact of AI Data Licensing on Reddit’s revenue
The FTC’s investigation into Reddit’s AI data licensing has brought to light the platform’s strategic moves within the AI market, a sector projected to reach $1 trillion by 2027, excluding China and Russia. Reddit’s engagement in this burgeoning market is underscored by its significant agreements for data licensing, notably its $60 million yearly deal with Google, which is pivotal for AI model training. This section delves into the financial implications of these ventures.
Reddit anticipates generating $66.4 million from AI data licensing contracts, marking a small yet growing revenue stream. Moreover, the bulk of this revenue is attributed to the $60 million annual contract with Google, emphasizing the tech giant’s role in Reddit’s AI data strategy.
Incorporating Bitcoin and Ether into its financial portfolio, Reddit aligns its revenue strategies with AI and digital currency markets. With AI data licensing contracts totaling $203 million over three years, Reddit is positioning itself to capitalize on the expanding AI market.
The ongoing FTC probe focuses on the fairness and transparency of Reddit’s data licensing practices, with potential implications for the platform’s operational policies. However, despite the financial promise of data licensing, Reddit asserts its efforts do not compromise its values or the rights of its community.
This financial exploration reveals how Reddit’s AI data licensing endeavors are not only a testament to its innovative revenue strategies but also highlight the regulatory challenges and ethical considerations inherent in navigating the AI landscape.
Responses and reactions
In the wake of Reddit’s AI data licensing programs, responses from the platform’s community have been notably vocal. They are highlighting concerns over privacy and the ethical use of user-generated content.
Privacy advocates and Reddit users have voiced apprehension regarding the use of their content for AI model training. The primary contention revolves around the subversion of user expectations and potential privacy violations. It is raising questions about the transparency and consent mechanisms in place for such data usage.
The summer of 2023 witnessed a significant protest from Reddit moderators, a direct response to the platform’s data-licensing endeavors. This widespread movement underscored the community’s dissatisfaction and apprehension towards the commercial use of user-generated content without explicit consent or adequate compensation, marking a pivotal moment in the platform’s community relations.
TikTok confirmed early this month that its Creativity Program will be leaving beta beta with some improvements and a new name. Today, the change has been officialized with the introduction of the new Creator Rewards Program, which replaces the beta program.
The new Creator Rewards Program will continue to reward high-quality and original content (over a minute long) using an optimized rewards formula that takes into consideration four major aspects: originality, play duration, search value and audience engagement.
TikTok says that the new formula will also automatically reward creators for their account’s ad value determined by their community’s ad watchtime.
Along with the new Creator Rewards Program, TikTok also released some improvements to the dashboard to offer creators updated analytics and data, as well as more customization for deeper analysis of their content performance, estimated rewards, qualified views, and program eligibility.
The updated Creator Rewards Program dashboard features dedicated pages for each video, which will include information about RPM and qualified video views. Additionally, TikTok announced that creators will have access to their last payouts for reliable records of their previous and upcoming earnings.
Of course, not everyone will be able to benefit from the rewards offered by this program. To be eligible for the Creator Rewards Program, creators must be at least 18 years old, have at least 10K followers with a minimum of 100K views in the last 30 days, and have a personal account in good standing where the program is available.
The database includes indicators of compromise (IOCs) and relationships between different artifacts observed within an analysis session. In October 2022, ANY.RUN launched TI Threat Intelligence Feeds to allow users to utilize this data.
Security experts assess threats using ANY.RUN, an interactive malware sandbox, and the data collected from these analyses is used to build a threat intelligence database.
TI Lookup’s introduction in February 2023 further improved this capability by enabling users to recognize threats even from lone indicators that other security solutions might not.
You can learn here about how ANY.RUN built Threat Intelligence Lookup.
ANY.RUN’s Approach to Indicator Analysis
An interactive sandbox environment allows for deep analysis of malware behavior. Suspicious files are executed within the sandbox, mimicking real-world scenarios that enable malware observation throughout its stages, including fetching payloads, encrypting files, or stealing data.
Analysts can even trigger the malware manually by simulating user actions such as entering passwords or solving CAPTCHAs.
The comprehensive analysis captures various indicators, including memory dumps, network traffic between the malware and its command-and-control server, and MITRE ATT&CK tactics.
Around 30 event-specific details are collected, encompassing file and registry information, command line activity, HTTP response content, and more, which provides a thorough understanding of the malware’s entire attack cycle.
Document
Integrate ANY.RUN in Your Company for Effective Malware Analysis
Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:
Real-time Detection
Interactive Malware Analysis
Easy to Learn by New Security Team members
Get detailed reports with maximum data
Set Up Virtual Machine in Linux & all Windows OS Versions
Interact with Malware Safely
If you want to test all these features now with completely free access to the sandbox:
Origins of ANY.RUN’s IOCs
ANY.RUNutilizes a global community of analysts to gather indicators of compromise (IOCs) through public sandbox submissions.
Daily, around 14,000 samples are uploaded, often stemming from suspicious activity detected by Security Information and Event Management (SIEM) logs or email investigations.
Analysts configure a sandbox environment mimicking real-world conditions and run the sample; during the 1200-second interactive analysis, the sandbox captures process activity and network events and extracts IOCs like file hashes, domains, IP addresses, and URLs.
Comprehensive data collection from global submissions fuels ANY.RUN’s threat intelligence database currently stores a massive 24TB of information on evolving malware threats.
Boosting Security with ANY.RUN Threat Intelligence
The solution offers a threat intelligence (TI) feed and a lookup portal, providing access to a constantly updated database of malware information that leverages data from over 1.5 million investigations by community and in-house analysts, allowing you to
Access the latest community-reported and analyst-discovered malware data.
Search across various aspects (fields) of 1.5 million investigations conducted in the past 6 months.
To identify risks, analyze command lines, registry changes, memory dumps, encrypted and unencrypted network traffic, and more.
It offers threat intelligence in two formats:
Threat Intelligence Lookup – Search our portal for relevant events using 30 criteria. Use wildcards (*) or widely to search substrings. With rapid search, you will get results in 5 seconds. The attached IOCs and event fields include links to recorded sandbox research sessions.
Threat Intelligence Feeds – Receive STIX data from our Feeds directly into your TIP and SIEM systems. Set up firewalls for the current threats. New data provides indications and event fields for context every two hours.
TI Lookup examines a massive database of Indicators of Compromise (IOCs) and related events across numerous parameters. Wildcards allow wide or particular searches, and results, including linked research sessions, are supplied in seconds.
SIEM systems can use TI Feeds’ continuous threat data in STIX format and every two hours, IOCs and event details are added for threat analysis.
What is ANY.RUN?
ANY.RUNis a cloud-based malware lab that does most of the work for security teams. 400,000 professionals use ANY.RUN platform every day to look into events and speed up threat research on Linux and Windows cloud VMs.
Advantages of ANY.RUN
Real-time Detection: ANY.RUN can find malware and instantly identify many malware families using YARA and Suricata rules within about 40 seconds of posting a file.
Interactive Malware Analysis: ANY.RUN differs from many automated options because it lets you connect with the virtual machine from your browser. This live feature helps stop zero-day vulnerabilities and advanced malware that can get past signature-based protection.
Value for money: ANY.RUN’s cloud-based nature makes it a cost-effective option for businesses since your DevOps team doesn’t have to do any setup or support work.
Best for onboarding new security team members: ANY. RUN’s easy-to-use interface allows even new SOC researchers to quickly learn to examine malware and identify signs of compromise (IOCs).
Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free
The HONOR Magic6 Pro jumps at the top of DXOMARK camera rankings
It does lead by one point only, but still, it’s alone at the top. The HONOR Magic6 Pro managed to score 158 points in the camera department, overall. The OPPO Find X7 Ultra and Huawei Mate 60 Pro+ are following with 157 points.
The Huawei P60 Pro is third-placed with 156 points, while the iPhone 15 Pro Max and iPhone 15 Pro are following with 154 points each. The Google Pixel 8 Pro is seventh-placed with 153 points, and so on.
The HONOR Magic6 Pro did a fantastic job in DXOMARK’s tests, and that’s easy to believe considering that we tested the phone’s cameras too. We were very impressed in our review, in case you’re interested.
It reached very high ratings in many categories
In any case, the HONOR Magic6 Pro managed to score very high ratings in Exposure, Color, Autofocus, Noise, Artifacts, Bokeh, Telephoto, Wide… and a number of other camera subcategories laid out by DXOMARK, as you can see below.
The ‘Preview’ section was not as high as the rest, and the same goes for ‘Artifacts’. The phone did a great job both indoors and outdoors, and it held its own in low-light conditions too.
DXOMARK highlighted “vivid and natural colors in both photo and video”. It also praised the phone’s detail at most zoom settings and its great and fast autofocus. Portrait images were commended too, as was the performance in wide depth of field scenes. DXOMARK also praised a wide dynamic range and accurate face exposure in both photo and video.
Some ‘Cons’ were mentioned too
As ‘Cons’, several things were mentioned. Unnatural detail rendering in photo, zoom, and video. Sharpness differences between video frames while recording were also mentioned, and some artifacts in high-contrast scenes. Motion blur on portraits in very low light scenes was also mentioned under ‘Cons’.
All in all, the HONOR Magic6 Pro did a fantastic job, which is not exactly surprising. You can read the full report here.
A new variant of the WhiteSnake Stealer, a formidable malware that has been updated to be more elusive and efficient in its malicious endeavors.
One of the key features of the updated WhiteSnake Stealer is its use of mutexes (mutual exclusions).
Mutexes are a common programming practice to prevent the same program from being launched multiple times, which can lead to system instability or make the malware more detectable.
Performing mutex check
Upon execution, the stealer checks for a specific mutex value predefined in its configuration file.
If this mutex is already present on the system, indicating that an instance of the stealer is running, the newly executed stealer will terminate itself.
This ensures that only one instance of the malware operates at a time, reducing the risk of detection and system resource exhaustion.
Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.:
The problem of vulnerability fatigue today
Difference between CVSS-specific vulnerability vs risk-based vulnerability
Evaluating vulnerabilities based on the business impact/risk
Automation to reduce alert fatigue and enhance security posture significantly
AcuRisQ, that helps you to quantify risk accurately:
Security researchers often use virtual machines (VMs) to analyze malware behavior in a controlled environment.
To combat this, WhiteSnake Stealer can be configured to detect the presence of VMs and terminate itself if one is found.
Performing AntiVM check
The stealer uses a WMI query to retrieve the computer system’s “Model” and “Manufacturer” properties.
It then searches for strings that are typically associated with virtual environments, such as “VMware,” “virtual,” and “qemu.”
If any of these strings are detected, the stealer will exit, thwarting any attempt to analyze or reverse-engineer its code.
According to the latest findings by SonicWall Capture Labs’ threat research team, WhiteSnake Stealer malware has emerged, showcasing less obfuscation and increased danger.
Advanced-Data Exfiltration Capabilities
Following the Anti-VM check, the malware proceeds to its primary function: data theft.
The Create() function is called, leading to the ProcessCommands() function, designed to siphon sensitive data from various sources.
The WhiteSnake Stealer targets a wide range of web browsers, including mainstream options like Google Chrome, Mozilla Firefox, and Microsoft Edge, as well as less common ones like Vivaldi and CocCoc Browser.
In addition to web browser data, the stealer is programmed to target cryptocurrency wallets to capture the lucrative financial information associated with these assets.
The table below shows the targeted cryptocurrency wallets and browser extensions.
Beyond its sophisticated evasion techniques, WhiteSnake Stealer boasts a range of functionalities designed to harvest sensitive data from infected systems.
While keylogging is disabled by default, attackers can activate this feature remotely and capture every keystroke of the victim.
Moreover, the malware can hijack the victim’s microphone and webcam, turning personal devices into surveillance tools.
Part of the code responsible for keylogging
The new variant of WhiteSnake Stealer demonstrates the continuous innovation by cybercriminals to bypass security measures and remain undetected.
Implementing mutexes and anti-VM techniques, along with its comprehensive data theft capabilities, make it a significant threat to users and organizations.
As the cyber threat landscape evolves, it is crucial for cybersecurity professionals and end-users to stay informed about the latest malware trends and to implement robust security measures to protect sensitive information.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
The Vivo X Fold 3 series launch date has been confirmed, it’s in exactly a week
These two phones have been making the rounds for quite some time now. Vivo not only confirmed that these two phones are coming, but the Vivo Pad 3 Pro and VIvo TWS 4 earbuds too.
In fact, the company actually showed off the designs of all these devices via its Weibo profile. You can check out all the aforementioned devices in the gallery below.
The Vivo X Fold 3 series will be the star of the show, though, of course. Only one design got shared, and it’s possible that the devices will look the same. If not the same, then extremely similar.
The Snapdragon 8 Gen 3 is confirmed to fuel the two phones
VIvo brand Vice President and General Manager of Brand and Product, Jiajing Dong, confirmed that the Snapdragon 8 Gen 3 will fuel the Vivo X Fold 3 series. We did already see a bunch of rumors regarding its specs.
You can expect an 8.03-inch Samsung E7 display as the main panel here. It will be an AMOLED LTPO display with an adaptive refresh rate. The cover display will be a 6.53-inch AMOLED unit with a 120Hz refresh rate.
The company’s self-developed V3 imaging chip will be included in the package too. The devices will offer up to 16GB of LPDDR5X RAM (or that could be the only variant). UFS 4.0 flash storage will also be on offer.
Android 14 will come pre-installed, along with rather compelling cameras
Android 14 will come pre-installed, with Vivo’s OriginOS 4 in China. ZEISS+ T* lens will be included in the package too. A 50-megapixel main camera (OV50H sensor, OIS) is tipped. The same goes for a 50-megapixel ultrawide unit, and a 64-megapixel periscope telephoto camera (3x optical zoom, OV64B sensor).
A 5,800mAh battery could be included on the inside, with support for 120W wired charging. 50W wireless charging was also mentioned, as was reverse wireless charging. The phones are also tipped to include two ultrasonic fingerprint scanners.
AhnLab security researchers detected a resurgence of CryptoWire, a ransomware strain originally prevalent in 2018, built with the AutoIt scripting language, which primarily spreads through phishing emails.
Unlike most ransomware, CryptoWire reportedly includes the decryption key within its code, while recovering encrypted files likely requires a complex process.
Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.:
The problem of vulnerability fatigue today
Difference between CVSS-specific vulnerability vs risk-based vulnerability
Evaluating vulnerabilities based on the business impact/risk
Automation to reduce alert fatigue and enhance security posture significantly
AcuRisQ, that helps you to quantify risk accurately:
Main Features:
The ransomware installs itself in a common location (“C:\Program Files\Common Files”) to ensure persistence, schedules tasks to maintain its presence on the system, and then scans the local network and connected devices to encrypt files, potentially compromising the entire network.
Registered task schedule
Encrypted files are renamed with the “.encrypted” extension, and a log file named “domaincheck.txt” is saved on the desktop, possibly containing compromised system information.
A partial source code related to the expansion of encryption
According to ASEC, the malware emptied the recycle bin and deleted shadow copies to hinder data recovery. Finally, a ransom message is displayed, demanding payment for decryption.
Ransomware can include the decryption key within itself or send it along with stolen system information to the attacker’s server.
This method is uncommon, as most ransomware forces users through a complex decryption process to regain access to their files.
Preventing decryption
To avoid infection, users should exercise caution when opening unknown files and utilize up-to-date anti-malware software to scan suspicious files.
The system has been infected with multiple threats as a Trojan downloader (Trojan/Win.Kryptik.C5576563) was detected on January 20th, 2024, which could have downloaded other malware.
More recently, on February 20th, 2024, ransomware (Ransomware/Win.bcdedit.C5590639) was also found, which likely encrypts files and demands a ransom for decryption.
Malware behavior consistent with ransomware execution (MDP.Ransom.M1171) was additionally detected.
An analysis of the Indicators of Compromise (IoCs) revealed two MD5 hashes (cd4a0b371cd7dc9dab6b442b0583550c and a410d4535409a379fbda5bb5c32f6c9c) that could be used to identify malicious files.
A C2 server address (hxxp://194.156.98[.]51/bot/log.php) was found to likely communicate with the malware to receive instructions or send stolen data, as immediate action is required to remove this malware and protect the system.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
.webp)
.webp)
.webp)
.webp)
.webp)