Trellix is a privately held cybersecurity company that provides hardware, software, and services to investigate cybersecurity attacks, protect against malicious software, and analyze IT security risks.

Trellix is a global company redefining the future of cybersecurity. The company’s open and native extended detection and response (XDR) platform helps organizations confronted by today’s most advanced threats gain confidence in the protection and resilience of their operations. Trellix’s security experts, along with an extensive partner ecosystem, accelerate technology innovation through machine learning and automation to empower over 40,000 business and government customers. More at https://trellix.com.

Accel

Matrix

Bessemer Venture Partners

Dell

Brightcom Group (formerly LYCOS Internet Ltd)

Goldman Sachs

HarbourVest Partners

Trellix

We hope this LinkedIn post finds you well! Please find this week’s most important cybersecurity threats at the link and below. https://bit.ly/46JIoxB

1️⃣ Threat Profile: APT35
Threat level: Medium 🟧

AKA Charming Kitten, this state-sponsored group typically targets the militaries in the U.S. and Middle Eastern, diplomatic, and government personnel and organizations across multiple sectors.

2️⃣ APT28
Threat level: Medium 🟧

A series of email-based attacks delivered malicious links leading to a website where a shortcut file was downloaded using JavaScript and the “ms-search” application protocol leading to downloading and executing malware and other malicious tools.

3️⃣ Threat Actors Exploit MS-AppInstaller
Threat level: Medium 🟧

Financially motivated threat actors like Dev-0569, Fin7, Storm-1133, Storm-1674 exploit the MS-Appinstaller protocol handler to distribute MSIX application packages through spoofed websites and phishing attacks.

4️⃣ PikaBot
Threat level: Medium 🟧

Once unpacked, PikaBot checks whether it is being analyzed or running in a real system and establishes persistence, then it tries to download further samples to fully compromise the system.

5️⃣ RE#TURGENCE Campaign Targets MSSQL Servers
Threat level: Medium 🟧

Financially motivated Turkish threat actors launched an ongoing campaign targeting and exploiting MSSQL database servers in the US, EU, and LATAM countries. The initial breach occurs by brute-forcing administrative passwords to gain access to the victim’s server. 
 
6️⃣ Threat Profile: DuckTail Information Stealer
Threat level: Medium 🟧

DuckTail’s modus operandi encompasses the theft of browser cookies, monetary gain through potential unauthorized ad campaigns, and infecting targets via their multifaceted delivery methods.

7️⃣ RusticWeb
Threat level: Low🟨

An ongoing phishing campaign was seen targeting Indian government officials since at least October 2023. Shifting from well-known compiled languages to newer ones like Golang, Rust, and Nim the threat actors used two different infection chains.

8️⃣ BatLoader And FakeBat Malware Attack Multiple Sectors
Threat level: Low 🟨

These actors create deceptive Google Ads and websites resembling legitimate software sites to entice employees into downloading a sophisticated malware loader.

9️⃣ Vetta Loader
Threat level: Low 🟨

This sophisticated and ongoing cyber threat predominantly targets Italian industrial companies. The malware propagates through compromised USB drives and uses popular public streaming services, such as Vimeo, to deploy payloads.

🔟 Ukrainian Servicemen The Focus Of Remcos RAT Campaign (CERT-UA#8386)
Threat level: Low 🟨

The Armed Forces of Ukraine recently faced a targeted phishing campaign where unknown actors attempted to infect devices using Remcos RAT and ReverseSSH malware. The attackers distributed archives containing LNK files, which included obfuscated commands to download and run HTA files via mshta.exe.

Big news: IDC MarketScape for Modern Endpoint Security for Enterprises named us a leader for 2024! #TeamTrellix is committed to providing future-proof endpoint solutions to our customers.

Network, data, endpoint, and email each present a plethora of unique #cybersecurity obstacles. Our on-demand solution webinars help you navigate ransomware detection and response for each security control.

While threats accelerate at an alarming rate, there are steps SecOps teams can take to become more adaptive and reduce risk. How, you ask? We’re here to show you in our upcoming webinar on Wednesday, 1/31! Find your region below to join us.  

AMER registration: https://bit.ly/3vrAJHr 
APJ registration: https://bit.ly/3NTaiAY 
EMEA registration: https://bit.ly/3S19gEi

Smarter cyber threats demand smarter cyber strategies. Managing Director, Asia, Jonathan Tan, outlines the pivotal impact of collaboration, accountability, and a comprehensive security solution. Learn more via TNGlobal.

Our expanded partnership with One Source enables faster detection, investigation, and remediation to secure customers from advanced threats. Learn more.

CEO Bryan Palma advocates for a holistic approach to combat ransomware, emphasizing #cybersecurity resiliency, public-private collaboration, and threat information sharing. Learn more via ITPro.

What’s in a name? Bad actors have already created ChatGPT knockoffs to accelerate phishing attacks. Do you know which of the below is the fake black hat LLM? Guess, then get The CyberThreat Report: November 2023 to learn more about data and trends. https://bit.ly/40O8Ftp

📢 Calling SOC analysts and security professionals! Join Trellix and Amazon Web Services (AWS) for a virtual hands-on #AI XDR Dev Day on Tuesday, 2/6, to experience how AWS seamlessly connects with 1,000+ applications, providing unparalleled visibility on the Trellix platform.

From insightful discussions with global business leaders around the future of technology and AI to talking about all things #cybersecurity in the Trellix hospitality suite, our team certainly made the most of their time at #WEF23. Thanks for having us, World Economic Forum!

COM:TRELLIX

Trellix

Analysis Not Available