Source link

The post Russian military death toll in Ukraine rises to 85,720 appeared first on Ukraine Intelligence.

Researchers warn of an ongoing aggressive Qakbot malware campaign that leads to Black Basta ransomware infections in the US.

Experts at the Cybereason Global SOC (GSOC) team have observed a surge in Qakbot infections as part of an ongoing aggressive Qakbot malware campaign that leads to Black Basta ransomware infections in the US.

In the last two weeks, the experts observed attacks against more than 10 different US-based customers.

Black Basta has been active since April 2022, like other ransomware operations, it implements a double-extortion attack model. Security researchers at Sentinel Labs recently shared details about Black Basta‘s TTPs and assess it is highly likely the ransomware operation has ties with FIN7.

“In this latest campaign, the Black Basta ransomware gang is using QakBot malware to create an initial point of entry and move laterally within an organization’s network. QakBot, also known as QBot or Pinkslipbot, is a banking trojan primarily used to steal victims’ financial data, including browser information, keystrokes, and credentials.” reads the report published by Cybereason. “Once QakBot has successfully infected an environment, the malware installs a backdoor allowing the threat actor to drop additional malware—namely, ransomware.” 

The attack chain starts with a QBot infection, The operators use the post-exploitation tool Cobalt Strike to take over the machine and finally deploy the Black Basta ransomware. The attacks began with a spam/phishing email containing malicious URL links.

The researchers noticed that once obtained access to the network, the threat actor moves extremely fast. In some cases observed by Cybereason, the threat actor obtained domain administrator privileges in less than two hours and moved to ransomware deployment in less than 12 hours.

The threat actor was also spotted locking the victims out of the network by disabling DNS services, making the recovery even more complex.  

In most of the attacks observed by the experts, the spear-phishing email contains a malicious disk image file. Upon opening the file, Qbot is executed, then the malware connects to a remote server to retrieve the Cobalt Strike payload.

Threat actors perform credential harvesting and lateral movement and use the gathered credentials to compromise as many endpoints as possible and deploy the Black Basta ransomware.

Experts observed the attackers that were looking for machines without a defense sensor in an attempt to deploy additional malicious tools without being detected.

The report includes indicators of compromise for this threat.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Black Basta ransomware)

The post An aggressive malware campaign targets US-based companies with Qakbot to deliver Black Basta Ransomware appeared first on Security Affairs.

Postal workers, teachers and university staff across Britain went on strike on Thursday to demand better pay, with warnings that there will be more industrial action and widespread disruption in the run-up to Christmas.

More than 70,000 staff at British universities, teachers across Scotland and Royal Mail postal workers walked out amid a growing number of disputes as workers and businesses grapple with a cost of living crisis.

The general secretary of the University and College Union (UCU), Jo Grady, said the planned three-day walkouts were the “biggest strike action in the history of higher education” due to a dispute over a pensions, working conditions and pay.

Teachers across Scotland also began the first day of strikes in almost four decades after talks on a pay deal with the Scottish government and COSLA (the Convention of Scottish Local Authorities) broke down.

The Educational Institute of Scotland trade union called its members in “all of Scotland’s schools” to strike, with classes closed to pupils after months of negotiations failed to yield a satisfactory pay agreement.

A spokesperson at COSLA said the union needed to “recognise that these are extremely challenging financial times”.

Royal Mail (IDSI.L) postal workers across Britain also took to the picket lines to begin strike action for two days, coinciding with the annual Black Friday sales.

The long-running pay dispute between the post and parcel company and the Communication Workers Union (CWU) is one of many raging across the country, including a pay row with railway workers who have announced planned strikes over two months before and after the Christmas holiday.

Rail union leaders are due to meet the transport minister later on Thursday.

Senior government minister Michael Gove said there needed to be fruitful negotiations between employers and unions.

“My first thought is for those people who are affected by the strike action, people who, whether it’s disruption to the Royal Mail or to transport, find that their everyday lives are disrupted,” he told BBC TV.

“What I want to see is people able to go about their daily lives without disruption.”

Related Galleries:

The European Union is pressing ahead with a ninth sanctions package on Russia in response to Moscow’s attack on Ukraine, European Commission chief Ursula von der Leyen said during a visit to Finland on Thursday.

“We are working hard to hit Russia where it hurts to blunt even further its capacity to wage war on Ukraine and I can announce today that we are working full speed on a 9th sanctions package,” von der Leyen told a news conference.

“And I’m confident that we will very soon approve a global price cap on Russian oil with the G7 and other major partners. We will not rest until Ukraine has prevailed over Putin and his unlawful and barbaric war,” she said.

Israel has cancelled 200 out of some 15,500 permits issued to Palestinians from the Gaza Strip to work in its territory after a labourer was accused of planning to carry out a bombing, the Shin Bet security agency said on Thursday.

The suspect, arrested on Oct. 30, told interrogators he had been recruited by relatives in the militant group Islamic Jihad to plant a bomb on a bus in southern Israel, the Shin Bet said.

It said the suspect had been indicted in an Israeli court. It was not immediately clear if he had been assigned a lawyer or how he might plead to the charges.

The Shin Bet said that among Israel’s responses was the voiding of around 200 permits of workers who have militant family members.

“The attempt by terror groups to exploit the jobs of workers in Israel in order to carry out attacks endangers the livelihood of hundreds of thousands of residents of the Gaza Strip,” Defence Minister Benny Gantz tweeted.

Islamic Jihad had no immediate comment

Gantz, part of the Israel’s centrist outgoing government, had championed expanding the allotment of entry permits in order ease Gaza’s grinding poverty and stave off conflict.

A double bombing in Jerusalem on Wednesday, for which there was no immediate claim of responsibility, killed a teenaged Israeli-Canadian and wounded at least 14 other people.

France and Spain on Wednesday, Nov. 23, lambasted the European Commission’s proposed price cap on wholesale natural gas, set so high that critics have questioned if it would ever be used.

The EU executive on Tuesday, Nov 22, unveiled a gas “safety ceiling” of 275 euros per megawatt hour as the bloc grapples with high energy prices spurred by Moscow’s war in Ukraine and supply cuts.

But the conditions meant the cap would only kick in when EU gas prices breach that threshold for two weeks running, calculated on advance purchases through the bloc’s main gas price benchmark, TTF.

The cap was also contingent on the TTF price for liquefied natural gas — an easily transportable form of gas that can be shipped worldwide — exceeding 58 euros for 10 days within that same two-week period.

The only time the TTF gas price has gone above the 275-euro limit was between August 22 and 29 this year.

It was running at around 120 euros in trading on Tuesday.

Spanish ecological transition minister Teresa Ribera called the commission’s proposal a “joke”, saying it would cause steeper price hikes and hamper efforts to tame decades-high inflation.

The French energy transition ministry criticised an “insufficient” scheme that “does not respond to the reality of the market”.

“The commission must propose an operational text, not simply a text that is political grandstanding and may have negative or no effects,” it said.

Spanish Prime Minister Pedro Sanchez has also expressed his opposition to the plan, with Ribera saying most EU members were against it as the bloc’s energy ministers prepare to meet on Thursday.

Spain could stop supporting other proposals on matters important to the commission if another “serious” text is not forthcoming, Ribera added.

A commission spokeswoman said the mechanism was designed “to anticipate and prevent this situation happening in the future”, but admitted even August’s price spike would not have triggered it.

The cap, if adopted, would come into force in January and came after months of wrangling between EU countries.

It runs alongside a plan by member states to voluntarily cut natural gas use by 15 percent over the northern hemisphere winter.

The post France, Spain Slam EU Gas Price Cap appeared first on Kyiv Post.

The resignation of Russia’s ambassador to UNESCO will end the deadlock in a key group he chaired that is charged with preserving cultural sites around the world, a diplomatic source told AFP.

The World Heritage Committee, responsible for adding properties to UNESCO’s list of world heritage sites, had been unable to function for months after the international backlash against Russia’s invasion of Ukraine.

“I have the honor to inform you of the end of my mission as permanent delegate of the Russian Federation to UNESCO,” Russian Ambassador Alexander Kuznetsov said Tuesday, Nov. 22 in a letter to the members of the World Heritage Committee obtained by AFP.

The resignation will allow the committee to “quickly appoint a new president” and resume its activities, a UN diplomat told AFP.

Russia’s position as chair of the committee had sparked an outcry among other members following Moscow’s invasion of Ukraine in February.

The committee had been due to meet in June in the Russian city of Kazan, but 46 countries, including France and the UK, boycotted the event.

The meeting was supposed to update the landscapes, monuments and cities included in the body’s list of heritage sites.

UNESCO regulations dictate that replacements for a resigning committee chair are to be appointed by the country that follows in alphabetical order in English.

Saudi Arabia, which is next in line after Russia, is expected to announce in the coming days whether it will take over the chair of the committee.

UNESCO said an extraordinary meeting will be held in the following weeks to determine the date and place of its next ordinary session, expected in the first half of next year.

The post Russian Resignation Unblocks Key UNESCO Committee: Source appeared first on Kyiv Post.