-
Cybersecurity researchers have discovered new infrastructure linked to a financially motivated threat actor known as FIN7. The two clusters of potential FIN7 activity “indicate communications inbound to FIN7 infrastructure from IP addresses assigned to Post Ltd (Russia) and SmartApe (Estonia), respectively,” Team Cymru said in a report published this week as part of a joint investigation with
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Researchers uncovered a new malware campaign dubbed BeaverTail, a North Korean cyber espionage malware family primarily focusing on job seekers.
Initially identified as a JavaScript-based info stealer, it has since morphed into a native macOS version that pretends to be legitimate software like the MiroTalk video call service.
This malware is designed to steal confidential information from contaminated computers, including browser data and cryptocurrency wallets.
Cybersecurity researchers at Group-IB Threat Intelligence recently discovered that BeaverTail malware has been attacking Windows users via weaponized games.
Technical Analysis
Two new developments in the BeaverTail malware family were discovered by Group-IB’s cybersecurity specialists.
Firstly, they detected a new Windows version of BeaverTail, expanding the malware’s reach beyond its previous platforms. Secondly, and perhaps more alarmingly, they uncovered an evolved JavaScript variant of BeaverTail.
This version circulates through innocent titles. It is built on ReactJS, a widely used JavaScript library for popular games.
These malicious applications are hidden inside NPM (Node Package Manager) packages and can easily be included in multiple development projects.
Through this sophisticated exploit, the Lazarus group has shown to be adaptive enough in their attempt to attack different operating systems and dev environments.
BeaverTail malware for Windows has been seen to disguise itself as a genuine conferencing app FCCCall.exe.
This is similar to an earlier Lazarus operation where the group trojanized the MiroTalk application.
Moreover, this most recent campaign was likely conducted between late July and early August, showing the group’s susceptibility to leveraging communication software in targeting host devices.
Two primary objectives remain the same for all BeaverTail versions, fetching cryptocurrency wallet information and downloading and executing the next-step payload, InvisibleFerret.
However, the malware’s developers broadened its scope as shown by the increasing number of browser extensions it targets.
BeaverTail now compromises a broader range of browser extensions including those previously mentioned such as kaikas, rabby, argent X, and Exodus web3 which suggests that its operators intend to capture a greater volume of victims’ cryptocurrency assets.
IoCs
- 185.235.241[.]208:1224
- 95.164.17[.]24:1224
- dc77044fe8d35882015eaa99ca31f826
- b9693b6541a22d01b100b867375279e6
- 8ebca0b7ef7dbfc14da3ee39f478e880
- ed60b3913e6694f4a0ed2fe25551bd1f
Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free AccesThe post BeaverTail Malware Attacking Windows Users Via Weaponized Games appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
OpenAI on Friday said it banned a set of accounts linked to what it said was an Iranian covert influence operation that leveraged ChatGPT to generate content that, among other things, focused on the upcoming U.S. presidential election. “This week we identified and took down a cluster of ChatGPT accounts that were generating content for a covert Iranian influence operation identified as
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
But “there are also real questions about [Ukraine’s] ability to hold captured Kursk territory,” said one expert.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
“SOF’s greatest power is early leverage” in deterring conflict, Adm. Sam Paparo said.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
It starts with touring schools.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The imminent release of Cisco HyperShield this month marks a pivotal evolution in the cybersecurity landscape. As an “AI-native” security architecture, HyperShield promises to redefine traditional security protocols through its automated proactive cybersecurity measures and AI-driven security solutions. However, the effectiveness of this sophisticated technology heavily relies on the skilled deployment by IT and Information Security (IS) teams, emphasizing the critical importance of specialized training in this high-tech environment.
Training as the Keystone of Effective AI Security Deployment
HyperShield’s introduction into the cybersecurity arena brings a suite of advanced capabilities centered around AI-powered security systems and IT security automation. This transformative approach will result in a profound shift in how security teams operate, moving from manual control of qualifying and applying new security updates, to instead overseeing and fine-tuning automated AI responses. However, to successfully harness the full potential of HyperShield’s distributed proactive network security measures, comprehensive training is essential.
“HyperShield’s introduction is a game-changer for network security,” said Brian McGahan, CCIE Security and Director of Networking Content for INE Security, a global leader in networking and cybersecurity training and certifications. “The shift to AI-driven security architectures will require a new way of thinking, and it’s become more critical than ever that organizations equip their teams with the right training to fully leverage these new technologies. We need to ensure that security teams are not just familiar with their functionalities but are also trained in using these tools to proactively secure our networks.”
Training programs must not only cover the operational aspects of these new technologies but also foster a deep understanding of Security Orchestration, Automation, and Response (SOAR), which is integral to managing the sophisticated ecosystems in which solutions like HyperShield operate. This will ensure that security teams can effectively manage AI-scale data centers, and effectively operate security solutions across both public & private clouds, maintaining robust security across increasingly complex networks.
The Direct Impact of Training on Business Continuity and Security
The role of IT/IS training extends beyond mere operational competence. Comprehensive training directly influences business continuity by equipping teams with the knowledge to implement and leverage autonomous segmentation and distributed exploit protection inherent to cutting edge solutions such as HyperShield. Training can help to minimize human error—a significant factor in security breaches—by ensuring that teams can proactively manage and respond to emerging threats with minimal human intervention.
Inadequate training could lead to underutilization of these new solutions’ capabilities, potentially leaving enterprises vulnerable to sophisticated cyberattacks. On the other hand, well-trained teams can fully leverage the benefits of AI-driven security, for example using HyperShield’s capabilities to preemptively address vulnerabilities and enhance the overall security posture of the organization.
Balancing Automation with Human Oversight
Despite the advanced automation capabilities of AI-driven solutions like HyperShield, the need for human oversight persists. Today’s security personnel must be skilled at interpreting AI decisions and actions, particularly when integrating these new solutions into existing security architectures. Training in compensating controls and the system’s security solutions is crucial for managing the balance between automated responses and necessary human intervention.
Additionally, training should address the continuous adaptation required in the cybersecurity field, enabling teams to stay current with both AI-based updates and evolving cyber threats. Ongoing education helps to maintain operational resilience and ensures that proactive security measures keep pace with the needs of a dynamic security environment.
As we reimagine security with the rollout of Cisco HyperShield, the spotlight turns not just to the technology itself, but also to the professionals tasked with its deployment. The investment in comprehensive IT/IS training is not just beneficial—it’s imperative for leveraging the full spectrum of capabilities offered by new AI-driven security solutions. Effective training empowers security teams to minimize risks and secure business operations against the sophisticated threats of today and tomorrow. With Cisco HyperShield, businesses have the opportunity to elevate their cybersecurity measures, but only if their teams are prepared to lead this charge effectively.
About INE Security:
INE Security is the premier provider of online networking and cybersecurity training and certification. Harnessing a powerful hands-on lab platform, cutting-edge technology, a global video distribution network, and world-class instructors, INE Security is the top training choice for Fortune 500 companies worldwide for cybersecurity training in business and for IT professionals looking to advance their careers. INE Security’s suite of learning paths offers an incomparable depth of expertise across cybersecurity and is committed to delivering advanced technical training while also lowering the barriers worldwide for those looking to enter and excel in an IT career.
Contact
Director of Global Strategic Communications and Events
Kathryn Brown
INE Security
kbrown@ine.comThe post Why Training is Critical to Implementing Cisco HyperShield appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
CYBERSECURITY / DEFENSE / INTELLIGENCE
