⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
South Korean authorities and cybersecurity firms have uncovered a state-sponsored campaign exploiting trusted domestic websites to target users through vulnerabilities in financial-security software, specifically AnySign4PC. Attackers leveraged compromised pages to silently install SIGNBT or COPPERHEDGE backdoors on systems running vulnerable versions of AnySign4PC (1.1.4.4 to 1.1.4.6), without requiring user interaction. The Korea Internet & Security Agency (KISA) has advised users to update to version 1.1.5.0 or delete vulnerable installations.
South Korean authorities and security firms disclosed a state-sponsored campaign that used compromised domestic websites to exploit AnySign4PC vulnerabilities. The attacks could infect visitors with backdoors without any user interaction.
South Korean authorities and four security firms disclosed a state-sponsored campaign that compromised trusted Korean websites to exploit AnySign4PC, a locally installed financial-security software, without any user prompt or download. The watering-hole attacks delivered SIGNBT or COPPERHEDGE backdoors.
The Chinese cybercrime group Silver Fox has been observed using a new three-driver BYOVD attack chain targeting a Japanese manufacturer. The attack uses invoice-themed phishing lures and DLL sideloading to deliver ValleyRAT for persistent remote access.
The Chinese cybercrime group Silver Fox has targeted a Japanese industrial manufacturer using a sophisticated attack chain involving bring your own vulnerable driver (BYOVD) techniques to deploy ValleyRAT, a remote access trojan. The campaign begins with a phishing lure disguised as an invoice, hosted on legitimate QQ and Tencent Cloud services, which triggers a DLL sideloading chain via a ZIP archive.
The Chinese cybercrime group Silver Fox targeted a Japanese industrial manufacturing organization using a BYOVD (bring your own vulnerable driver) attack chain involving three drivers, combined with DLL sideloading via legitimate applications, to deploy ValleyRAT (Winos 4.0) for persistent remote access. The attack chain begins with an invoice-themed phishing lure hosted on legitimate QQ and Tencent Cloud services, uses a ZIP archive containing a downloader, and leverages kernel access through vulnerable drivers to impair security controls and evade detection.