All Articles - X-Industry - Red Sky Alliance

Iranian APT Groups

TACTICAL CYBER INTELLIGENCE REPORT

Actor Type: II
Serial: TR-18-024-001
Countries: IN, CN
Report Date: 20180124

Iranian APT Groups

APT34

APT34 is involved in long-term cyber espionage operations largely focused in the Middle East. This threat group has targeted a wide variety of industries, including financial, government, energy, chemical, and telecommunications. The group is thought to have been operational since at least 2014 and is likely linked to the Iranian government. The group is also kno

Security Vulnerability Identified in Intel’s AMT

A vulnerability has been identified within Intel’s Active Management Technology, which could allow attackers to bypass logins and place backdoors; allowing them remote access to the target laptop. This remote access can be exploited within one minute.

Critical Vulnerabilities in Western Digital ‘My Cloud’ Storage Devices

SITUATION REPORT

Actor Type: II
Serial: SR-18-017-002
Countries: IN, CN
Report Date: 20180111

Critical Vulnerabilities in Western Digital ‘My Cloud’ Storage Devices

Various critical vulnerabilities have been identified in Western Digital’s My Cloud network attached storage (NAS) devices, which attackers could use to gain root access to a device.

Western Digital’s My Cloud NAS, is a personal cloud storage unit that organizes photos and videos.[1] It is listed on Amazon as a highly rated device and is

Samsung Browser “Same Origin Policy” Bypass Vulnerability

On 27 December 2017, a critical vulnerability was reported in Samsung Internet Browser, the browser app that comes pre-installed on Samsung Android devices. The vulnerability could allow an attacker to steal data from browser tabs if the user visits an attacker-controlled site.

Apple MacOS Privilege Escalation Vulnerability

A security researcher has made public a vulnerability in Apple’s MacOS operating system which allows an attacker to take complete control of the system. The vulnerability was made public on 31 December 2017 by a researcher who is identified as, “Siguza.”

Iranian Protests: Propaganda War

Wapack Labs is monitoring the developments in the ongoing Iran protests. Wapack analysts continue to observe an increase in Internet restriction and disabling of communication applications; Facebook, Twitter, Telegram, Google, WhatsApp, and Signal. To date, ProtonMail’s free VPN service for Android phones, and Psiphon, an app that circumnavigates network firewalls, are the only means of providing anonymity for Iranian citizens.

Bypassing Antivirus using Amber (Reflective PE Packer)

TACTICAL CYBER INTELLIGENCE REPORT

Actor Type: II
Serial: TR-18-009-001
Countries: IN, CN
Report Date: 20180109

Bypassing Antivirus using Amber (Reflective PE Packer)

Amber is a proof-of-concept tool used for bypassing antivirus software. Amber uses techniques that convert Portable Executables (PEs) to reflectively load those PEs. This can be used as a multi-stage payload for infection on a target system. It was developed by Ege Balci and takes advantage of in-memory execution methods. In-m

Pyeongyang Olympics Volunteers Targeted with Malware

TACTICAL CYBER INTELLIGENCE REPORT

**********CORRECTED COPY 15 JAN 18. DISREGARD ALL OTHERS**********

Actor Type: II
Serial: TR-18-014-001
Countries: All, KP, KR
Report Date: 20180114

Pyeongyang Olympics Volunteers Targeted with Malware

Wapack Labs observed two specimens of a macro-malware believed to be targeting volunteers at the 2018 Winter Olympics, Pyeongyang, South Korea. Two XLSM documents were uploaded to Virus Total from Korea in late November. The documents are trojanized ver

Iranian Protests: Communication Bans & Targeting of Protestors

Wapack Labs has been monitoring the developing Iran protests. By Day 9, Wapack analysts observed an uptick in Internet and communication restrictions, including social media platforms, phone applications, encrypted/secure messaging, and Virtual Private Network (VPN) services, and other platforms.

Meltdown and Spectre

Meltdown and Spectre are two major flaws that affect all modern computers based on processors from Intel, AMD and ARM. Discovered and named by the team of security researchers as part of Google Project Zero, both of these flaws potentially allow hackers to steal personal data from computers, including cloud servers and mobile devices. The disclosure date for the flaws was January 9, 2018 but due to premature reports, growing speculation and risk of exploitation, the information was revealed s

Iranian Protests and Cyber Hacktivism

Wapack Labs analysts have been monitoring the recent demonstrations in Iran involving discontent toward the Islamic Republic seated in the aftermath of the 1979 Revolution. Iranian dissidents and activists took to the streets by the thousands, chanting slogans like “We don’t want an Islamic Republic” and “Death to the dictator”, as they tore down pictures of Supreme Leader Khamenei and set fire to the Governor’s office.

The Iranian Cyber Evolution: RATs, Backdoors, and Droppers

Wapack Labs has been monitoring Iranian cyber activity for several years, specifically the evolving OilRig and Greenbug campaigns. Their adoption of a cyber operational paradigm involving both cyber hacktivism and cyber espionage tactics resembles cyber activity patterns employed by Chinese APT groups, whereby different groups perform different campaigns, with multiple teams conducting separate phases of a cyber campaign. With President Trump’s refusal to re-certify Iran’s compliance with the 20

X-Industry

All Articles (2612)

Iranian APT Groups

Security Vulnerability Identified in Intel’s AMT

Critical Vulnerabilities in Western Digital ‘My Cloud’ Storage Devices

Samsung Browser “Same Origin Policy” Bypass Vulnerability

Apple MacOS Privilege Escalation Vulnerability

Iranian Protests: Propaganda War

Bypassing Antivirus using Amber (Reflective PE Packer)

Pyeongyang Olympics Volunteers Targeted with Malware

Iranian Protests: Communication Bans & Targeting of Protestors

Meltdown and Spectre

Iranian Protests and Cyber Hacktivism

The Iranian Cyber Evolution: RATs, Backdoors, and Droppers

Note: this page contains paid content.