IBM X-Force | Breaking Cybersecurity News | The Hacker News

Russian companies have been targeted as part of a large-scale phishing campaign that's designed to deliver a known malware called DarkWatchman . Targets of the attacks include entities in the media, tourism, finance and insurance, manufacturing, retail, energy, telecom, transport, and biotechnology sectors, Russian cybersecurity company F6 said . The activity is assessed to be the work of a financially motivated group called Hive0117, which has been attributed by IBM X-Force to attacks aimed at users in Lithuania, Estonia, and Russia spanning telecom, electronic, and industrial sectors. Then in September 2023, the DarkWatchman malware was once again used in a phishing campaign targeting energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. Russian banks, retailers and marketplaces, telecom operators, agro-industrial enterprises, fuel and energy companies, logistics businesses, and IT firms were singled out again in No...

Delivery- and shipping-themed email messages are being used to deliver a sophisticated malware loader known as  WailingCrab . "The malware itself is split into multiple components, including a loader, injector, downloader and backdoor, and successful requests to C2-controlled servers are often necessary to retrieve the next stage," IBM X-Force researchers Charlotte Hammond, Ole Villadsen, and Kat Metrick  said . WailingCrab, also called WikiLoader, was  first documented  by Proofpoint in August 2023, detailing campaigns targeting Italian organizations that used the malware to ultimately deploy the Ursnif (aka Gozi) trojan. It was spotted in the wild in late December 2022. The malware is the handiwork of a threat actor known as TA544, which is also tracked as Bamboo Spider and Zeus Panda. IBM X-Force has named the cluster Hive0133. Actively maintained by its operators, the malware has been observed incorporating features that prioritize stealth and allows it to ...