Russian cyber espionage actors affiliated with the Federal Security Service (FSB) have been observed using a USB propagating worm called LitterDrifter in attacks targeting Ukrainian entities. Check Point, which detailed Gamaredon's (aka Aqua Blizzard, Iron Tilden, Primitive Bear, Shuckworm, and Winterflounder) latest tactics, branded the group as engaging in large-scale campaigns that are followed by "data collection efforts aimed at specific targets, whose selection is likely motivated by espionage goals." The LitterDrifter worm packs in two main features: automatically spreading the malware via connected USB drives as well as communicating with the threat actor's command-and-control (C&C) servers. It's also suspected to be an evolution of a PowerShell-based USB worm that was previously disclosed by Symantec in June 2023. Written in VBS, the spreader module is responsible for distributing the worm as a hidden file in a USB drive together with a decoy LNK that's assigned random names. The malware gets its name LitterDrifter owing to the fact that the initial orchestration component is named "trash.dll." #nexthreat #russia #ukraine #usb #littledrifter #worm #powershell #symatec
NexThreat’s Post
More Relevant Posts
-
As the landscape of cyber threats continues to evolve, the role of Splunk (SIEM) engineers and architects has never been more critical. With increasing vulnerabilities and data breaches threatening the security of government agencies, it’s essential that we recognize and retain qualified professionals who are at the forefront of protecting sensitive information. However, we’ve observed a concerning trend: compensation for engineers and architects is decreasing compared to past years, despite the increasing complexity of their work. This is alarming, especially when we consider the costs these professionals bear to maintain their skills: - High certification fees for required industry credentials. - Ongoing education expenses to stay ahead in a rapidly evolving field. - Rising costs of living due to inflation, making it even harder for these experts to thrive in their careers. Government agencies rely on skilled cybersecurity professionals to safeguard their networks, prevent data breaches, and maintain boundary protection. At NexThreat, we work tirelessly to support these missions through our threat hunting and boundary protection services. From identifying insider threats to monitoring for external vulnerabilities, our team ensures agencies are protected 24/7. Retaining top talent in this field isn’t just about filling a job; it’s about protecting the nation’s most sensitive data. We must value and compensate our cybersecurity professionals fairly—not just for their skillsets, but for the cost of maintaining their expertise.
-
-
With the recent release of CISA’s Federal Civilian Executive Branch Operational Cybersecurity Alignment plan, federal agencies are being called upon to bolster their cyber defenses through enhanced asset management, vulnerability management, defensible architecture, and incident response. At NexThreat, we have firsthand experience supporting CISA through the CDM (Continuous Diagnostics and Mitigation) DEFEND program, helping agencies improve their cybersecurity postures in the face of evolving threats. Our expertise in insider threat detection, zero trust implementation, and vulnerability management positions us perfectly to assist agencies in navigating the complexities outlined in CISA’s guidance. As agencies across the federal ecosystem work towards implementing zero trust architecture by the upcoming deadline, NexThreat is ready to offer tailored solutions that enhance resilience and ensure a cohesive, secure government enterprise. Let's work together to stay ahead of cybercriminals and safeguard our nation’s most sensitive assets. - NexThreat https://lnkd.in/evMD77Uu
CISA issues guide to help federal agencies set cybersecurity priorities
nextgov.com
-
We recently had a customer dealing with an intermittent connection and system performance issue. You know, the kind of thing that drives everyone nuts but never shows up when you want it to. It wasn’t our usual cybersecurity gig, but we dove into it anyway—because, hey, sometimes you just have to get your hands dirty. The issue? A 216V Intel NIC was randomly dropping out. After poking around, we found out it wasn’t just the NIC. The NVMe drives didn’t have enough DRAM to handle the load they were being hit with. Instead of stopping there, we went deeper. We worked on tuning bandwidth, optimizing write speeds, and ensuring the system wouldn’t keep choking under pressure. We developed a quick dashboard to see this visually, and as we modified bandwidth to fit into write rates, you see the most gorgeous parallel processing line appear (we arent lying about being data nerds) This reminded me why knowing the fundamentals is key. When you understand the basics inside and out, you can handle almost anything thrown your way. Cybersecurity isn't really our focus, winning is —it’s about making sure your whole tech setup runs like it’s supposed to, without the drama, and you get the intel you need out of the systems you have paid for so you can free up to do more interesting things.
-
NexThreat remains committed to supporting federal initiatives that enhance cybersecurity resilience. As a trusted partner with experience in Threat Detection and Continuous Diagnostic and Mitigation (CDM DEFEND), we stand ready to help organizations achieve and sustain Zero Trust frameworks. https://lnkd.in/eadAT6M8
Major agencies are close to meeting September zero trust deadline, federal CIO says
govexec.com
-
NexThreat will be attending tonight's GovMates networking event!
Today's the day! Beer, BBQ, & GovCon Buddies (Networking) at our Sold Out Prime Another Day Networking Event. Didn't get a ticket to this one but still want to get that govmates goodness? Join us for our July govmates Institute (YES! The Institute is BACK). July 23rd we're hosting a half day education session on AI | The Wild West! https://lnkd.in/e8iTH3sQ
AI | The Wild West - govmates Institute
eventbrite.com
-
🎄 Happy Holidays from NexThreat! 🎄 As we gather for the holidays, we reflect on how Data, like the threads of a festive tapestry, weaves together the stories that drive our cybersecurity efforts, particularly in insider threat detection. As we enjoy the holiday lights, we're reminded of the brightness of Intelligence in our field. It's the beacon that guides our strategies and innovations. Heading into the new year, we embrace Action. Together, we'll continue to safeguard our Nation's digital realms with proactive measures and steadfast dedication. Happy Holidays and a proactive New Year to all our clients and business partners! 🌟 NexThreat 🌟 Data. Intelligence. Action #cybersecurity #NexThreat #happyholidays #threatintelligence
-
