Suspected Iran-backed attackers targeting European aerospace sector with novel malware

Suspected Iranian government-backed online attackers have expanded their European cyber ops with fake job portals and new malware targeting organizations in the defense, manufacturing, telecommunications, and aviation sectors. In a Monday report, Check Point Research says it's been tracking "waves" of this activity since early …

[VoiceOfTruth]

Checkpoint

An American company which operates internationally, providing backdoors for the American regime. Yeah.

[NoneSuch]

Re: Checkpoint

It's "novel malware" so it only affects ebooks. Right? Right!?

[JimmyPage]

First, the victim runs a legitimate Windows executable from the archive,

I have an immediate suggestion to stop this in it's tracks. One that I suspect a lot of real IT professionals (not script kiddies) will already have in place.

It does beg the question about the level of mark the phishing is trying to reel in.

[cyberdemon]

Re: First, the victim runs a legitimate Windows executable from the archive,

Windows Defender, no less...

One might've thought that a security app like that would have secure code-signing for DLLs ...

Less Windows Defender, more Windows Defenestrator

[TimMaher]

Re: Windows Defender

Could have been worse.

Could have been Land Rover Defender.

Except JLR haven’t got any.

[Doctor Syntax]

" Nimbus Manticore – also known as UNC1549 (by Google), Smoke Sandstorm (Microsoft), and Imperial Kitten."

Make up your minds - one crew, one name would make your lives a bit and everyone else's a lot easier.

[Tom66]

I feel like these names are far too "cool" for what are essentially criminals. How about "Hacker group ABC123"?

[TimMaher]

I was thinking that.

Came up with “Tosser 123”.

[Anonymous Coward]

Now About NSO and Paragon Malware........

.....attacking IOS and Android.......

.....so Twentieth Century.......describing attacks on Windows.............