/
ttps_attack:T1059.001 × latest_source_host:gbhackers.com × limpar

Resultados

3 casos · pág. 1/1

gbhackers.com · high

APT28 (Swallowtail) uses Hookedge backdoor and SSH tunnel in months-long intrusion at NATO shipbuilder

Swallowtail (also tracked as APT28, Fancy Bear and Forest Blizzard), a Russian espionage group linked by the U.S. government to the GRU, targeted organizations in two NATO member states. Victims included a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. Symantec's Threat Hunter Team reported th…

gbhackers.com · high

Gentlemen ransomware uses vulnerable Lenovo and Safetica drivers (BYOVD) to kill security software before encryption

Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the dr…

gbhackers.com · · 2 fontes · 2 atualizações critical

CISA advisory: SafePay ransomware has hit 600+ organizations and destroys backups via VSS shutdown and NAS factory resets

A joint advisory published on October 20, 2026 by CISA, the FBI, the United States Secret Service and German and UK law enforcement says SafePay ransomware actors have compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe and Australia since August 2024. The findings cover in…