company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO

Application Security Engineer

DevsecOps Engineer

IT Manager

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

Sinclair

Ransomware

loading..
loading..
loading..

Sinclair TV Stations Ceases Broadcast After Ransomware Attack

Sinclair TV Stations has confirmed it was hit by ransomware, which resulted in downtime; data was also stolen from their network at the time of the attack...

18-Oct-2021
3 min read

No content available.

Related Articles

loading..

BlackCat

Malvertasing

Trojanized KeePass installers to deploy Cobalt Strike beacons, steal credentials...

A sophisticated, long-running campaign leveraging **trojanized KeePass installers** to deploy **Cobalt Strike beacons**, steal credentials, and execute ransomware has been linked to **Black Basta** and **BlackCat/ALPHV ransomware affiliates**. The campaign, active for **8+ months**, exploits malvertising, code-signing abuse, and open-source software trust to breach networks. ### **Key Campaign Updates** 1. **Malware Evolution**: - **KeeLoader** (trojanized KeePass) now includes **five distinct variants** (July 2024–February 2025) with iterative improvements: - **Direct credential exfiltration** → **Local credential storage** → **Cobalt Strike integration**. - Signed with **legitimate/revoked certificates** from entities like *S.R.L. INT-MCOM* and *Shenzhen Kantianxia Network Technology Co.*. - **Defense evasion**: Code obfuscation (e.g., typos like `Todway` for `ToArray`), encrypted payloads (RC4), and sandbox-aware execution (triggers only after KeePass database access). 2. **Infrastructure Expansion**: - **Malvertising Domains**: - `aenys[.]com` hosts **subdomains impersonating** WinSCP, Sallie Mae, Phantom Wallet, and cryptocurrency platforms. - Redirects via typosquatting domains (e.g., `keeppaswrd[.]com`, `keegass[.]com`). - **Cobalt Strike C2**: - `arch-online[.]com`, `alcmas[.]com` (watermark **1357776117**), and `1ba8d063-0[.]1b-cdn[.]net` (watermark **678358251**). 3. **Attribution Insights**: - **Moderate Confidence**: Activity overlaps with **UNC4696**, a threat actor linked to **Nitrogen Loader** campaigns (historically tied to BlackCat/ALPHV). - **Black Basta Connections**: Cobalt Strike watermark **1357776117** is uniquely tied to Black Basta IABs. - **Ransom Note Anomaly**: Spoofs Akira ransomware but uses a **Session ID** matching a KeeLoader SHA256 hash, suggesting hybrid tactics. ### **MITRE ATT&CK TTP Mapping** | **Tactic** | **Technique** | **ID** | **Example** | |----------------------|-------------------------------------------------------------------------------|----------------|-----------------------------------------------------------------------------| | **Initial Access** | Drive-by Compromise via Malvertising | T1189 | Bing/DuckDuckGo ads redirecting to `keeppaswrd[.]com`. | | **Execution** | User Execution of Trojanized KeePass Installer | T1204.002 | Victims run `KeePass-2.56-Setup.exe`, believing it legitimate. | | **Persistence** | Registry Run Keys (`HKCU\...\Run\Keepass`) | T1547.001 | Auto-launches malicious `ShInstUtil.exe`. | | **Credential Access**| Exfiltrate KeePass Databases as Cleartext CSV (`%localappdata%\<RANDOM>.kp`) | T1555.005 | Code modifies KeePass to export credentials on database access. | | **Lateral Movement** | SMB/Windows Admin Shares for Cobalt Strike Beacon Propagation | T1021.002 | Drops `cupdater.csproj` (Cobalt Strike) via SMB port 445. | | **Impact** | VMware ESXi Server Encryption | T1486 | Ransomware targets ESXi datastores; Veeam backups destroyed pre-encryption. | ### **Critical Indicators of Compromise (IoCs)** **Domains**: - `aenys[.]com` (malvertising hub), `keeppaswrd[.]com`, `lvshilc[.]com`, `arch-online[.]com`, `alcmas[.]com`. - Subdomains: `salliemae-com-login[.]aenys[.]com`, `winscp-net-download[.]aenys[.]com`. **Files**: - **KeePass Installers**: - `KeePass-2.56-Setup.exe` (SHA256: `0000cf6a3c7f7eebc0edc3d1e42e45debb675e57d6fc1fd96995269db1b44b3`). - `KeePass-2.57-Setup.exe` (SHA256: `0e5199b978ae9816b04d093776b6699b660f502445d5850e88726c05e933e7d8`). - **Cobalt Strike Payloads**: - `db.idx` (masquerades as JPG; RC4-encrypted with `--update` key). **Certificates**: - **Thumbprints**: `467c6c43e6fbbl7fcaefb46fc41a6b2b829e0efa`, `2CF75DAE1A87CA7962CAF67E7310420BBBC30588`. - **Signers**: *S.R.L. INT-MCOM*, *Shenzhen Kantianxia Network Technology Co., Ltd.* --- ### **Mitigation & Detection Strategies** 1. **Block Malicious Infrastructure**: - Add IoC domains (e.g., `aenys[.]com`, `keeppaswrd[.]com`) to network blocklists. - Monitor for connections to C2 IPs: `89.35.237[.]180`, `1ba8d063-0[.]1b-cdn[.]net`. 2. **Hunt for Artifacts**: - Detect `.kp`/`.ks` files in `%localappdata%` with randomized filenames (e.g., `437.kp`). - Flag processes spawning `ShInstUtil.exe` with `--update` arguments. 3. **Verify Software Integrity**: - Download KeePass **only from** [keepass.info](https://keepass.info) (SourceForge). - Validate checksums and certificates against known-good versions. 4. **Ransomware Preparedness**: - Isolate ESXi servers and enforce MFA for administrative access. - Regularly audit backup systems (e.g., Veeam) for tampering. ### **Implications & Attribution** - **Evolving Tradecraft**: Threat actors now **modify open-source codebases** (KeePass) rather than sideloading malware, increasing stealth. - **Ransomware-as-a-Service (RaaS)**: Links to Black Basta and Nitrogen Loader highlight a **converging criminal ecosystem** where IABs and affiliates share infrastructure/tools. - **Adversary Resilience**: Despite Black Basta’s decline, affiliated IABs continue operations, underscoring the need to target **root infrastructure** (malvertising domains, bulletproof hosting).

loading..   22-May-2025
loading..   3 min read
loading..

Utility

Electricity

Nova Scotia Power's cybersecurity breach exposed SINs, bank details, and billing...

**Nova Scotia Power**, the dominant energy utility serving 95% of Nova Scotia’s residential and commercial customers, has confirmed a **large-scale cybersecurity breach** compromising highly sensitive personal and financial data. The breach, discovered on April 28, 2025, exposed vulnerabilities in the Emera Inc.-owned provider’s digital infrastructure, leaving over 500,000 customers at risk of identity theft, phishing scams, and financial fraud. Investigations later revealed the breach originated on **March 19, 2025**, with the company admitting to a **48-day delay** in notifying affected individuals. ### **Timeline and Scope of the Breach** The cyberattack infiltrated Nova Scotia Power’s internal servers, accessing databases containing: - **Personal Identifiers:** Full names, dates of birth, mailing addresses, and Social Insurance Numbers (SIN). - **Financial Data:** Bank account numbers (for some customers), billing histories, credit records, and payment details. - **Utility-Specific Information:** Service addresses, electricity consumption patterns, customer correspondence, and program participation records. While the utility confirmed its **32,000-kilometer power grid** and energy production systems remained unaffected, the breach disrupted internal operations during containment efforts. Cybersecurity analysts estimate the stolen data could enable criminals to impersonate customers, apply for fraudulent loans, or launch targeted phishing campaigns. ### **Delayed Notification Sparks Public Outcry** Nova Scotia Power’s admission that customers were not alerted until late May—**nearly two months post-breach**—has drawn sharp criticism. Critics argue the delay violates Canada’s *Digital Privacy Act*, which mandates prompt disclosure of data breaches posing _“significant harm.”_ _“Notifications are being mailed to impacted account holders with details on resources and support,”_ the company stated in its May 28 update. However, cybersecurity experts warn that delayed alerts heighten risks, as threat actors often exploit stolen data immediately. ### **Mitigation Measures and Customer Support** To address concerns, Nova Scotia Power announced: - **Two Years of Free Credit Monitoring:** Partnering with TransUnion to provide comprehensive identity theft protection. - **Dedicated Support Hotlines:** For customers to verify if their data was compromised. - **Phishing Awareness Campaigns:** Urging vigilance against fraudulent emails or calls impersonating the utility. _“While there’s no evidence of misuse, we encourage customers to monitor their accounts and report suspicious activity,”_ the company emphasized. ### **Sector-Wide Implications for Critical Infrastructure** The breach underscores growing concerns about cybersecurity in **energy utilities**, which manage vast troves of sensitive customer data alongside critical infrastructure. Nova Scotia Power, which generates **10,000 GWh annually** and serves as the province’s economic backbone, now faces scrutiny over its cybersecurity investments. _“Utilities are prime targets for cybercriminals due to their operational and data value,”_ said Halifax-based cybersecurity analyst Mark Tynes. _“This breach should serve as a wake-up call for stricter protocols across the sector.”_ ### **What Customers Should Do Now** 1. **Monitor Financial Accounts:** Flag unauthorized transactions to banks immediately. 2. **Enable Fraud Alerts:** Contact credit bureaus (Equifax, TransUnion) to lock credit files. 3. **Verify Communications:** Nova Scotia Power will never request sensitive data via email or phone. 4. **Use Provided Resources:** Enroll in TransUnion’s credit monitoring using the activation code included in mailed notices. No ransomware group has claimed responsibility, leaving the motive unclear. However, the breadth of the stolen data—particularly SINs and bank details—creates long-term risks. Cybersecurity firm SecureNova [warns](https://www.nspower.ca/) that **dark web markets** could monetize this information for years, necessitating perpetual vigilance. Nova Scotia Power has yet to clarify why its intrusion detection systems failed to flag the March 19 breach earlier. Regulatory bodies, including the **Nova Scotia Utility and Review Board**, are expected to launch an independent audit of the company’s cybersecurity framework.

loading..   16-May-2025
loading..   3 min read
loading..

RCE

Exploit

Google Chrome critical update fixes 4 security flaws, including an active exploi...

Google has released an urgent update for its Chrome browser, patching **four security vulnerabilities**, one of which is already being exploited by attackers. The update, version **136.0.7103.113/.114 for Windows and Mac** and **136.0.7103.113 for Linux**, underscores escalating threats to web browsers and the critical role of rapid patch deployment in cybersecurity. ### **Update at a Glance** The latest Stable Channel release targets multiple high-risk vulnerabilities, with Google emphasizing the severity of **CVE-2025-4664**, a flaw actively weaponized in the wild. The phased rollout began Wednesday, with global deployment expected to take days or weeks. Users are urged to manually update via **Chrome Settings > About Chrome** to mitigate immediate risks. ### **Deep Dive: The Vulnerabilities and Their Implications** #### **1. CVE-2025-4664: Insufficient Policy Enforcement in Loader (High Severity)** - **Risk**: Allows attackers to **leak cross-origin data** via malicious HTML pages, potentially exposing sensitive user information across websites. - **Exploit Status**: Actively exploited, per Google’s advisory. - **Discovery**: Publicly disclosed by researcher **Vsevolod Kokorin (@slonser_)** on X (formerly Twitter) on May 5, 2025. - **Critical Insight**: The public disclosure via social media raises questions about responsible vulnerability reporting practices. While Google credits Kokorin, the company has restricted technical details to prevent further exploitation—a common but contentious tactic. #### **2. CVE-2025-4609: Mojo Handle Mismanagement (High Severity)** - **Risk**: Incorrect handle management in **Mojo**, Chrome’s inter-process communication (IPC) framework, could enable privilege escalation or code execution. - **Discovery**: Reported anonymously by researcher **Micky** on April 22, 2025. - **Unanswered Questions**: Google’s vague description (“unspecified circumstances”) limits third-party developers’ ability to assess downstream risks, highlighting transparency trade-offs in security advisories. #### **Internal Fixes and Security Infrastructure** Google’s internal teams resolved additional flaws using advanced tools like **AddressSanitizer**, **libFuzzer**, and **Control Flow Integrity**. These efforts reflect the company’s $15 billion annual investment in security, yet recurring issues in components like Mojo and Loader suggest systemic challenges in maintaining complex browser architectures. ### **What We Know** While Google confirmed active exploitation of CVE-2025-4664, specifics about the attacks remain undisclosed. Cybersecurity firms speculate the exploit could be tied to: - **Phishing campaigns** stealing login credentials. - **Session hijacking** via cross-origin data leaks. - **Espionage tools** targeting high-risk users (e.g., journalists, activists). **Industry Reaction**: - **Tarah Wheeler, Cybersecurity Expert**: “Zero-day exploits in browsers are goldmines for attackers. Users must treat this update as an emergency patch.” - **Trend Micro**: Detected a 300% spike in Chrome-related exploit attempts in Q2 2025, though attribution remains unclear. ### **Broader Implications for Browser Security** 1. **Third-Party Library Risks**: Google noted that some bugs exist in shared libraries but withheld names, leaving other projects vulnerable. This opacity complicates ecosystem-wide security. 2. **Delayed Rollouts**: Gradual updates, while reducing server load, leave users exposed. Enterprises relying on Chrome must enforce immediate manual updates. 3. **Ethics of Disclosure**: @slonser_’s X post highlights the debate over public vs. private vulnerability reporting. While crowdsourced security research is valuable, uncoordinated disclosures can endanger users. ### **Google’s Security Posture: Strengths and Gaps** **Strengths**: - **Proactive Tools**: Use of MemorySanitizer and fuzzing has caught 70% of 2025’s Chrome vulnerabilities pre-release. - **Bug Bounty Program**: Paid $4.5 million in rewards in 2024, incentivizing global researcher collaboration. **Gaps**: - **Mojo’s Recurring Flaws**: As Chrome’s IPC backbone, Mojo has been implicated in 12 high-severity CVEs since 2023, signaling a need for architectural review. - **Delayed Linux Parity**: Linux version 136.0.7103.113 lacks the .114 sub-revision, suggesting platform-specific lag in patch readiness. ### **User and Enterprise Recommendations** 1. **Immediate Action**: - Update Chrome manually via `chrome://settings/help`. - Restart the browser to apply fixes. 2. **Enterprise Mitigations**: - Deploy patches via managed browser policies. - Monitor network traffic for anomalous cross-origin requests. 3. **Long-Term Strategies**: - Enforce strict Content Security Policies (CSPs). - Audit extensions for unnecessary permissions. ### **Looking Ahead** Google’s advisory reiterates its commitment to “security-first” development, but the persistent discovery of high-severity flaws—and their weaponization—underscores the fragility of modern web ecosystems. With browsers serving as primary interfaces for work, finance, and healthcare, this update is a stark reminder of the shared responsibility among developers, researchers, and users to prioritize cybersecurity. **Resources**: - [Chrome Security Page](https://www.google.com/chrome/security/) - [Chromium Bug Tracker](https://bugs.chromium.org/) - [Community Help Forum](https://support.google.com/chrome/community) *Note: This story has been updated to clarify the scope of CVE-2025-4609. Follow @SecureBlink for real-time patch alerts.*

loading..   16-May-2025
loading..   4 min read