Breaking News

A new ransomware group has been targeting large corporate networks using self-made backdoors and file-encrypting malware for the initial and final stages of the attack.

Researchers are tracking the gang using the codename OldGremlin.
Their campaigns appear to have started in late March and have not expanded globally, yet.

Attacks attributed to this group have been identified only in Russia but there is a strong suspicion that OldGremlin is currently operating at smaller scale to fine-tune their tools and techniques before going global.

OldGremlin is using custom backdoors (TinyPosh and TinyNode) and ransomware (TinyCrypt, a.k.a decr1pt) along with third-party software for reconnaissance and lateral movement (Cobalt Strike, command line screenshot, NirSoft's Mail PassView for email password recovery).

Only about half of enterprises are satisfied with their ability to detect cybersecurity threats, according to a survey from Forrester Consulting – with respondents painting a picture of major resource and technology gaps hamstringing their efforts to block cyberattacks.

X-Force researchers Dave McMillen, Wi Gao, and Charles DeBeck have published their work on the Mozi botnet and how it has spiked lately in attacks on IoT devices.
First discovered in late 2019, Mozi shares code with Mirai and its variants and accounted for nearly 90% of the observed IoT network traffic from October 2019 through June 2020.