The hack began as early as March when malicious code was snuck into updates to the popular SolarWinds Orion software that monitors computer networks of businesses and governments.
Among all the ways COVID-19 has affected the cybersecurity world, perhaps nothing is more impossible than live hacking events, which were once a staple of the security industry.
Critical and classified data of a Noida-based private company, providing technology solutions to Indian defense forces, has been allegedly hacked, leading to the theft of confidential information.
The findings were published today in a paper titled “AIR-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers” by Dr. Mordechai Guri, the head of R&D at BGU’s Cyber-Security Research Center.
The Russia-linked UNC2452 threat actor group has been observed leveraging a supply chain compromise to serve backdoored updates for the SolarWinds Orion Platform software.
The adversaries leverage administrative privileges obtained during the on-premise compromise to access the victim’s global administrator account and/or trusted SAML token-signing certificate.
The DHS, the State Department, and the NIH joined the list of known victims of a months-long, highly sophisticated digital spying operation by Russia whose damage remains uncertain but is presumed to be extensive, experts say.
SolarWinds Orion products (affected versions are 2019.4 through 2020.2.1 HF1) are currently being exploited by malicious actors. This tactic permits an attacker to gain access to network traffic management systems.
The attacker’s post-compromise activity leverages multiple techniques to evade detection and obscure their activity, but these efforts also offer some opportunities for detection.
Unit 42 researchers have been tracking the threat group AridViper, which has been targeting the Middle Eastern region, and identified a new information stealer with relations to the MICROPSIA malware.