Knotweed Euro cyber mercenaries attacking private sector, says Microsoft

Microsoft has published an analysis of a Europe-based "private-sector offensive actor" with a view to helping its customers spot signs of attacks by money-hungry gangsters. Dubbed Knotweed by Microsoft's Threat Intelligence Center and Security Response Center, the private sector targeting crew has made use of multiple Windows …

[Zippy´s Sausage Factory]

Excel macros... why is it always Excel?

I remember installing VB 5 a few years ago to open some legacy project and it said something along the lines of "write code that downloads and executes on the user's machine - without prompting!".

Bless* 'em, how naive they were...

* (that's a euphemism, of course)

[Anonymous Coward]

pdf has permission to make DLLs?

MS why do you give so much access to a fricking document? Why do you keep creating insecure OSs that allow alteration?

you'd think by now you would "get it" but nope

[VoiceOfTruth]

Microsoft

Why is Microsoft able to identify Austria based rogues, but not rogues that exist on Microsoft's own IP space?

I notice that Microsoft points out Digital Ocean hosts some of these bad actors. While this is undoubtedly true, based on what I see myself, how about the baddies on MS's own network? I see plenty of bad traffic sourced from there.

[Clausewitz4.0]

Re: Microsoft

True. A lot of phishing pages jump from Azure -> AWS and vice versa, sometimes in round-robin. Probably to make the takedown harder / slower.