Symantec boss Greg Clark exits biz amid dismal financials • The Register Forums

User topics

Article topics

Log in Sign up

Other stories you might like

Microsoft Defender goes cross-platform for the masses

Redmond's security brand extended to multiple devices without stomping on other solutions

Richard Speed Fri 17 Jun 2022 // 15:30 UTC

Microsoft is extending the Defender brand with a version aimed at families and individuals.
"Defender" has been the company's name of choice for its anti-malware platform for years. Microsoft Defender for individuals, available for Microsoft 365 Personal and Family subscribers, is a cross-platform application, encompassing macOS, iOS, and Android devices and extending "the protection already built into Windows Security beyond your PC."
The system comprises a dashboard showing the status of linked devices as well as alerts and suggestions.

Continue reading
Symantec: More malware operators moving in to exploit Follina

Meanwhile Microsoft still hasn't patched the fatal flaw

Jeff Burt Thu 9 Jun 2022 // 11:45 UTC

While enterprises are still waiting for Microsoft to issue a fix for the critical "Follina" vulnerability in Windows, yet more malware operators are moving in to exploit it.
Microsoft late last month acknowledged the remote code execution (RCE) vulnerability – tracked as CVE-2022-30190 – but has yet to deliver a patch for it. The company has outlined workarounds that can be used until a fix becomes available.
In the meantime, reports of active exploits of the flaw continue to surface. Analysts with Proofpoint's Threat Insight team earlier this month tweeted about a phishing campaign, possibly aligned with a nation-state targeting US and European Union agencies, which uses Follina. The Proofpoint researchers said the malicious spam messages were sent to fewer than 10 Proofpoint product users.

Continue reading
VMware customers fear Broadcom acquisition will stall innovation, increase cost

Gartner advises renegotiating subscriptions now to avoid ‘dramatic’ and ‘extraordinary’ price rises

Simon Sharwood, APAC Editor Thu 9 Jun 2022 // 00:57 UTC

Analyst firms S&P Global Market Intelligence and Gartner have both offered negative evaluations of Broadcom's takeover of VMware.
S&P surveyed VMware customers and found 44 percent feel neutral about the deal, and 40 percent expressed negative sentiments.
But when the analyst crunched the numbers for current customers of both VMware and Broadcom, 56 percent expressed negative sentiments. More than a quarter rated their response to the deal as "extremely negative".

Continue reading
Clipminer rakes in $1.7m in crypto hijacking scam

Crooks divert transactions to own wallets while running mining on the side

Jeff Burt Fri 3 Jun 2022 // 12:30 UTC

A crew using malware that performs cryptomining and clipboard-hacking operations have made off with at least $1.7 million in stolen cryptocurrency.
The malware, dubbed Trojan.Clipminer, leverages the compute power of compromised systems to mine for cryptocurrency as well as identify crypto-wallet addresses in clipboard text and replace it to redirect transactions, according to researchers with Symantec's Threat Intelligence Team.
The first samples of the Windows malware appeared in January 2021 and began to accelerate in their spread the following month, the Symantec researchers wrote in a blog post this week. They also observed that there are several design similarities between Clipminer and KryptoCibule – another cryptomining trojan that, a few months before Clipminer hit the scene, was detected and written about by ESET analysts.

Continue reading
North Korea's Lazarus cyber-gang caught 'spying' on chemical sector companies

Crypto-coin theft isn't enough to keep these miscreants busy

Jessica Lyons Hardcastle Fri 15 Apr 2022 // 02:30 UTC

North Korea's Lazarus cybercrime gang is now breaking into chemical sector companies' networks to spy on them, according to Symantec's threat intel team.
While the Korean crew's recent, and highly profitable, thefts of cryptocurrency have been in the headlines, the group still keeps its spying hand in. Fresh evidence has been found linking a recent espionage campaign against South Korean targets to file hashes, file names, and tools previously used by Lazarus, according to Symantec.
The security shop says the spy operation is likely a continuation of the state-sponsored snoops' Operation Dream Job, which started back in August 2020. This scheme involved using phony job offers to trick job seekers into clicking on links or opening malicious attachments, which then allowed the criminals to install spyware on the victims' computers.

Continue reading
Microsoft's standalone Defender for Business hits GA

Security suite for the orgs unwilling to stump up for a Microsoft 365 Business Premium subscription

Richard Speed Tue 3 May 2022 // 14:00 UTC

Microsoft has made a standalone version of Microsoft Defender for Business generally available, aimed at customers not keen on paying for one of its subscriptions.
The product is already bundled with Microsoft 365 Business Premium (for businesses with up to 300 employees) but can now be picked up as a standalone product for $3 per user per month, as we reported from Ignite late last year.
Microsoft currently has four tiers of 365 subscriptions, starting at Business Basic (which includes the web versions of the company's productivity apps) for $6, going up to the full-fat premium version for $22 per user per month, with desktop versions of Office apps.

Continue reading
Russian-linked Shuckworm crew ramps up Ukraine attacks

Cyber-espionage gang using multiple variants of its custom backdoor to ensure persistence, Symantec warns

Jeff Burt Wed 20 Apr 2022 // 16:04 UTC

A Russian-linked threat group that has almost exclusively targeted Ukraine since it first appeared on the scene in 2014 is deploying multiple variants of its malware payload on systems within the country.
The Shuckworm gang – also known as Armageddon and Gamaredon – is using at least four distinct variants of its Pterodo backdoor that are designed to perform similar tasks but communicate with different command-and-control (C2) servers, according to Symantec's Threat Hunter Team.
"The most likely reason for using multiple variants is that it may provide a rudimentary way of maintaining persistence on an infected computer," the researchers wrote in a blog post Wednesday. "If one payload or [C2] server is detected and blocked, the attackers can fall back on one of the others and roll out more new variants to compensate."

Continue reading
Mutating Verblecon malware in illicit cryptomining ... so far

Symantec team warns ransomware and spying could be next

Jessica Lyons Hardcastle Tue 29 Mar 2022 // 22:46 UTC

Internet fiends are using a relatively new piece of a malicious code dubbed Verblecon to install cryptominers on infected computers.
The mutating malware attempts to evade detection by antivirus tools and similar defenses, meaning bad news all round if the software was used to deploy more destructive payloads — and that the crooks using Verblecon may not realize the power of the loader's full potential.
"The activity we have seen carried out using this sophisticated loader indicates that it is being wielded by an individual who may not realize the capabilities of the malware they are using," Symantec's threat hunting team warned today.

Continue reading
Kaspersky cracks Yanluowang ransomware, offers free decryptor

Step one, get some scrambled files back. Steps two through 37...

Jessica Lyons Hardcastle Tue 19 Apr 2022 // 19:59 UTC

Kaspersky has found a vulnerability in the Yanluowang ransomware encryption algorithm and, as a result, released a free decryptor tool to help victims of this software nasty recover their files.
Yanluowang, named after a Chinese deity and underworld judge, is a type of ransomware that has been used against financial institutions and other firms in America, Brazil, and Turkey as well as a smaller number of organizations in Sweden and China, Kaspersky said yesterday. The Russian security shop said it found a fatal flaw in the ransomware's encryption system and those afflicted can get a free fix to restore their scrambled data.
Symantec's threat hunters uncovered this Windows ransomware strain in the fall and said unknown fiends have been using it to infect US corporations since at least August 2021.

Continue reading
How do China's cyber-spies snoop on governments, NGOs? Probably like this

Cicada's months-long global espionage campaign marks an expansion of team's capabilities

Jeff Burt Thu 7 Apr 2022 // 09:45 UTC

A China-backed crew is said to be running a global espionage campaign against governments, religious groups, and non-governmental organizations (NGOs) by, in some cases, possibly exploiting a vulnerability in Microsoft Exchange servers.
+Symantec's Threat Hunter Team said the campaign, which aims to spy on targeted victims and steal information, likely started in mid-2021, with the most recent activity detected in February. It may still be going on, the researchers observed in a report this week.
The Threat Hunter Team team is attributing the attacks to Cicada, also known as APT10 – a group that has been operating for more than a decade and that intelligence agencies in the US have linked to China's Ministry of State Security. The researchers are pointing at Cicada because a custom loader and custom malware that have been used exclusively by the group were found in victims' networks.

Continue reading

ABOUT US

MORE CONTENT

SITUATION PUBLISHING

The Register - Independent news and views for the tech community. Part of Situation Publishing

SIGN UP TO OUR DAILY NEWSLETTER

Security Scorecard

Biting the hand that feeds IT © 1998–2022

Do not sell my personal information Cookies Privacy Ts&Cs