FireEye Archives - s0x • Austin Managed IT Services

16 Feb, 2022

Red Cross Hack Linked to Iranian Influence Operation?

Cybersecurity Data Breaches, fbi, FireEye, ICRC hack, International Committee for the Red Cross, KELA, [email protected], Ne'er-Do-Well News, RaidForums, Ransomware, Red Cross and Red Crescent Movement, Restoring Family Links, Sheriff, threat_actor, unindicted

A network intrusion at the International Committee for the Red Cross (ICRC) in January led to the theft of personal information on more than 500,000 people receiving assistance from the group. KrebsOnSecurity has learned that the email address used by a cybercriminal actor who offered to sell the stolen ICRC data also was used to register multiple domain names the FBI says are tied to a sprawling media influence operation originating from Iran. …

29 Apr, 2021

Task Force Seeks to Disrupt Ransomware Payments

Cybersecurity amazon, Cisco, Department of Homeland Security, disrupting ransomware payments, Emsisoft, Europol, fbi, FireEye, Institute for Security and Technology, mcafee, microsoft, Philip Reiner, Ransomware, The Coming Storm, The Wall Street Journal, U.K. National Crime Agency, U.S. Justice Department, U.S. Treasury Department

16 Apr, 2021

Did Someone at the Commerce Dept. Find a SolarWinds Backdoor in Aug. 2020?

Cybersecurity, VMware A Little Sunshine, CVE-2020-4006, Cybersecurity Infrastructure Security Administration, Democratic National Committee, fbi, FireEye, GoldMax, Lexicon.exe, microsoft, national security agency, National Telecommunications and Information Administration, NTIA, SolarWinds hack, Sunshuttle, The Wall Street Journal, U.S. Commerce Department, U.S. Treasury Department, virustotal, VMware

On Aug. 13, 2020, someone uploaded a suspected malicious file to VirusTotal, a service that scans submitted files against more than five dozen antivirus and security products. Last month, Microsoft and FireEye identified that file as a newly-discovered fourth malware backdoor used in the sprawling SolarWinds supply chain hack. An analysis of the malicious file and other submissions by the same VirusTotal user suggest the account that initially flagged the backdoor as suspicious belongs to IT personnel at the National Telecommunications and Information Administration (NTIA), a division of the U.S. Commerce Department that handles telecommunications and Internet policy. …

16 Apr, 2021

Did Someone at the Commerce Dept. Find a SolarWinds Backdoor in Aug. 2020?

Cybersecurity, VMware A Little Sunshine, CVE-2020-4006, Cybersecurity Infrastructure Security Administration, Democratic National Committee, fbi, FireEye, GoldMax, Lexicon.exe, microsoft, national security agency, National Telecommunications and Information Administration, NTIA, SolarWinds hack, Sunshuttle, The Wall Street Journal, U.S. Commerce Department, U.S. Treasury Department, virustotal, VMware

On Aug. 13, 2020, someone uploaded a suspected malicious file to VirusTotal, a service that scans submitted files against more than five dozen antivirus and security products. Last month, Microsoft and FireEye identified that file as a newly-discovered fourth malware backdoor used in the sprawling SolarWinds supply chain hack. An analysis of the malicious file and other submissions by the same VirusTotal user suggest the account that initially flagged the backdoor as suspicious belongs to IT personnel at the National Telecommunications and Information Administration (NTIA), a division of the U.S. Commerce Department that handles telecommunications and Internet policy. …

12 Jan, 2021

SolarWinds: What Hit Us Could Hit Others

Cybersecurity CrowdStrike, FireEye, Orion, Other, SolarWinds breach, Sudhakar Ramakrishna, Sunburst malware, Sunspot malware, Teardrop malware

New research into the malware that set the stage for the megabreach at IT vendor SolarWinds shows the perpetrators spent months inside the company’s software development labs honing their attack before inserting malicious code into updates that SolarWinds then shipped to thousands of customers. More worrisome, the research suggests the insidious methods used by the intruders to subvert the company’s software development pipeline could be repurposed against many other major software providers. …

12 Jan, 2021

SolarWinds: What Hit Us Could Hit Others

Cybersecurity CrowdStrike, FireEye, Orion, Other, SolarWinds breach, Sudhakar Ramakrishna, Sunburst malware, Sunspot malware, Teardrop malware

New research into the malware that set the stage for the megabreach at IT vendor SolarWinds shows the perpetrators spent months inside the company’s software development labs honing their attack before inserting malicious code into updates that SolarWinds then shipped to thousands of customers. More worrisome, the research suggests the insidious methods used by the intruders to subvert the company’s software development pipeline could be repurposed against many other major software providers. …