Nubia unveils Z60 Ultra Leading Version and Z60S Pro with AI

andreasc
-
0
Nubia unveils Z60 Ultra Leading Version and Z60S Pro with AI
[ad_1]

Nubia has launched two new flagship Android smartphones, the Nubia Z60 Ultra Leading Version and the Nubia Z60S Pro. The phones come with AI features, including advanced AI imaging technologies. The ZTE subsidiary has opened pre-orders for the phones, with general sales beginning on August 12.

Nubia Z60 Ultra Leading Version official with overclocked chip and AI features

The Nubia Z60 Ultra Leading Version is an upgraded version of the Z60 Ultra launched in December last year. The device got its name from its processor, the Snapdragon 8 Gen 3 Leading Version. This special edition Qualcomm chipset has a faster CPU and GPU. Its Cortex-X4 prime CPU core is clocked at 3.4GHz against the standard version’s 3.3GHz. The Adreno 750 GPU operates at a boosted frequency of 1GHz.

According to Nubia, the new phone’s dedicated AI engine delivers a total computing power of up to 73 TOPS (Tera Operations per Second). It can run large language models with up to 10 billion parameters on the device, ensuring superfast on-device AI performance. The device’s 6,000mAh battery and AI ‘Zero’ power consumption 2.0 technology ensure long battery life even when you push it to its limits.

Apart from a faster CPU, a faster GPU, and advanced AI capabilities, the Nubia Z60 Ultra Leading Version seemingly packs the same set of specs as the standard Z60 Ultra. You get a 6.8-inch AMOLED display with an under-display selfie camera and an optical under-display fingerprint scanner. The phone boasts an IP68 certification for solid protection against dust and water and features a Custom Sliding Shortcut design.

Nubia has equipped the device with three cameras on the back, all with OIS (Optical Image Stabilization) and NeoVision AI Photography System 2.0. There’s a 50MP main shooter, a 64P zoom camera (3.3x optical zoom), and a 50MP ultrawide lens. The Nubia Z60 Ultra Leading Version can record 8K videos and offers a wide range of AI features for enhanced camera output, including AI Flash Capture and AI Telephoto.

Nubia Z60S Pro makes AI imaging more affordable

The Nubia Z60S Pro is a more affordable Android flagship (see prices below) with powerful AI imaging capabilities. It offers more or less the same camera experience as the Z60 Ultra. Its Snapdragon 8 Gen 2 processor may not be able to handle AI features as efficiently as the Gen 3, though. Nubia has paired the chipset with up to 16GB of LPDDR5X RAM and 1TB of UFS 4.0 storage, the same as the Z60 Ultra. The phone has a 5,100mAh battery and boasts the same power technology.

Nubia has equipped the Z60S Pro with a 1.5K super retina-grade resolution AMOLED display that can show the true colors of the images you capture with its amazing cameras. The handset features new Longxi Durable Glass on the front. The firm says it offers enhanced screen durability thanks to its robust resistance to drops and scratches. Both new Nubia phones run Android 14 out of the box. The Z60 Ultra comes in Black and Silver colors and the Z60S Pro in Black, Aqua, and White colors.

Price and availability

The Nubia Z60 Ultra Leading Version and Nubia Z60S Pro are available for pre-order globally starting today, July 23. Prices of the Z60 Pro start at $649/£649/€729 for the 8GB+256GB variant. Its top-tier model (16GB+1TB) costs $879/£929/€979. The Z60S Pro costs $569/£569/€669 for the 12GB+256GB variant (no 8GB variant) and goes up to $769/£769/€869 for the 16GB+1TB model. General sales begin globally on August 12. Nubia has region-specific early bird offers for pre-orders.


[ad_2]
Source link

Beware Of Dating Apps Exposing Your Personal & Location Details

andreasc
-
0
Beware Of Dating Apps Exposing Your Personal & Location Details
[ad_1]

Threat actors often attack dating apps to steal personal data, including sensitive data and location details, which can be used in identity theft, blackmailing people, or other malicious activities.

Since these applications are a goldmine of personal experiences and chats, hackers consider them as lucrative options for their malicious activities.

Cybersecurity researchers at DistriNet Research Unit recently analyzed the usability of establishing accounts, data transfer methods, and confidentiality clauses in 15 popular dating applications. 

In their analysis, they identified that location-based dating apps expose users to privacy risks by sharing personal and sensitive information with potential matches.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

Dating Apps Exposing Location Details

Location-based dating (LBD) apps are mobile applications that use proximity and user preferences to suggest potential partners for romantic or social purposes.

This assessment studied the data collection techniques and privacy controls used by 15 renowned LBD apps and their susceptibility to location inference attacks.

Here below, we have mentioned the 15 apps that are analyzed:-

  • Tinder
  • Badoo
  • POF
  • MeetMe
  • Tagged
  • Grindr
  • Tantan
  • Jaumo
  • LOVOO
  • happn
  • Bumble
  • Hinge
  • Hily
  • OkCupid
  • Meetic

A large number of applications collect personal and sensitive information about users, such as demographic characteristics, sexual orientation, and health records.

As others require some fields to be filled before they create profiles.

A few applications had weak points, like trilateration, that made it easy to locate individuals using them and helped reveal their exact positions. Also, some apps had API vulnerabilities, which disclosed hidden data.

This highlights how unsafe LBD can be and also showcases the need for enhanced protection for personal data, more user openness, and better security policies within this fast-growing segment of online dating services.

While most LBD app privacy policies do matter, the level of their detail and transparency varies significantly.

Although many policies admit processing sensitive data and location information, they often fail to provide any specific privacy controls or potential risks.

Besides this, notable differences exist between stated policies and actual app behaviors, particularly regarding location permissions, profile visibility options, and data-sharing practices.

For example, only 3 out of 15 apps claim that they need geolocation permission to run on a device, contrary to their policies.

Furthermore, only two apps state exactly which user data is visible to others.

The research shows that some applications leak data through API vulnerabilities, which counter their privacy guarantees.

These results emphasize how far apart privacy policy declarations can be from the actual handling of personal information in LBD apps.

This indicates an urgent need for greater transparency, better user management tools, and greater openness between policy statements and real-life protection arrangements.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo


[ad_2]
Source link

These Samsung Galaxy flagships are optimized for Dark And Darker Mobile

andreasc
-
0
These Samsung Galaxy flagships are optimized for Dark And Darker Mobile
[ad_1]

Well, all of Samsung’s flagship smartphones for the year have launched. We’re talking about the Galaxy S24 series, Galaxy Z Fold 6, and Galaxy Z Flip 6. These are powerful gaming devices, yes, but Samsung saw to it to make them the best. According to a new report, Samsung optimized its latest flagship phones for Dark And Darker Mobile.

In case you’ve been living under that proverbial rock for the past two weeks, Samsung unveiled its latest foldable phones, the Galaxy Z Fold 6 and Galaxy Z Flip 6. What they lack in hardware and visual changes, they make up for in new AI tools and other goodies. If you’re interested in learning about these devices, we have a ton of information on them. For example, you can read our Galaxy Z Fold 6 review.

Pre-order the Galaxy Z Fold 6

Pre-order the Galaxy Z Flip 6

Samsung optimized its latest flagship to run Dark And Darker Mobile

Sometimes, it doesn’t matter how powerful a device is, optimization is key. For example, Genshin Impact is a great-looking game, and a bit more graphically intensive than Honkai Star Rail, but the latter doesn’t run as smoothly on devices. That’s because Genshin is better optimized than Star Rail.

Dark And Darker Mobile is a pretty graphically intensive game in the Google Play Store, and most phones running the best hardware should run it smoothly. However, Samsung decided to take this to the next level. Its phones are optimized to run this game smoothly, so you shouldn’t expect any hiccups, but it goes further than that.

Thanks to this collaboration, you’ll use Vulkan 3D graphics, which will look nice. Also, this partnership brings ray tracing to this game. That’s pretty big, but not too many people recognize Samsung’s ray tracing tech.

This partnership also brought something that foldable users have been struggling with. Most of the time, when you play a game with the screen folded and then unfold it, the game will still think that it’s folded and display accordingly. However, Darker And Darker Mobile will change the way it’s displayed when you open the phone and vice versa.

There’s a catch

One thing to note is that these optimizations may not be available everywhere. These were for the phone running the Snapdragon 8 Gen 3 for Galaxy SoC. This means that the phones running the Exynos 2400 could be left out. So, some users with the Galaxy S24 and Galaxy S24+ might be left out in the rain.

If you’re interested in trying Dark And Darker, it’s in beta, and the first global test will start on Thursday, August 1st.

Download Dark And Darker Mobile


[ad_2]
Source link

xMEMs and AMPACS collaborate for a 2-way headphone design

andreasc
-
0
xMEMs and AMPACS collaborate for a 2-way headphone design
[ad_1]

Companies do a great job of innovating and pushing the audio industry forward, but sometimes, nothing pushes the industry further than a collaboration between companies. xMEMs and AMPACS partnered to bring a two-way over-the-ear headphones reference design. This is an industry-first.

It’s important to note that we’re not talking about a pair of headphones like most other companies. We’re talking about a reference design for headphones. Think of reference designs as templates that companies can use to build their headphones around. The companies can make changes, but the reference design can be the infrastructure that they build around.

xMEMS and AMPACS partnered to bring the first two-way over-the-ear headphone reference design

xMEMs and AMPACS are two popular companies in the audio industry. The former is a company that designs high-quality solid-state MEM microspeakers. They’re designed to be smaller than typical conical drivers. This means that headphones can be smaller. Also, companies can fit more drivers into the headphones that focus on different frequencies, leading to better audio overall.

AMPACS is a brand that offers several business and design solutions for companies that want to develop headphones. In this partnership, AMPACS will use xMEMS’ Cowell microspeaker. This is the smallest microspeaker from the company, but that doesn’t mean that it’s not a quality driver.

Along with that microspeaker, the reference design will also use AMPACS’ Dynamic Driver. The Cowell driver will handle the high and mid-tones while the Dynamic Driver will handle the bass. This driver is a smaller-than-usual (for high-end headphones) 40mm, and it will create a rich and nuanced sound.

Benefits of this design

This two-way design benefits the audio much more than any single-driver solution. There will be separation between the highs/mids and bass. Audiophiles will enjoy them along with gamers and casual listeners.

The dedicated Cowell driver will boost the higher tones so that you can expect cleaner vocals. The Dynamic Driver can be individually tuned to produce a sound that compliments the higher tones.

This is a convenient and modular design that headphone makers can use with several types of headphones. These include open-back, closed-back, wired, and wireless. It’s a versatile reference design.

Also, this design means that the headphones being built can be smaller. This means that they can be more lightweight and comfortable to wear for extended periods of time.

The materials used will replace the graphene materials used in traditional speakers. This, depending on the materials used, might actually cut the cost of production. Those cost savings may possibly lead to more affordable headphones. Again, that depends on the company making the consumer-facing product.

A solid-state future

xMEMS is aiming toward a future where solid-state drivers are the default across the industry. “…in creating this 2-way design, we’re moving the headphone market one step closer to a solid-state future“, stated xMEMS’ VP of Marketing and Business Development Mike Housholder.

There are several different types of microspeakers on the market, and many of the cheaper headphones still use the standard conical speaker design. However, xMEMS is looking to change that. This partnership might be the next step toward that future.

If you’re interested in looking at this reference design, click the link below.

Contact AMPACS for reference design


[ad_2]
Source link

Two Russian Nationals Charged for Cyber Attacks against U.S. Critical Infrastructure

andreasc
-
0
Two Russian Nationals Charged for Cyber Attacks against U.S. Critical Infrastructure
[ad_1]

The United States has designated Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko, two members of the Russian hacktivist group Cyber Army of Russia Reborn (CARR), for their roles in cyber operations targeting U.S. critical infrastructure.

Pankratova, the group’s leader, and Degtyarenko, a primary hacker, have been implicated in a series of cyber-attacks that severely threaten public safety and national security.

Targeting Critical Infrastructure

Since 2022, CARR has been known for conducting low-impact, unsophisticated DDoS attacks in Ukraine and against entities in countries supporting Ukraine.

However, the group’s activities escalated in late 2023 when they began targeting industrial control systems of critical infrastructure in the U.S. and Europe.

These attacks included manipulating equipment at water supply, hydroelectric, wastewater, and energy facilities.

One notable incident occurred in January 2024, when CARR claimed responsibility for overflowing water storage tanks in Abernathy and Muleshoe, Texas.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

The group posted videos of their manipulation of human-machine interfaces at these facilities, resulting in the loss of tens of thousands of gallons of water.

Additionally, CARR compromised the SCADA system of a U.S. energy company, gaining control over alarms and pumps.

Despite these breaches, significant damage was avoided due to the group’s lack of technical sophistication.

Profiles of the Accused

Pankratova, also known as “YUliYA” online, is identified as the leader and spokesperson of CARR. She commands and controls the group’s operations, orchestrating various cyber-attacks.

Degtyarenko, known as “Dena” online, is a primary hacker within the group. He was responsible for compromising the SCADA system of a U.S. energy company and has developed training materials on how to breach such systems, potentially intending to distribute them to other malicious actors.

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has designated Pankratova and Degtyarenko under Executive Order 13694, as amended.

This designation is for their involvement in cyber-enabled activities outside the United States that pose significant threats to national security, foreign policy, or economic stability.

Sanctions and Implications

As a result of this designation, all property and interests in property of the designated individuals within the U.S. or controlled by U.S. persons are blocked and must be reported to OFAC.

Furthermore, any entities owned 50 percent or more by these individuals are also blocked. U.S. persons are generally prohibited from engaging in transactions involving the property or interests of these designated individuals unless authorized by OFAC.

Financial institutions and other entities engaging in transactions with the sanctioned individuals may expose themselves to sanctions or enforcement actions. The prohibitions include providing or receiving funds, goods, or services to or from the designated persons.

OFAC emphasizes that the goal of sanctions is not punitive but to induce positive behavioral changes. The OFAC website provides detailed information and processes for those seeking removal from the sanctions list.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link

Google Personal Safety app could stop working on older Android phones (Pixels excluded)

andreasc
-
0
Google Personal Safety app could stop working on older Android phones (Pixels excluded)
[ad_1]

Google’s Personal Safety app has been around for a few years now, and it seems some of the older phones won’t support it anymore. The folks at Android Authority managed to dig into the code of the Personal Safety app and find that it now supports Android 12 or later devices.

Introduced initially as a Pixel-exclusive feature, Personal Safety moved on to other phones as well (certain releases are not available on older hardware though). It manages emergency contact info, prompts safety check-ins, and even automatically detects car crashes.

Right now, Google has three variants of the app: one for older Pixels, one for Pixel 4 and newer, and one for third-party OEMs. And now, all of a sudden the most recent builds for the latter two versions will start requiring Android 12 or later, instead of Android 10 or later.

This will probably not going to have a huge impact on the majority of Personal Safety users. Pixel users won’t see any changes, and only older third-party phones will reportedly stop supporting it. But of course, there will always be those who use the app on an older Android phone and they won’t be happy when they find out about this.

But the thing is, safety isn’t always about avoiding accidents, it’s also about preventing security breaches on your phone. That is related to your device running the most up-to-date software as well. So maybe for some people, it is time to get an upgrade.

Izzy, a tech enthusiast and a key part of the PhoneArena team, specializes in delivering the latest mobile tech news and finding the best tech deals. Her interests extend to cybersecurity, phone design innovations, and camera capabilities. Outside her professional life, Izzy, a literature master’s degree holder, enjoys reading, painting, and learning languages. She’s also a personal growth advocate, believing in the power of experience and gratitude. Whether it’s walking her Chihuahua or singing her heart out, Izzy embraces life with passion and curiosity.


[ad_2]
Source link

NCA Shut’s Down the Most Popular “digitalstress” DDoS-for-hire Service

andreasc
-
0
NCA Shut’s Down the Most Popular “digitalstress” DDoS-for-hire Service
[ad_1]

The National Crime Agency (NCA) has successfully infiltrated and dismantled one of the most notorious Distributed Denial of Service (DDoS) for hire services, digitalstress.su.

This criminal marketplace, responsible for tens of thousands of attacks weekly worldwide, was taken down through a collaborative effort between the NCA and the Police Service of Northern Ireland (PSNI).

Earlier this month, the PSNI arrested one of the site’s suspected controllers, paving the way for the NCA to take over the site and disable its functionality.

Innovative Tactics and International Cooperation

The NCA’s innovative approach involved creating a mirror site that redirected users to a splash page, warning them that law enforcement had collected their data.

This strategic move not only disabled the site but also sent a clear message to cybercriminals that their activities were being closely monitored.

The splash page displayed a stern warning: On 2 July, a joint operation by the NCA, PSNI, and FBI led to the arrest of a suspected controller of DigitalStress. We have now taken down www.digitalstress.su. We are watching you.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

Is it worth it? The NCA also accessed communication platforms used to discuss launching DDoS attacks, further demonstrating that no platform is safe for cybercriminals to discuss their illicit activities.

This operation follows an FBI-led international effort in December 2022, which targeted tools and services for severe cyberattacks and resulted in the takedown of 48 of the world’s most famous ‘booter’ sites.

Impact and Future Implications

DDoS-for-hire services, such as digitalstress.su, allow users to create accounts and order DDoS attacks within minutes, posing significant threats to businesses, critical national infrastructure, and essential public services.

The administrators of digitalstress.su believed using an old Soviet Union domain (.su) would shield them from law enforcement. However, the NCA’s successful takedown has proven that such domains are not beyond reach.

Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, emphasized the importance of innovative tools and techniques in combating cybercrime.

“Booter services are an attractive entry-level cyber crime, allowing individuals with little technical ability to easily commit cyber offenses. Anyone using these services while our mirror site was in place has now made themselves known to law enforcement agencies worldwide,” he stated.

Detective Chief Inspector Paul Woods of the PSNI highlighted the importance of collaborative efforts in tackling cybercrime.

“This is an excellent example of collaborative working. We will continue to work tirelessly alongside our law enforcement partners to disrupt the activities of those who use cyber technology to cause damage, whether locally or globally,” he said.

This operation forms part of Operation Power Off, an ongoing coordinated international response targeting criminal DDoS-for-hire infrastructures worldwide.

The NCA’s actions have sent a strong message to cybercriminals: anonymity and impunity are no longer guaranteed.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link

The Apple Music Classical app now curates a Top 100 chart, a fellow from 1685 tops it

andreasc
-
0
The Apple Music Classical app now curates a Top 100 chart, a fellow from 1685 tops it
[ad_1]

While science debates over whether brain cells can regenerate or not, it’s best not to take any chances and not get your brain cells pulverized by too much modern music. That’s where the Apple Music Classical app comes into play.

Launched in the Spring of 2023, the Apple Music Classical app is available at no extra cost to Apple Music subscribers. The app is said to boast the largest classical music catalog, with over 5 million unique tracks and thousands of exclusive albums. Users can search by composer, work, conductor, or catalog number.

Now, it offers a Top 100 chart: it’s weekly and derived from listening data spanning over 165 countries!

Apple Music Classical has been a huge hit with classical fans around the world. With the launch of Apple Classical Top 100 and the recently announced new partnerships, the app is transforming the world of classical.


— Oliver Schusser, Apple’s vice president of Apple Music and Beats.

The Top 100 chart is refreshed every Monday and is accessible through the Apple Music Classical app or Apple’s chart website. It is compiled using five sources that reflect listening statistics from what Apple claims to be more than 165 countries. These sources include:
  • Apple Music Classical streams
  • Apple Music streams
  • iTunes downloads
  • iTunes song sales
  • Shazam tags

Apple asserts that this diverse array of sources from numerous countries makes Apple Music Classical Top 100 “the most comprehensive and representative chart available”.

The first Top 100 chart is led by “Bach: Keyboard Concertos with Chinese pianist Tianqi Du and the Academy of St Martin in the Fields,” under the direction of Jonathan Bloxham. Bach, as everyone with the help of Google knows, was born in 1685.

Speaking of the Academy of St Martin in the Fields orchestra, I can’t help but recall the intergalactic 1984 masterpiece Amadeus – a fictional depiction of Mozart’s bitter feud with rival Antonio Salieri directed by Milos Forman. Even if you’re not keen on spending 2 hours and 40 minutes of your life to watch that movie, you can check out the soundtrack, which was recorded by the said Academy of St Martin in the Fields orchestra. It received 13 Gold Discs, making it one of the most popular classical music recordings of all time.

Back to this week’s numero uno in the Top 100 chart. Here’s how Tianqi Du feels about topping the hit parade: I’m deeply honored for my latest album to be top of the first Apple Classical 100 chart. These concertos are a vibrant showcase of Bach’s energy and spirit, bursting with emotional richness and expressive depth”.

More about the Apple Music Classical


Featuring a specialized search engine for classical music, Apple Music Classical offers high audio quality (up to 192 kHz/24-bit Hi-Res lossless) and allows for spatial audio listening without ads. It also includes hundreds of curated playlists, composer biographies, guides to key works, and intuitive browsing features, making it accessible for both enthusiasts and newcomers.

An Apple Music subscription (Individual, Student, Family, or Apple One) is required, and the app is not available for Apple Music Voice Plan subscribers. Availability is limited in certain countries including China, Japan, Korea, Russia, Taiwan, Turkey, Afghanistan, and Pakistan, and requires iOS 15.4 or later and an internet connection.

Apple’s creation of this app follows its August 2021 acquisition of classical music streamer Primephonic.

The Apple Music app is available from the App Store for iOS and the Google Play Store for Android.


[ad_2]
Source link

Threat Actors Taking Advantage of CrowdStrike BSOD Bug to Deliver Malware

andreasc
-
0
Threat Actors Taking Advantage of CrowdStrike BSOD Bug to Deliver Malware
[ad_1]

Threat actors have been found exploiting a recently discovered bug in CrowdStrike’s software that causes a Blue Screen of Death (BSOD) on affected systems.

This vulnerability has given cybercriminals a unique opportunity to spread malware, posing significant risks to users and organizations relying on CrowdStrike for cybersecurity.

The Malicious Lure

Zscaler ThreatLabz, a prominent cybersecurity research group, tweeted that it has identified a sophisticated lure that leverages this BSOD bug.

The lure is a Microsoft Word document ostensibly containing instructions on how to recover from the BSOD issue. However, this document is far from harmless.

It includes a malicious macro that, when enabled by the unsuspecting user, initiates the download of information-stealing malware from a remote server.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

The malicious macro connects to the URL hxxp://172.104.160[.]126:8099/payload2.txt to download the malware. This information stealer is designed to evade detection by many antivirus solutions, making it particularly dangerous.

Once installed, the malware begins its nefarious activities, compromising the security and privacy of the affected system.

Data Exfiltration via HTTP POST Requests

The primary function of the downloaded malware is to steal sensitive information from the infected system. This stolen data is then exfiltrated via HTTP POST requests to the IP address 172.104.160[.]126:5000.

Cybercriminals commonly use HTTP POST requests for data exfiltration, as this tactic can often bypass traditional network security measures.

The specific types of data this malware targets have not been disclosed, but information stealers typically aim to harvest credentials, financial information, personal data, and other valuable assets.

The implications of such data breaches are severe, potentially leading to identity theft, financial loss, and further cyberattacks.

In response to this threat, cybersecurity experts urge users and organizations to exercise extreme caution with unsolicited documents, particularly those claiming to offer solutions to known issues like the CrowdStrike BSOD bug.

It is crucial to disable macros in Microsoft Office documents unless necessary and to verify the authenticity of any recovery instructions through official channels.

CrowdStrike has been notified of this exploitation, and users are advised to stay updated with the company’s latest patches and security advisories.

Additionally, robust endpoint protection and network monitoring can help detect and mitigate such threats.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.


[ad_2]
Source link

Play Ransomware’s Linux Variant Attacking VMware ESXi Servers

andreasc
-
0
Play Ransomware’s Linux Variant Attacking VMware ESXi Servers
[ad_1]

A new Linux variant of Play ransomware targets VMware ESXi environments, which encrypts virtual machine files and appends the “.PLAY” extension by leveraging obfuscation techniques to bypass detection and is compressed with a Windows variant in a RAR archive. 

It utilizes similar tactics as the Windows version based on the presence of common tools associated with Play ransomware on the command-and-control server, which suggests that the Play ransomware group is expanding its attacks to Linux environments and potentially increasing the impact of their operations.  

The infection chain of the Linux variant of Play ransomware includes the use of several tools.

In the initial infection stage, it verifies the environment by looking for the presence of ESXi-specific commands (vim-cmd and esxcli), and if the commands are found, the ransomware proceeds with its malicious routine.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

First, it disables all running virtual machines to prevent data access or modification. Then, it sets a custom welcome message on the ESXi host, potentially alerting victims of the attack. 

The ransomware encrypts critical VM files, including disks, configuration files, and metadata files, rendering them inaccessible. To indicate that Play ransomware has infected them, the encrypted files have the “.PLAY” extension appended. 

The login portal of the affected ESXi server also displays the ransom note.

A ransom note is dropped in the root directory of the compromised system, and the same note is displayed on both the ESXi login portal and the console, which ensures that the victim will encounter the ransom note regardless of the method used to access the compromised ESXi system.

Analysis of the Play ransomware attack revealed a connection to Prolific Puma, a threat actor known for offering link-shortening services using domains generated by a Registered Domain Generation Algorithm (RDGA). 

The ransomware payload and other tools were hosted on a server with several IP addresses, which resolved to multiple RDGA domains registered by Porkbun, LLC, and NameCheap, Inc., further obfuscating the attacker’s identity.  

The VirusTotal result of the URL mentions Prolific Puma.

Prolific Puma registered domains that resolved to the Play ransomware IP address using their typical short and random names, and the message that appeared on these domains matched that seen in Prolific Puma’s infrastructure. 

The Coroxy backdoor used by Play ransomware has been detected, establishing a connection to the specified IP address.

The Coroxy backdoor used by Play ransomware connected to another IP address that also resolved to Prolific Puma-linked domains by connecting to an IP address that resolved to multiple domains registered by Prolific Puma. 

Further investigation by Trend Micro revealed this IP belonged to the same autonomous system (ASN) as another IP linked to Prolific Puma, indicating they share the same network provider.  

The overlap in infrastructure suggests a potential collaboration between Play ransomware and Prolific Puma, while Play ransomware may be seeking to improve its ability to bypass security measures using Prolific Puma’s services. 

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo


[ad_2]
Source link
1...404142...1,480Page 41 of 1,480