Menaces et incidents

Version française: 🇫🇷 ANSSI has observed a number of phishing campaigns directed against French entities since February 2021. Technical indicators correspond to activities associated with the Nobelium intrusion set. These campaigns have succeeded in compromising email accounts belonging to French...

English version : 🇬🇧 L'ANSSI a observé plusieurs campagnes d'hameçonnage contre des entités françaises depuis février 2021 dont les marqueurs techniques correspondent au mode opératoire Nobelium. Ces campagnes ont permis de compromettre des comptes de messagerie d'organisations françaises, et...

Version française : 🇫🇷 Based on incidents reported to the ANSSI and their commonalities, investigations were carried out by the Agency to confirm the existence of a single cyber criminal group responsible for these incidents, understand its modus operandi and distinguish its techniques, tactics...

Version anglaise : 🇬🇧 Sur la base d'incidents signalés à l'ANSSI et de leurs points communs, des investigations ont été menées afin de confirmer l'existence d'un groupe cybercriminel responsable de ceux-ci, de comprendre son mode opératoire et de distinguer ses principales techniques, tactiques...

French version: 🇫🇷 Active since September 2020, the Egregor ransomware is currently being used in Big Game Hunting operations. Part of the Sekhmet malware family, Egregor is sometimes considered the successor to Maze. It is made available to various affiliates, explaining the different chains of...

French version: 🇫🇷 First observed in August 2018, the Ryuk ransomware has since been used in Big Game Hunting operations. It is characterized by the use of different infection chains and the extreme speed of the Bazar-Ryuk chain, as well as the absence of a dedicated leak site. A Ryuk variant...

French version: 🇫🇷 ANSSI has been informed of an intrusion campaign targeting the monitoring software Centreon distributed by the French company CENTREON which resulted in the breach of several French entities. The first victim seems to have been compromised from late 2017. The campaign lasted...

Version anglaise : 🇬🇧 L’ANSSI a été informée d’une campagne de compromission touchant plusieurs entités françaises. Cette campagne ciblait le logiciel de supervision Centreon, édité par la société du même nom. Les premières compromissions identifiées par l’ANSSI datent de fin 2017 et se sont...

French version: 🇫🇷 First spotted in 2014 as a banking Trojan, Emotet evolved towards a modular structure. Since 2017, this Malware-as-a-Service has been distributing, within networks it infects, malicious codes operated by others cybercriminals who are customers of TA542. Currently, Emotet...

Threat Actor 505 (TA505) est un groupe cybercriminel, actif depuis 2014. Il mène des campagnes d’hameçonnage, qui sont depuis 2019, régulièrement suivies d’actions de chiffrement par rançongiciel. Un précédent rapport publié par l’ANSSI en 2020, CERTFR-2020-CTI-006, fournit une synthèse de la...