Acronis Blog
Authors
MSP Threats Security Team
MSP Threats Security Team

Latest stories from MSP Threats Security Team

26 July 2022  — 8 min read
TRU Security
Acronis
26 July 2022  — 8 min read
Symbiote: A new stealthy malware for Linux
Symbiote is a new Linux malware that steals users’ data and provides a backdoor to threat actors. It was discovered in June, 2022 and is characterized as a very stealthy malware. It uses a lot of evasion techniques, such as hooking functions, capturing TCP traffic and hiding its own files. It collects users' data and exfiltrates it on DNS servers.
22 July 2022  — 12 min read
TRU Security
Acronis
22 July 2022  — 12 min read
CloudMensis: a new macOS threat
In April 2022, ESET researchers found a yet-unknown backdoor on macOS. It was named CloudMensis due to the fact that it uses different public cloud storage for C2 communication. CloudMensis looks for different types of documents, captures keyboard input, searches local emails and can take screen captures.
30 June 2022  — 8 min read
TRU Security
Acronis
30 June 2022  — 8 min read
Details about ZingoStealer: The new, free malware-as-a-service variant
On March 18, 2022, the Telegram public group published a post detailing the release of a new version of malware, a Windows data stealer called ZingoStealer. The group created a chat bot to field information requests, deliver more information, and even enable downloads of ZingoStealer. Later, the developer announced that cryptomining functionality was added to the stealer in order to maximize profits from its operations.
28 June 2022  — 7 min read
TRU Security
Acronis
28 June 2022  — 7 min read
Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service
On March 16, 2022, security specialists identified a new version of BlackCat ransomware (so named because the software displays a black cat on the victim’s payment site). These experts also noted that some previous YARA rules no longer match, which will make it difficult to find malicious files.
22 April 2022  — 14 min read
TRU Security
Acronis
22 April 2022  — 14 min read
HermeticWiper and HermeticRansom delivered via Active Directory GPO
On February 23, 2022, a new data wiper and ransomware were deployed on a large number of devices in the Ukraine, as ESET Research reported on Twitter. Just before this, a couple of Ukrainian government sites and services were subjected to DDoS attacks. Cybersecurity specialists discovered that the malware was deployed via Microsoft Active Directory GPO. In addition to the disk wiper and ransomware, a worm component was deploy
16 March 2022  — 9 min read
TRU Security
Acronis
16 March 2022  — 9 min read
WhisperGate malware targets Ukrainian government sites
Multiple government sites in Ukraine were shut down on January 13, 2022, the result of a large-scale cyberattack by the WhisperGate malware. Microsoft Intelligence named this activity "DEV-0586" and identified it as destructive malware that used to be ransomware. Its main purpose is to disrupt the system and damage files beyond the possibility of their recovery.
30 November 2021  — 9 min read
TRU Security
Acronis
30 November 2021  — 9 min read
VenomRAT: A remote access tool with dangerous consequences
The first messages about VenomRAT started to appear in June 2020. By analyzing the code, analysts concluded that this new threat is a modified fork of Quasar RAT. The malware itself was introduced on malware-oriented forums, in posts advertising it as an effective tool to remotely access computers for $150 per month.
26 November 2021  — 14 min read
TRU Security
Acronis
26 November 2021  — 14 min read
Trojan-as-a-service: From Formbook to XLoader
Discovered in 2016, Formbook appeared on underground forums, advertised as an infostealer for Windows. In October 2020, Formbook was renamed XLoader; as its developers say, it has the same features, but has improved from the previous version. XLoader can steal users’ information from various browsers, email clients and messengers, and is available to cybercriminals as a service.
19 November 2021  — 6 min read
TRU Security
Acronis
19 November 2021  — 6 min read
Malware analysis: SkinnyBoy hits military, government organizations
In June 2021, military and government institutions were attacked using malware called SkinnyBoy. The malicious implant is attributed to the APT28 group, also known as Pawn Storm, Fancy Bear or Strontium. This group has been known since the mid-‘00s for cyber espionage operations, including attacks on NATO allies and organizations in the energy and transportation sectors as well as the 2016 U.S. presidential election.
19 May 2021  — 6 min read
TRU Security
Acronis
19 May 2021  — 6 min read
New attack vectors for the DarkSide ransomware gang
DarkSide stands out from other ransomware as a service (RaaS) threats, as one of its attack vectors is based on the Zloader botnet (also known as “Silent Night”). It has also been delivered through compromised third-party service providers.
13 May 2021  — 7 min read
TRU Security
Acronis
13 May 2021  — 7 min read
N3TWoRM hackers published exfiltrated data from Israeli companies
On Sunday, May 2, сybercriminal group N3TWoRM attacked the computer networks of the international clothing network H&M in Israel and threatened to release customer data.
27 April 2021  — 7 min read
TRU Security
Acronis
27 April 2021  — 7 min read
DearCry ransomware exploits Exchange server vulnerability
DearCry ransomware uses the recently disclosed zero-day ProxyLogon vulnerabilities to hack into Microsoft Exchange servers. Its file encryption scheme leaves no chance of decryption without the correct key, and data overwriting techniques may complicate recovery. The first DearCry attack was discovered on March 9, 2021.