Attacker tradecraft dissected — TTPs, detection opportunities and practical mitigation guidance.
45 reports
A recent cybersecurity incident has brought to light a malicious Python package on the Python Package Index (PyPI), posing as the VMware vSphere connector module 'vConnector'. This package, named…
APT36, also known as Earth Karkaddan, is a cyber-espionage group that has been active since at least 2016. The group is believed to be based in Pakistan and has been linked to the Pakistani…
The cybersecurity landscape is a complex and ever-evolving space, with Advanced Persistent Threat (APT) actors and ransomware attackers continuously developing their skills and learning from their…
APT34, also known as OilRig, is a suspected Iranian cyber espionage threat group that has been operational since at least 2014. The group is believed to work on behalf of the Iranian government,…
The issue lies in the "display name" of an email's "From" header in Outlook. It appears that this display name can be manipulated to misrepresent the actual sender of the email, making phishing…
The Centre for Cyber Security Belgium (CERT.be) has issued an advisory warning of an actively exploited zero-day vulnerability (CVE-2023-38606) affecting all Apple products. This vulnerability,…
In a significant development in the cybersecurity landscape, the banking sector has recently been the target of two distinct open-source software (OSS) supply chain attacks. These attacks,…
APT32, also known as OceanLotus Group, is a Vietnam-based threat group that has been active since at least 2014. This group is known for its sophisticated attacks on several private companies,…
The Evasive Panda Advanced Persistent Threat (APT) group, also known as BRONZE HIGHLAND and Daggerfly, has been active since at least 2012. This Chinese-speaking APT group has been conducting…
APT30, also known as APT-C-30, is a China-based cyber espionage group that has been active since at least 2005. The group has targeted multiple industries, including the aerospace, government,…
Insecure Direct Object References (IDOR) vulnerabilities have been a consistent thorn in the side of web application security. In 2023, it was identified as the top vulnerability discovered by…
