#NSFOCUS

[digitalcreationsllc]

xorbot: A Stealthy Botnet Family That Defies Detection - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

I. Background of xorbot In November 2023, NSFOCUS Global Threat Hunting System detected that a type of elf file was being widely distributed and accompanied by a large amount of suspected encrypted outbound communication traffic. However, the detection rate of mainstream antivirus engines on this file was close to zero, which aroused our curiosity. After further manual analysis, we identified a…

[mariacallous]

Every software supply chain attack, in which hackers corrupt a legitimate application to push out their malware to hundreds or potentially thousands of victims, represents a disturbing new outbreak of a cybersecurity scourge. But when that supply chain attack is pulled off by a mysterious group of hackers, abusing a Microsoft trusted software model to make their malware pose as legitimate, it represents a dangerous and potentially new adversary worth watching.

Today, researchers on the Threat Hunter Team at Broadcom-owned security firm Symantec revealed that they'd detected a supply chain attack carried out by a hacker group that they've newly named CarderBee. According to Symantec, the hackers hijacked the software updates of a piece of Chinese-origin security software known as Cobra DocGuard, injecting their own malware to target about 100 computers across Asia, mostly in Hong Kong. Though some clues, like the exploitation of DocGuard and other malicious code they installed on victim machines, loosely link CarderBee with previous Chinese state-sponsored hacking operations, Symantec declined to identify CarderBee as any previously known group, suggesting it may be a new team.

Beyond the usual disturbing breach of trust in legitimate software that occurs in every software supply chain, Symantec says, the hackers also managed to get their malicious code—a backdoor known as Korplug or PlugX and commonly used by Chinese hackers—digitally signed by Microsoft. The signature, which Microsoft typically uses to designate trusted code, made the malware far harder to detect.

“Any time we see a software supply chain attack, it’s somewhat interesting. But in terms of sophistication, this is a cut above the rest,” says Dick O'Brien, a principal intelligence analyst on Symantec's research team. “This one has the hallmarks of an operator who knows what they’re doing.”

Cobra DocGuard, which is ironically marketed as security software for encrypting and protecting files based on a system of users' privileges inside an organization, has around 2,000 users, according to Symantec. So the fact that the hackers chose just 100 or so machines on which to install their malware—capable of everything from running commands to recording keystrokes—suggests that CarderBee may have combed thousands of potential victims to specifically target those users, O’Brien argues. Symantec declined to name the targeted victims or say whether they were largely government or private sector companies.

The Cobra DocGuard application is distributed by EsafeNet, a company owned by the security firm Nsfocus, which was founded in China in 2000 but now describes its headquarters as Milpitas, California. Symantec says it can't explain how CarderBee managed to corrupt the company's application, which in many software supply chain attacks involves hackers breaching a software distributor to corrupt their development process. Nsfocus didn't respond to WIRED's request for comment.

Symantec's discovery isn't actually the first time that Cobra DocGuard has been used to distribute malware. Cybersecurity firm ESET found that in September of last year a malicious update to the same application was used to breach a Hong Kong gambling company and plant a variant of the same Korplug code. ESET found that the gambling company also had been breached via the same method in 2021.

ESET pinned that earlier attack on the hacker group known as LuckyMouse, APT27, or Budworm, which is widely believed to be based in China and has for more than a decade targeted government agencies and government-related industries, including aerospace and defense. But despite the Korplug and CobraGuard connections, Symantec says it's too early to link the wider supply chain attack it has uncovered to the group behind the previous incidents.

“You can't rule out the idea that one APT group compromises this software, and then it becomes known that this software is vulnerable to this kind of compromise, and somebody else does it as well,” says Symantec's O'Brien, using the term APT to mean “advanced, persistent threat,” a common industry term for state-sponsored hacker groups. “We don't want to jump to conclusions.” O'Brien notes that another Chinese group, known as APT41 or Barium, has also carried out numerous supply chain attacks—perhaps more than any other team of hackers—and has used Korplug, too.

To add to the attack's stealth, the CarderBee hackers managed to somehow deceive Microsoft into lending extra legitimacy to their malware: They tricked the company into signing the Korplug backdoor with the certificates Microsoft uses in its Windows Hardware Compatibility Publisher program to designate trusted code, making it look far more legit than it is. That program typically requires a developer to register with Microsoft as a business entity and submit their code to Microsoft for approval. But the hackers appear to have obtained a Microsoft signature through either developer accounts they created themselves or obtained from other registered developers. Microsoft didn't respond to WIRED's request for more information on how it ended up signing malware used in the hackers' supply chain attack.

Malware that's signed by Microsoft is a long-running problem. Getting access to a registered developer account represents a hurdle to hackers, says Jake Williams, a former US National Security Agency hacker now on faculty at the Institute for Applied Network Security. But once that account is obtained, Microsoft is known to take a lax approach to vetting registered developers' code. “They typically sign whatever you, as the developer, submit,” Williams says. And those signatures can, in fact, make malware far harder to spot, he adds. “So many folks, when they threat-hunt, they start by exempting things that are signed by Microsoft,” Williams says.

That code-signing trick, combined with a well-executed supply chain attack, suggests a level of sophistication that makes CarderBee uniquely worthy of tracking, says Symantec's O'Brien—even for those outside of its current targeting in Hong Kong or Chinese neighbor countries. Regardless of whether you’re in China’s orbit, says O’Brien, “it’s certainly one to look out for.”

[the-hacker-news]

New Cyber Threat Targets Azerbaijan and Israel Diplomats, Stealing Sensitive Data

The Hacker News : A previously unknown threat actor has been attributed to a spate of attacks targeting Azerbaijan and Israel with an aim to steal sensitive data. The attack campaign, detected by NSFOCUS on July 1, 2024, leveraged spear-phishing emails to single out Azerbaijani and Israeli diplomats. The activity is being tracked under the moniker Actor240524. "Actor240524 possesses the ability to steal secrets http://dlvr.it/TBxQzB Posted by : Mohit Kumar ( Hacker )

[sufferfly1]

Threat intelligence Market : A Study of the Industry's Current Status and Future Outlook

“According to the research report published by Polaris Market Research, the global threat intelligence market was valued at USD 11.69 billion in 2021 and is expected to reach USD 20.35 billion by 2030, to grow at a CAGR of 6.6% during the forecast period.” Polaris Market Research has unveiled an updated report on Threat Intelligence Market Share, Size, Trends, Industry Analysis Report, By Component (Solutions, Services); By Deployment Mode (Cloud, On-premises); By Application; By Industry Vertical; By Region; Segment Forecast, 2022 - 2030: By Size, Latest Trends, Share, Huge Growth, Segments, Analysis and Forecast, 2030, that provides a thorough analysis of the market status with the best facts and figures, definitions, applications, and the latest developments across the globe. The report assesses the industry structure based on Threat Intelligence Market size, segments, source, distribution channel, and major regions. It scrutinizes the latest trends in the industry and studies their impact on the overall market environment. The market has evolved swiftly in recent years and has made a remarkable contribution to global finances in terms of growth rate, Threat Intelligence Market share, and revenue generation.

Get Sample PDF with Report Insight @ https://www.polarismarketresearch.com/industry-analysis/threat-intelligence-market/request-for-sample

Key Market Dynamics This analytical study report provides information on significant aspects of the market, such as dynamics, key demand and price, technology trends, and detailed profiles of key players, industry revenue, and regional segments analyzing the Threat Intelligence Market based on SWOT and Porter's Five Forces models. Details of segment markets by type, application, and region have been covered in this report, with historical data presented in metrics of sales volume, revenue, and growth rate.

Key Offerings:

Industry Dynamics

Threat Intelligence Market Segmentation

Market Size in terms of Value and Volume: Current, Historical, and Projected Data

Industrial Trends and Developments

Competitive Landscape

Opportunities in the market

Strategies and Products offerings of Major Players

Strategic Recommendations for the new entrants

Production and Consumption Analysis by Regions

Growth Prospects with Revenue Estimations

Main Findings and Insights

The next section gives a detailed description of the key drivers, restraints, growth opportunities, challenges, and risks in the market. Further, the development status and future [KEYWORD] trends are tracked in the report. The supply chain and cost analysis in the report are both explained in-depth. Through technological innovation and advancement, the product's performance will be further optimized, expanding its use in downstream applications. Additionally, readers will find market dynamics and consumer behavior studies as essential data for understanding the market. Top Key Players:

AT&T

Broadcom

Check Point

Cisco

Cyfirma

Cymulate

DXC Technology

IBM

McAfee

Mimecast

Nsfocus

Optiv

Seclytics

Trend Micro

VMware

Threat Intelligence Market key players are presented along with their expansion plans, share, strategies, and business overview. In addition to this, their company profiles, sales figures, profit margins, and product and service portfolios are evaluated in the report. The chapter sheds light on the business expansion strategies employed by these players, such as mergers and acquisitions, product launches, collaborations, M&A, contracts, partnerships, and joint ventures. 

Inquire your Questions If any Before Purchasing this Report @ https://www.polarismarketresearch.com/industry-analysis/threat-intelligence-market/inquire-before-buying

How Will This Report Help you?

The report delivers extensive analysis in the form of figures, tables, charts, and graphs combined with an in-depth study of current and future Threat Intelligence Market prospects. It further allows readers to comprehend the competitive regional pattern by comparing the sales volume and revenue of the world's key regions. Import volume and export volume are evaluated on a regional level. Key statistical insights are presented in a straightforward manner that will users grasp the market's development patterns, crucial factors, and other loopholes which are expected to affect the market expansion.

Key Regions Covered By Report:

North America (United States, Canada, and Mexico)

Europe (Germany, France, United Kingdom, Russia, Italy, and the Rest of Europe)

Asia-Pacific (China, Japan, Korea, India, Southeast Asia, and Australia)

South America (Brazil, Argentina, Colombia, and the rest of South America)

The Middle East and Africa (Saudi Arabia, United Arab Emirates, Egypt, South Africa, and the Rest of the Middle East and Africa)

The entire market industrial chain is examined in the research, from the important upstream raw materials and their suppliers to the midstream distributors and downstream customers, while taking the effects of global inflation into account. Finally, it predicts the market's future trends from the perspectives of various types, uses, and significant geographical areas. This study is a trustworthy source for market research that will greatly accelerate the growth of your business and increase its presence in the Threat Intelligence Market. Browse Additional Details on "Threat Intelligence Market" @ https://www.polarismarketresearch.com/industry-analysis/threat-intelligence-market

Reasons to Purchase This Report

This research includes a thorough worldwide and regional analysis of the market.

It gives thorough coverage of every sector of the market in order to assess prospective trends, growth plans, and industry size projections.

The firm profiles of each industry player examine the industry portfolio, sales income, SWOT analysis, and current advancements.

Comprehension of the market's drivers, restrictions, and key small markets.

Analysis of collaboration and authorizing transaction trends can be used to identify commercial prospects in the market sales scenario.

The research analyzes how specific industry structures, ideas, or technological advancements may help with player promotion.

About Us

Polaris Market Research is a worldwide market research and consulting organization. We give unmatched nature of offering to our customers present all around the globe across industry verticals. Polaris Market Research has expertise in giving deep-dive market insight along with market intelligence to our customers spread crosswise over various undertakings. We at Polaris are obliged to serve our different client base present over the enterprises of medicinal services, healthcare, innovation, next-gen technologies, semiconductors, chemicals, automotive, and aerospace & defense, among different ventures, present globally.

Contact Us:

Polaris Market Research

Email: sales@polarismarketresearch.com

Ph: +1-929 297-9727

[ericvanderburg]

NSFOCUS reveals alarming surge in DDoS attacks in 2022 report

http://i.securitythinkingcap.com/Sz3CN8

[statesone]

NSFOCUS AISecOps: Elevating Your Security Operations Efficacy and Mitigating Alert Fatigue - Security Boulevard

📣 StatesOne — https://news.google.com/rss/articles/CBMigAFodHRwczovL3NlY3VyaXR5Ym91bGV2YXJkLmNvbS8yMDIzLzEwL25zZm9jdXMtYWlzZWNvcHMtZWxldmF0aW5nLXlvdXItc2VjdXJpdHktb3BlcmF0aW9ucy1lZmZpY2FjeS1hbmQtbWl0aWdhdGluZy1hbGVydC1mYXRpZ3VlL9IBhAFodHRwczovL3NlY3VyaXR5Ym91bGV2YXJkLmNvbS8yMDIzLzEwL25zZm9jdXMtYWlzZWNvcHMtZWxldmF0aW5nLXlvdXItc2VjdXJpdHktb3BlcmF0aW9ucy1lZmZpY2FjeS1hbmQtbWl0aWdhdGluZy1hbGVydC1mYXRpZ3VlL2FtcC8?oc=5&utm_source=dlvr.it&utm_medium=tumblr

[gazeta24br]

A NSFOCUS, referência global em soluções de cibersegurança, acaba de divulgar o “Relatório Global de Cenário de Ataques DDoS 2022”, que constatou uma alta de 273% de ataques de negação de serviço (DDoS) de 2021 para 2022, seguindo a tendência de crescimento registrada nos últimos quatro anos. As ofensivas acima de 100 Gbps aumentaram 50%, sendo que, por hora, em média, um ataque em grande escala foi registrado, com pico de tráfego de 1Tbps em seis meses do ano.   Os cibercriminosos têm se tornado cada vez mais estratégicos e tendem a ter alvos claros. A análise revela que o número de endereços IP atacados repetidamente no ano anterior, foi significativamente maior do que em 2021. Isso significa que uma vítima identificada como alvo, provavelmente sofrerá ataques repetidamente. O relatório também destaca que os ataques baseados no vetor UDP são o método mais popular quando falamos em Terabit entre os cibercriminosos, representando aproximadamente 60% do total de ameaças.  Para André Mello, vice-presidente da NSFOCUS para América Latina, o cenário de ameaças em constante mudança traz novos desafios para a proteção contra DDoS. “Todos os setores devem se preparar para uma alta de ataques significativa durante 2023, principalmente por causa das tecnologias mais recentes, como Inteligência Artificial, Internet das Coisas e 5G. Estamos antevendo um ano com ataques massivos e frequentes, que podem estar além da capacidade de soluções locais”, antecipa o executivo. Além dos ataques na camada de rede, os ataques DDoS na camada de aplicação obtiveram grande destaque, já que são mais difíceis de detectar e defender, porque estabelecem conexões confiáveis e os endereços IP de origem não podem ser falsificados. Em 2022, o Peru foi o país mais visado por ataques DDoS na camada de aplicação, sendo que o Brasil ocupou o sétimo lugar no ranking mundial. Botnet x Brasil De acordo com o relatório, a Mirai se manteve como a botnet mais perigosa de 2022, respondendo por mais da metade de todas as atividades e com o maior número de servidores de comando e controle. Entre os 10 países mais atingidos por ela, o Brasil aparece na sétima posição. As botnets Gafgyt e BillGates ficaram em segundo e terceiro lugar, respectivamente. Outra descoberta foi que elas exploravam vulnerabilidades críticas em sistemas Linux/IoT, com Mirai e Gafgyt buscando quase 100% das 20 principais vulnerabilidades. 

[krypteiagroup]

Cyber ​​espionage operation against MUREN, Turkey's submarine management system project

Cyber ​​espionage operation against MUREN, Turkey’s submarine management system project

https://www.defenceturk.net/turkiyenin-denizalti-yonetim-sistemi-projesi-murene-yonelik-siber-casusluk-operasyonu According to the report published by China-based internet and application security company NSFocus, a new APT group of unknown origin allegedly carried out cyber espionage operations against the Naval Forces Command (DKK) and TUBITAK in early August 2022. According to the report,…

[palavradigital-blog]

Softwares de trabalho e dispositivos caseiros são responsáveis por quase 100% dos ataques hackers 

Relatório da NSFOCUS analisou os dados entre o primeiro semestre deste e o mesmo período de 2021 Segundo o relatório “Global DDoS Landscape Report”, realizado pela NSFOCUS, referência global em cibersegurança, os ataques de negação de serviço (DDoS) aumentaram 205% nos primeiros seis meses de 2022, em comparação com o primeiro semestre do ano anterior, maior alta desde 2018. Além disso, foi…

[technologictr]

Siber güvenlikte liderler belirlendi

Uluslararası araştırma şirketi Quadrant’ın “online erişimi engellemeye yönelik saldırılar” karşısında geliştirilmiş en iyi çözümleri belirlediği araştırmanın sonuçları açıklandı. Pazar ve teknoloji liderlerinin ayrı ayrı sıralandığı araştırmada, her iki başlığın da lideri Arbor Networks oldu.

Quadrant’ın 2017’inin ilk çeyreğine ilişkin raporu, online erişimi engellemeye yönelik DDoS saldırılarına…

[digitalcreationsllc]

The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits

Overview In 2022, NSFOCUS Research Labs revealed a large-scale APT attack campaign called DarkCasino and identified an active and dangerous aggressive threat actor. By continuously tracking and in-depth study of the attacker’s activities, NSFOCUS Research Labs has ruled out its link with known APT groups, confirmed its high-level persistent threat nature, and following the operational name, named…

[demianblog]

Investigadores chinos encuentran fallas críticas de seguridad en el software de automatización CoDeSys

Investigadores chinos encuentran fallas críticas de seguridad en el software de automatización CoDeSys

La firma china de ciberseguridad NSFOCUS detectó 11 fallas críticas de seguridad en el software de automatización CoDeSys. Según un consultivo por parte de los expertos en seguridad, las vulnerabilidades podrían explotarse para obtener acceso no autorizado a los recursos de la empresa o llevar a cabo ataques de denegación de servicio (DoS). “Estas vulnerabilidades son fáciles de explotar y pueden…

[the-hacker-news]

Experts Uncover DarkCasino: New Emerging APT Threat Exploiting WinRAR Flaw

The Hacker News : A hacking group that leveraged a recently disclosed security flaw in the WinRAR software as a zero-day has now been categorized as an entirely new advanced persistent threat (APT). Cybersecurity company NSFOCUS has described DarkCasino as an "economically motivated" actor that first came to light in 2021. "DarkCasino is an APT threat actor with strong technical and learning ability, who is good http://dlvr.it/SywBSb Posted by : Mohit Kumar ( Hacker )

[orbitbrain]

Codesys Patches 11 Flaws Likely Affecting Controllers From Several ICS Vendors

Codesys Patches 11 Flaws Likely Affecting Controllers From Several ICS Vendors

Home › ICS/OT Codesys Patches 11 Flaws Likely Affecting Controllers From Several ICS Vendors By Eduard Kovacs on June 24, 2022 Tweet Codesys this week announced patches for nearly a dozen vulnerabilities discovered in the company’s products by researchers at Chinese cybersecurity firm NSFocus. The industrial automation software solutions provided by the German company are used by some of the…

[arshnet]

Codesys Patches 11 Flaws Likely Affecting Controllers From Several ICS Vendors

Codesys Patches 11 Flaws Likely Affecting Controllers From Several ICS Vendors

Codesys this week announced patches for nearly a dozen vulnerabilities discovered in the company’s products by researchers at Chinese cybersecurity firm NSFocus. read morehttp://dlvr.it/SSmHtj

[businessertreter]

Huge Growth Of Global Secure Access to The Service Edge Market Analysis: 2022-2028 | Hewlett-Packard, Barracuda Networks , Inc

The recent research report on the Global Secure Access to The Service Edge Market 2022-2028 explains current market trends, possible growth rate, differentiable industry strategies, future prospects, significant players and their profiles, regional analysis, and industry shares as well as forecast details. The detail study offers a wide range of considerable information that also highlights the importance of the foremost parameters of the world Secure Access to The Service Edge market.

Market Is Expected to Reach Rise At A CAGR Of 36% During The Forecast Period

(Exclusive Offer: Flat 30% discount on this report)

Click Here to Get Free Sample PDF Copy of Latest Research on Secure Access to The Service Edge Market 2022 Before Purchase:

https://www.theresearchinsights.com/request_sample.php?id=490243&mode=V004

Top Key Players are covered in this report:

Hewlett-Packard, Barracuda Networks , Inc, Cato Networks, Check Point, Cisco Systems, McAfee, Corporation for Open Systems, Palo Alto Networks, Inc, Versa Networks, VMware, Inc, Nsfocus Technologies Group Co., Ltd

On the Basis of Product, the Secure Access to The Service Edge Market Is Primarily Split Into

·         Software Defined Wide Area Network (SD-WAN)

·            Firewall As A Service

·            Secure Web Gateway (SWG)

·            Cloud Access Security Broker (CASB)

·            Zero Trust Network Access (ZTNA)

·            Others

On the Basis of End Users/Application, This Report Covers

·         Information Technology and Telecommunications

·            Energy and Utilities

·            Manufacturing

·            Retail and E-commerce

·            Health Care

·            Government

·            Others

·          

The regions are further sub-divided into:

-North America (NA) – US, Canada, and Mexico

-Europe (EU) – UK, Germany, France, Italy, Russia, Spain & Rest of Europe

-Asia-Pacific (APAC) – China, India, Japan, South Korea, Australia & Rest of APAC

-Latin America (LA) – Brazil, Argentina, Peru, Chile & Rest of Latin America

-The Middle East and Africa (MEA) – Saudi Arabia, UAE, Israel, South Africa

Major Highlights of the Secure Access to The Service Edge Market report study:

·         A detailed look at the global Secure Access to The Service Edge Industry

·         The report analyzes the global Secure Access to The Service Edge market and provides its stakeholders with significant actionable insights

·         The report has considered all the major developments in the recent past, helping the users of the report with recent industry updates

·         The report study is expected to help the key decision-makers in the industry to assist them in the decision-making process

·         The study includes data on Secure Access to The Service Edge market intelligence, changing market dynamics, current and expected market trends, etc.

·         The report comprises an in-depth analysis of macroeconomic and microeconomic factors affecting the global Secure Access to The Service Edge market

·         Market Ecosystem and adoption across market regions

·         Major trends shaping the global Secure Access to The Service Edge market

·         Historical and forecast size of the Secure Access to The Service Edge market in terms of Revenue (USD Million)

SPECIAL OFFER: AVAIL UP TO 30% DISCOUNT ON THIS REPORT:

https://www.theresearchinsights.com/ask_for_discount.php?id=490243&mode=V004

Market Segment Analysis:

The Secure Access to The Service Edge Report provides a primary review of the industry along with definitions, classifications, and enterprise chain shape. Market analysis is furnished for the worldwide markets which include improvement tendencies, hostile view evaluation, and key regions development. Development policies and plans are discussed in addition to manufacturing strategies and fee systems are also analyzed. This file additionally states import/export consumption, supply and demand, charge, sales and gross margins.

Browse Full Report at:

https://www.theresearchinsights.com/reports/global-secure-access-to-the-service-edge-market-growth-2022-2028-490243?mode=V004

The Research covers the following objectives:

– To study and analyze the Global Secure Access to The Service Edge consumption by key regions/countries, product type and application, history data from 2016 to 2022, and forecast to 2026.

– To understand the structure of Secure Access to The Service Edge by identifying its various sub-segments.

– Focuses on the key global Secure Access to The Service Edge manufacturers, to define, describe and analyze the sales volume, value, market share, market competition landscape, Porter’s five forces analysis, SWOT analysis and development plans in the next few years.

– To analyze the Secure Access to The Service Edge with respect to individual growth trends, future prospects, and their contribution to the total market.

– To share detailed information about the key factors influencing the growth of the market (growth potential, opportunities, drivers, industry-specific challenges and risks).

– To project the consumption of Secure Access to The Service Edge submarkets, with respect to key regions (along with their respective key countries).

Report Customization:

Secure Access to The Service Edge, the report can be customized according to your business requirements as we recognize what our clients want, we have extended 25% customization at no additional cost to all our clients for any of our syndicated reports.

In addition to customization of our reports, we also offer fully tailored research solutions to our clients in all industries we track.

Our research and insights help our clients in identifying compatible business partners.

Note: All of the reports that we list have been tracking the impact of COVID-19 on the market. In doing this, both the upstream and downstream flow of the entire supply chain has been taken into account. In addition, where possible we will provide an additional COVID-19 update report/supplement to the report in Q3, please check with the sales team.

About us:

The Research Insights – A world leader in analysis, research and consulting that can help you renew your business and change your approach. With us you will learn to make decisions with fearlessness. We make sense of inconveniences, opportunities, circumstances, estimates and information using our experienced skills and verified methodologies. Our research reports will provide you with an exceptional experience of innovative solutions and results. We have effectively led companies around the world with our market research reports and are in an excellent position to lead digital transformations. Therefore, we create greater value for clients by presenting advanced opportunities in the global market.

Contact Us:

Robin

Sales Manager

Contact number: + 91-996-067-0000  

sales@theresearchinsights.com

https://www.theresearchinsights.com