Aggregator

error code: 1106

The APT33 Iranian hacking group has used new Tickler malware to backdoor the networks of organizations in the government, defense, satellite, oil and gas sectors in the United States and the United Arab Emirates. [...]

The APT33 Iranian hacking group has used new Tickler malware to backdoor the networks of organizations in the government, defense, satellite, oil and gas sectors in the United States and the United Arab Emirates. [...]

As a database administrator, you don’t just maintain systems—you protect your organization’s most sensitive data. With the rise of AI, big data, and ever-tightening regulations, the challenge isn’t just in securing data; it’s in making sure that data remains accessible and usable. As data spreads across multiple formats and systems, data masking has become increasingly […]

The post Data Masking Challenges in Complex Data Environments and How to Tackle them first appeared on Accutive Security.

The post Data Masking Challenges in Complex Data Environments and How to Tackle them appeared first on Security Boulevard.

Hot TopicsDataDome Releases Fastly Compute Server-Side Integration China Cyberwar Coming? Ve

Our new Fastly Compute server-side integration is the latest in a range of 50+ integrations that ensure DataDome stops bad bots & fraud on any infrastructure.

The post DataDome Releases Fastly Compute Server-Side Integration appeared first on Security Boulevard.

Novel attack vectors leverage the CVE-2023-22527 RCE flaw discovered in January, which is still under active attack, to turn targeted cloud environments into cryptomining networks.

error code: 1106

Threat Intelligence Report

Date: August 28, 2024

Prepared by: David Brunsdon, Threat Intelligence - Security Engineer, HYAS

As the US election approaches, the surge in political activity and heightened public interest make it an attractive target for cybercriminals. In each election cycle, billions of dollars are donated to support various candidates and political causes. For example, the 2020 US election saw an unprecedented amount of over $14 billion in donations, surpassing any previous election in US history. This enormous influx of funds creates opportunities for threat actors to exploit vulnerable donors and organizations.

One such tactic, which has been observed in the past and appears to be resurfacing, involves the creation of fake domains that closely mimic legitimate donation websites. In 2016, following the Democratic National Convention (DNC) hacks, Buzzfeed News reported that cybercriminals had set up fake domains to impersonate legitimate political websites, aiming to trick users into donating to fraudulent causes.

ActsBlue Phishing Site

Now, this tactic seems to be active again. The domain actsblue[.]com has been identified as a phishing site designed to look identical to actblue.com, the official platform for Democratic Party donations. Unlike the legitimate site actblue.com, which is registered with Amazon AWS, actsblue[.]com is registered with Namecheap, a registrar known for providing anonymity through redacted WHOIS data and accepting bitcoin payments. This anonymity makes it challenging to trace the domain back to the original threat actors, making it difficult to attribute it to the same group responsible for similar attacks in the past.

Look for Unlikely Account Names

One suspicious element of the phishing page is the large variety of payment options, some with unlikely account names:

Zelle Payment: diazjohana394@gmail[.]com

Cash App Payment: $MollyManisay

Venmo Payment: $JJWDiaz

Bitcoin Payment: bc1q856ynd25sf43suwcy4shlszdkkxk42ahlpe6ec

Ethereum Payment: 0xC8623b18327957751A2ffbEEdAd002319A52D367

USDT Ethereum (ERC20) Payment: 0xC8623b18327957751A2ffbEEdAd002319A52D367

For USDT Tron (TRC20) Payment: TGfoTqZLc3SNYkataG8pBf1vTvDf3Z62QK

A domain like this could be combined with phone calls, text messages, or emails to direct potential donors to the malicious site. This case underscores the importance of vigilance among donors and political organizations as the election draws near. Cybercriminals are likely to continue exploiting the chaotic and high-stakes environment to siphon funds and sow confusion.

Download: How to Stop Phishing Attacks with Protective DNS

 

Suspicious Domains Identified

In our investigation, we have identified a series of suspicious domains, all registered through domain.com and using the same nameservers: ns1.dotster.com and ns2.dotster.com. These domains include:

nationalcommittee[.]democrat
nationalcommittee[.]republican
republicanpac[.]net
democraticnationalcommittee[.]co
democratnationalcommittee[.]org
republicannationalcommittee[.]org

While some of these sites appear to accept donations, it is unclear where the funds are actually directed. The consistent configuration across these domains suggests they may have been registered by the same actor. We strongly advise against making donations through these sites until more information is available.

Warning: Be Cautious When Making Donations

As the election season heats up, it’s crucial to be vigilant about where you send your donations. Cybercriminals often take advantage of the heightened emotions and urgency surrounding elections to deceive well-meaning donors. If you receive a request for a donation via phone call, email, or text message, always verify the legitimacy of the source before proceeding. Do not click on links or provide payment information unless you are certain that the request is genuine.

For those wishing to support political campaigns, the official websites for donations are:
Republican Party: winred.com
Democratic Party: actblue.com

Donating through these sites ensures that your contributions are directed to the intended recipients.

Want more threat intel on a weekly basis?

Follow HYAS on LinkedIn
Follow HYAS on X

Read recent HYAS threat reports:

HYAS Investigates Threat Actors Hidden In Gaming Services

Caught in the Act: StealC, the Cyber Thief in C 

HYAS Protects Against Polyfill.io Supply Chain Attack with DNS Safeguards

StealC & Vidar Malware Campaign Identified

Sign up for the (free!) HYAS Insight Intel Feed

Disclaimer: This Threat Intelligence Report is provided “as is” and for informational purposes only. HYAS disclaims all warranties, express or implied, regarding the report’s completeness, accuracy, or reliability. You are solely responsible for exercising your own due diligence when accessing and using this Report's information. The analyses expressed in this Report reflect our current understanding of available information based on our independent research using the HYAS Insight platform. The Report’s inclusion of any companies, organizations, or ASNs does not imply any wrongdoing on their part; it is simply an indication of where digital threat activities have been observed. HYAS reserves the right to update the Report as additional information is made known to us.

Learn More About HYAS Insight

An efficient and expedient investigation is the best way to protect your enterprise. HYAS Insight provides threat and fraud response teams with unparalleled visibility into everything you need to know about the attack.This includes the origin, current infrastructure being used and any infrastructure.

Read how the HYAS Threat Intelligence team uncovered and mitigated a Russian-based cyber attack targeting financial organizations worldwide.

More from HYAS Labs

Polymorphic Malware Is No Longer Theoretical: BlackMamba PoC.

Polymporphic, Intelligent and Fully Autonomous Malware: EyeSpy PoC.

The post Special Bulletin: US Election Phishing Alert appeared first on Security Boulevard.

error code: 1106

error code: 1106

An Iran-based hacking group known as Pioneer Kitten is breaching defense, education, finance, and healthcare organizations across the United States and working with affiliates of several ransomware operations to extort the victims. [...]

Анализ музыкальных сетей показал, что сложность его композиций не случайна.

error code: 1106

Learn How to Recognize Fraudulent Job Postings and Avoid Becoming a Scam Victim
The demand for skilled cybersecurity professionals, coupled with the rise in remote work, has led to an increase in fraudulent job postings targeting tech-savvy individuals. Learn why this is so and how to protect yourself from deceptive schemes as you pursue a job in cybersecurity.

Targeted Versa Software Used by Service Providers to Manage Wide Area Networks
Chinese nation-state attackers are actively exploiting a zero-day vulnerability in Versa Director software, used by major internet and managed service providers to deploy, configure and monitor network infrastructure, security experts warn. Versa updated its software last month to patch the flaw.

Ransomware attacks on US schools and colleges have surged, with 491 incidents since 2018, affecting over 8000 institutions

Google has more than doubled payouts for Google Chrome security flaws reported through its Vulnerability Reward Program, with the maximum possible reward for a single bug now exceeding $250,000. [...]