Monday , May 27 2024
CoralRaider

Cisco Talos report
“CoralRaider” Targeting Financial Data Across Asia including Bangladesh

Vietnamese hackers are targeting businesses in Asia to get corporate credentials and financial data to sell online. Researchers at Cisco Talos found a group of hackers, known as CoralRaider, targeting India, China, South Korea, Bangladesh, Pakistan, Indonesia, and local entities with a specific type of malware.

Source: CISCO Talos
    Source: CISCO Talos

Talos believes that the group originates from Vietnam because they use Vietnamese language in their Telegram channel for controlling operations, and Vietnamese words are embedded in their code. The IP address is located in Hanoi.

Researcher claimed: Biometrics of Indian Forces Exposed

Jeremiah Fowler, a security researcher, claimed to discover a major vulnerability in India's data security. He found an unprotected database...
Read More
Researcher claimed: Biometrics of Indian Forces Exposed

NSA Releases Guidance on Zero Trust Maturity

The NSA released an information sheet called "Advancing Zero Trust Maturity Throughout the Application and Workload Pillar." This sheet will...
Read More
NSA Releases Guidance on Zero Trust Maturity

Data protection is sovereignty: Mohammad A. Arafat
INFOCOM Dhaka ends promoting cyber resiliency

The two day long 7th edition of INFOCOM, India's biggest business, technology, and leadership event, themed "Sustainable Disruption", concluded today...
Read More
Data protection is sovereignty: Mohammad A. Arafat  INFOCOM Dhaka ends promoting cyber resiliency

Phoenix Summit 2024
Two days phoenix summit ended successfully at Dhaka

TheTeamPhoenix, a non-profit organization, successfully hosted Phoenix Summit 2024, the largest cyber security event in Bangladesh, from May 23-24. This...
Read More
Phoenix Summit 2024  Two days phoenix summit ended successfully at Dhaka

CISA Added Apache Flink CVE-2020-17519 Vulnerability to KEV

CISA warns Apache Flink users about a critical vulnerability. Cybercriminals are exploiting this flaw to compromise systems. Apache Flink is...
Read More
CISA Added Apache Flink CVE-2020-17519 Vulnerability to KEV

Cisco released software updates for CVE 2024-20360

Cisco, a global network solutions leader, has reported a security issue with its Firepower Management Center (FMC) software. This vulnerability,...
Read More
Cisco released software updates for CVE 2024-20360

Ivanti Patches Critical RCE Flaws in Endpoint Manager

Ivanti on Tuesday declare to patch for several products, including fixes for critical vulnerabilities in Endpoint Manager (EPM). Ivanti resolved...
Read More
Ivanti Patches Critical RCE Flaws in Endpoint Manager

German police warn of cyberattacks via Office 365

ompanies in Germany are facing a new wave of cyberattacks. The State Criminal Police Office of North Rhine-Westphalia has issued...
Read More
German police warn of cyberattacks via Office 365

Hacktivists group target Philippines government ransomware attack

SentinelOne researchers found that the Ikaruz Red Team is targeting the Philippines government using different ransomware builders like LockBit, Vice...
Read More
Hacktivists group target Philippines government ransomware attack

CISA ALERT
CISA Warns Exploiting NextGen Healthcare Mirth Connect Flaw

The US cybersecurity agency, CISA, added a flaw in NextGen Healthcare's Mirth Connect product to its catalog of Known Exploited...
Read More
CISA ALERT  CISA Warns Exploiting NextGen Healthcare Mirth Connect Flaw

Hackers use a modified remote access tool called RotBot to download an info stealer. The info stealer searches for business social media accounts with valuable data, like payment card information.

   Source: CISCO Talos

The group “focuses on stealing victims’ credentials, financial data, and social media accounts, including business and advertisement accounts,” the researchers said.

A CoralRaider attack starts when users open a harmful Windows shortcut file. This activates the infection process. Talos is uncertain about how the threat actor sends the files to victims.

The activated LNK file downloads an HTML application. This application runs a Virtual Basic script, which then runs a PowerShell script. This PowerShell script decrypts and runs three other PowerShell scripts. These scripts perform anti-VM and anti-analysis checks, bypass User Access Controls, disable Windows and application notifications, and download and execute the RotBot.

   Source: CISCO Talos

The XClient info stealer loaded by RotBot collects data including cookies, credentials and financial information from web browsers including Brave, Cốc Cốc, Google Chrome, Microsoft Edge, Mozilla Firefox and Opera, as well as Discord and Telegram.

XClient targets data from victims’ Facebook, Instagram, TikTok, and YouTube accounts. It also collects information about payment methods and permissions related to their Facebook business and advertising accounts.

 

Check Also

Microsoft office

German police warn of cyberattacks via Office 365

Companies in Germany are facing a new wave of cyberattacks. The State Criminal Police Office …

Leave a Reply

Your email address will not be published. Required fields are marked *