The Weekly Rewind

Subscribe to our blog

Anonymous Sudan, not so anonymous

By Hitachi Systems Security on 28 March 2023

As its name does not indicate, Anonymous Sudan has nothing to do with either Anonymous or Sudan. Despite the use of Arabic and religious references for political purposes, this is all part of a Russian disinformation strategy. On February, the group claimed to have launched a distributed denial of service (DdoS) attack on multiple US […]

NBA Fan Data hacked via Third-Party Vendor

By Hitachi Systems Security on 24 March 2023

The National Basketball Association (NBA) admitted over the weekend that "an unauthorized third party" hacked a database filled with fans' names and email addresses, but the systems remain uncompromised. NBA programming and games are broadcast worldwide, in 215 countries and over 50 languages. Unfortunately, with the basketball playoffs, upcoming social engineering, and related email phishing, […]

Critical Microsoft vulnerability exploited in the wild

By Cyber Threat Intelligence Unit on 16 March 2023

CVE-2023-23397 is a critical vulnerability in Microsoft Outlook that allows threat actors to remotely steal hash passwords by receiving an email. According to Microsoft, “a Russia-based threat actor” exploited the vulnerability in targeted attacks against several European organizations in government, transportation, energy, and military sectors. Around 15 organizations are believed to have been attacked with […]

LastPass: a story in multiple part

By Vicky Desjardins on 7 March 2023

Aug 25th LastPass disclaimed that they had observed an intrusion in their cloud environment, but it didn't touch the main core of the passwords vaults. They hired third parties to be able to do some forensic. In September, the first conclusion gave view on the targeted infrastructure and the Development environment. End of November, LastPass […]

Exfiltrator-22: The new tool for Ransomware

By Hitachi Systems Security on 4 March 2023

Exfiltrator-22 (or EX-22) is a new tool sold and use in the wild whose goal is to deploy ransomware while being able to avoid detection from within organizations’ networks. The tool makes post-exploitations really easy for the buyers. The tool has a wide range of capabilities which includes a reverse shell with elevation of privileges, […]

New threat actor Hydrochasma targets Medical and Shipping Organizations in Asia

By Hitachi Systems Security on 24 February 2023

Hydrochasma, is a threat actor named by Symantec after leading a campaign targeting shipping companies and medical laboratories in Asia since at least October 2022. The goal of this campaign seems to be intelligence gathering, while phishing email campaigns is the modus operandi. Tools deployed by Hydrochasma seek remote access, escalation of privileges and spread laterally […]

« Previous 1 2 3 Next »