What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-01-04 17:00:49 | InfoSec Global Federal ajouté à la liste de produits approuvés du Département de la sécurité intérieure et de la liste des produits approuvés InfoSec Global Federal Added to Department of Homeland Security Continuous Diagnostics and Mitigation Approved Product List (lien direct) |
Federal mondial Infosec ajouté au diagnostic continu du ministère de la Sécurité intérieure et à la liste des produits approuvés
-
nouvelles commerciales
InfoSec Global Federal Added to Department of Homeland Security Continuous Diagnostics and Mitigation Approved Product List - Business News |
Tool Vulnerability | ★★★ | |
 |
2024-01-04 14:25:04 | Observabilité : comment Odigo a engagé son virage " as a Service " (lien direct) | Parallèlement à une migration de ses ressources vers AWS, Odigo - éditeur de logiciels CCaaS - a rationalisé ses sept outils d'APM pour se concentrer sur la solution d'observabilité de Dynatrace. | Tool | ★★★ | |
 |
2024-01-04 13:35:17 | Que rechercher dans un scanner de vulnérabilité open source What To Look For in an Open Source Vulnerability Scanner (lien direct) |
L'une des principales préoccupations de sécurité que nous entendons des leaders de la technologie concerne la sécurité des logiciels open source (OSS) et le développement de logiciels cloud.Un scanner de vulnérabilité open source (pour la numérisation OSS) vous aide à découvrir le risque dans le code tiers que vous utilisez.Cependant, ce n'est pas parce qu'une solution scanne l'open source que vous réduisez finalement le risque de sécurité.Voici ce qu'il faut rechercher dans un scanner de vulnérabilité open source et une solution de test de sécurité pour trouver et corriger les vulnérabilités dans l'OSS.
Contexte sur les vulnérabilités en open source et à quoi ressemble le risque
Avant de pouvoir parler de ce qu'il faut rechercher dans une solution de numérisation, nous devons parler des vulnérabilités que les outils recherchent.Né en 1999, la base de données nationale de vulnérabilité (NVD) était un produit de l'Institut national des normes et de la technologie (NIST) conçu pour être «le référentiel du gouvernement américain des données de gestion de la vulnérabilité basées sur les normes».Il représente un indice des vulnérabilités connues…
One of the top security concerns we hear from technology leaders is about the security of open source software (OSS) and cloud software development. An open source vulnerability scanner (for scanning OSS) helps you discover risk in the third-party code you use. However, just because a solution scans open source does not mean you are ultimately reducing security risk with it. Here is what to look for in an open source vulnerability scanner and security testing solution to find and fix vulnerabilities in OSS. Background on Vulnerabilities in Open Source and What the Risk Looks Like Before we can talk about what to look for in a scanning solution, we need to talk about the vulnerabilities the tools are looking for. Born in 1999, the National Vulnerability Database (NVD) was a product of the National Institute of Standards and Technology (NIST) made to be “the U.S. government repository of standards based vulnerability management data.” It represents an index of known vulnerabilities… |
Tool Vulnerability Cloud | ★★★ | |
 |
2024-01-04 11:00:00 | VR et AR: risques de sécurité potentiels à préparer VR and AR: Potential security risks to be prepared for (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Virtual reality (VR) and augmented reality (AR) technologies capture everyone’s imagination with use cases and an unlimited potential for future implementations. While these concepts have been around for decades, they continue to be buzzwords with a fascinating flavor of science fiction. The truth is that the VR and AR combination is close to mainstream adoption these days, with plenty of examples of successful projects creating ripples in ecommerce, entertainment, and many other industries. According to Statista, the global virtual reality and augmented reality market is worth $32.1 billion in 2023, and analysts predict it will exceed $58 billion by 2028. These appear to be conservative estimates, with another study forecasting growth up to a whopping $252 billion in the next four years. Whereas these technologies aren’t susceptible to major malicious exploitation at this point, their skyrocketing popularity might encourage threat actors to come up with viable attack vectors in the near future. This article highlights some of the current security and privacy concerns that stem from the rising adoption of VR and AR technologies. 1. Eye tracking Many people consider eye tracking in VR to be truly revolutionary. The logic of such a perspective is clear: this tech enhances the accuracy of virtual interaction and takes the user experience to a new level by helping interpret people’s emotions. It is also believed to give the security of VR systems a boost because eye scanning can refine biometric verification in the login workflows. As useful as it is, glance tracking could also expose users to hidden monitoring and other privacy risks. For example, VR game makers may be tempted to embed advertisements in their products, similar to how sponsored information is shown in mobile games. If this is the case, eye tracking would be a perfect instrument for advertisers to figure out which ads draw your attention and which ones you ignore. As per analysts’ findings, 95% of decisions to buy a product occur in the subconscious mind. By snooping on a user’s visual response, marketers may be able to derive conclusions regarding their preferences and dislikes. The flip side is that such a technology could potentially play into unscrupulous parties’ hands as a powerful surveillance instrument. 2. Blackmail and harassment Adult entertainment is one of the most popular areas of the virtual reality industry. According to a relevant study, the VR adult content market will see a staggering rise from $716 million in 2021 to $19 billion in 2026. Cybercriminals may try to cash in on this hype by engaging in what’s known as “sextortion”. The idea is to deceive users into thinking that the malefactors have some embarrassing evidence of their private pastimes and instruct them to send money in exchange for not disclosing this information. In some cases, the scammers may even include a valid password for one of the user’s web accounts so that the blackmail message appears true. Bear in mind that they obtained these authentication details from a large-scale data breach that occurred in the past. While these emails contain | Data Breach Hack Tool Threat Mobile Prediction | ★★★ | |
 |
2024-01-04 08:00:00 | WSA System Control – Gérez facilement votre sous système Android sous Windows (lien direct) | Voici le scoop: WSA System Control est l'assistant idéal pour tous ceux qui jonglent avec le Windows Subsystem for Android (WSA). Irritant les complexités techniques, il optimise la gestion du WSA. De plus, le logiciel compte sur une icône dédiée pour filer des infos en temps réel. Il est aussi simple à installer qu'un post-it sur un frigo ! | Tool Mobile | ★★★ | |
 |
2024-01-04 06:00:10 | Cybersecurity Stop of the Month: MFA Manipulation (lien direct) | This blog post is part of a monthly series exploring the ever-evolving tactics of today\'s cybercriminals. Cybersecurity Stop of the Month focuses on the critical first three steps in the attack chain in the context of email threats. The series is designed to help you understand how to fortify your defenses to protect people and defend data against emerging threats in today\'s dynamic threat landscape. The critical first three steps of the attack chain: reconnaissance, initial compromise and persistence. So far in this series, we have covered the following types of attacks: Supplier compromise EvilProxy SocGholish eSignature phishing QR code phishing Telephone-oriented attack delivery (TOAD) Payroll diversion In this post, we examine an attack technique called multifactor (MFA) manipulation. This malicious post-compromise attack poses a significant threat to cloud platforms. We cover the typical attack sequence to help you understand how it works. And we dive deeper into how Proofpoint account takeover capabilities detected and prevented one of these threats for our customer. Background MFA manipulation is an advanced technique where bad actors introduce their own MFA method into a compromised cloud account. These attackers are used after a cloud account takeover attack, or ATO. ATOs are an insidious threat that are alarmingly common. Recent research by Proofpoint threat analysts found that in 2023 almost all businesses (96%) were targeted by cloud-based attacks. What\'s more, a whopping 60% were successfully compromised and had at least one account taken over. MFA manipulation attacks can work several ways with bad actors having multiple options for getting around MFA. One way is to use an adversary-in-the-middle (AiTM) attack. This is where the bad actor inserts a proxy server between the victim and the website that they\'re trying to log into. Doing so enables them to steal that user\'s password as well as the session cookie. There\'s no indication to the user that they\'ve been attacked-it just seems like they\'ve logged into their account as usual. However, the attackers have what they need to establish persistence, which means they can maintain access even if the stolen MFA credentials are revoked or deemed invalid. The scenario Recently, Proofpoint intercepted a series of MFA manipulation attacks on a large real estate company. In one case, the bad actors used an AiTM attack to steal the credentials of the firm\'s financial controller as well as the session cookie. Once they did that, they logged into that user\'s business account and generated 27 unauthorized access activities. The threat: How did the attack happen? Here is a closer look at how this MFA manipulation attack played out: 1. Bad actors used the native “My Sign-Ins” app to add their own MFA methods to compromise Microsoft 365 accounts. We observed that the attackers registered their own authenticator app with notification and code. They made this move right after they gained access to the hijacked account as part of an automated attack flow execution. This, in turn, allowed them to secure their foothold within the targeted cloud environment. The typical MFA manipulation flow using Microsoft\'s “My Sign-Ins” app. 2. After the compromise, the attackers demonstrated a sophisticated approach. They combined MFA manipulation with OAuth application abuse. With OAuth abuse, an attacker authorizes and/or uses a third-party app to steal data, spread malware or execute other malicious activities. Attackers also use the abused app to maintain persistent access to specific resources even after their initial access to a compromised account has been cut off. 3. The attackers authorized the seemingly benign application, “PERFECTDATA SOFTWARE,” to gain persistent access to the user\'s account and the systems, as well as the resources and applications that the user could access. The permissions the attackers requested for this app included: | Malware Tool Vulnerability Threat Cloud | ★★★ | |
 |
2024-01-03 19:16:54 | APT28: de l'attaque initiale à la création de menaces à un contrôleur de domaine en une heure APT28: From Initial Attack to Creating Threats to a Domain Controller in an Hour (lien direct) |
#### Description
Entre le 15 et 25 décembre, 2023, une série de cyberattaques a été identifiée impliquant la distribution des e-mails contenant des liens vers des «documents» présumés parmi les organisations gouvernementales.
Cliquer sur ces liens a entraîné une infection des logiciels malveillants.L'enquête a révélé que les liens ont redirigé les victimes vers un site Web où un téléchargement basé sur JavaScript a lancé un fichier de raccourci.L'ouverture de ce fichier a déclenché une commande PowerShell pour télécharger et exécuter un document de leurre, un interprète Python et un fichier Masepie classifié nommé client.py.Par la suite, divers outils, notamment OpenSSH, Steelhook PowerShell Scripts et la porte dérobée OceanMap ont été téléchargés, avec des outils supplémentaires comme Impacket et SMBEXEC créés pour la reconnaissance du réseau et le mouvement latéral.Les tactiques globales, les techniques et les outils utilisés ont indiqué le groupe APT28.Notamment, la stratégie d'attaque a indiqué un plan plus large pour compromettre l'ensemble du système d'information et de communication de l'organisation, mettant l'accent sur la menace potentielle pour l'ensemble du réseau.Des attaques similaires ont également été signalées contre des organisations polonaises.
#### URL de référence (s)
1. https://cert.gov.ua/article/6276894
#### Date de publication
3 janvier 2024
#### Auteurs)
Certificat
#### Description Between December 15-25, 2023, a series of cyberattacks were identified involving the distribution of emails containing links to purported "documents" among government organizations. Clicking on these links resulted in malware infecting computers. Investigation revealed that the links redirected victims to a website where a JavaScript-based download initiated a shortcut file. Opening this file triggered a PowerShell command to download and execute a decoy document, a Python interpreter, and a classified MASEPIE file named Client.py. Subsequently, various tools including OPENSSH, STEELHOOK PowerShell scripts, and the OCEANMAP backdoor were downloaded, with additional tools like IMPACKET and SMBEXEC created for network reconnaissance and lateral movement. The overall tactics, techniques, and tools used pointed to the APT28 group. Notably, the attack strategy indicated a broader plan to compromise the entire organization\'s information and communication system, emphasizing the potential threat to the entire network. Similar attacks were also reported against Polish organizations. #### Reference URL(s) 1. https://cert.gov.ua/article/6276894 #### Publication Date January 3, 2024 #### Author(s) CERT-UA |
Malware Tool Threat | APT 28 | ★★★★ |
 |
2024-01-03 16:46:00 | \\ 'Black Basta Buster \\' exploite le bogue du ransomware pour la récupération de fichiers \\'Black Basta Buster\\' Exploits Ransomware Bug for File Recovery (lien direct) |
Un outil permet désormais que les fichiers de victime chiffrés par le gang Black Basta Cybercriminal soient entièrement ou partiellement récupérables, selon leur taille.
A tool now allows for victim files encrypted by the Black Basta cybercriminal gang to be fully or partially recoverable, depending on their size. |
Ransomware Tool | ★★ | |
|
2024-01-03 11:00:00 | Décodage du piratage éthique: une exploration complète des pratiques de chapeau blanc Decoding ethical hacking: A comprehensive exploration of white hat practices (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. In era of digital devices, where the specter of data breaches and cyber threats looms large, the role of ethical hackers, colloquially known as white hat hackers, has become paramount. This article embarks on an in-depth journey into the realm of ethical hacking, illuminating its profound significance in identifying vulnerabilities and fortifying the intricate tapestry of overall cybersecurity. Ethical hacking, at its core, entails authorized and legal endeavors to infiltrate computer systems, networks, or applications. The primary objective is to unveil vulnerabilities. Diverging from their malevolent counterparts, ethical hackers leverage their skills to fortify security rather than exploit weaknesses. The strategic importance of ethical hacking: Proactive defense: Ethical hacking adopts a proactive stance, aiming to unearth and neutralize potential threats before malicious actors can exploit them. Vulnerability assessment: Systematic assessments conducted by ethical hackers pinpoint weaknesses in systems, networks, and applications, enabling organizations to address vulnerabilities in a timely manner. Compliance and risk management: Ethical hacking aligns seamlessly with regulatory compliance requirements, facilitating effective risk management. This ensures organizations adhere to industry standards and safeguard sensitive information. The crucial role of ethical hackers 1. Identifying vulnerabilities: Ethical hackers employ an array of techniques, including penetration testing, code review, and network analysis, to uncover vulnerabilities. By replicating the tactics of malicious hackers, they unveil potential entry points and weaknesses susceptible to exploitation. 2. Penetration testing: A cornerstone of ethical hacking, penetration testing involves simulating real-world cyber-attacks to evaluate the security posture of a system. This practice assesses how well an organization\'s defenses can withstand various threats. 3. Code Review: Analyzing source code for security flaws is fundamental. Ethical hackers scrutinize the codebase to identify vulnerabilities such as injection flaws, buffer overflows, and insecure dependencies. Navigating the ethical hacking process 1. Planning: Ethical hacking commences with meticulous planning. The ethical hacker collaborates with the organization to define the scope, goals, and methodologies of the assessment. 2. Reconnaissance: Gathering information about the target system is a critical phase. Ethical hackers employ both passive and active reconnaissance techniques to understand the environment they are assessing. 3. Scanning: The scanning phase involves identifying live hosts, open ports, and services on a network. Tools like Nmap and Nessus are commonly employed to assess the target\'s attack surface comprehensively. 4. Gaining access: Ethical hackers attempt to exploit identified vulnerabilities, gaining access to systems or sensitive data. This phase provides organizations insights into the potential impact of a suc | Tool Vulnerability Threat | ★★★ | |
 |
2024-01-03 02:51:07 | Sécurité CI / CD: meilleures pratiques avancées pour sécuriser vos pipelines CI/CD Security: Advanced Best Practices to Secure Your Pipelines (lien direct) |
L'intégration continue et la sécurité continue (CI / CD) sont devenues cruciales pour les pratiques de développement logiciel modernes.À mesure que la vitesse du développement de logiciels augmente avec DevOps et les méthodologies agiles, il est de plus en plus nécessaire d'assurer l'intégrité des logiciels sur l'ensemble du pipeline de développement.La sécurité CI / CD englobe les pratiques, les outils et les méthodologies qui protègent le pipeline de livraison du logiciel contre les menaces potentielles.Essentiellement, il s'agit de garantir que le code que nous réintégrons et déploie et le logiciel comprenant le pipeline lui-même est aussi sécurisé que possible.Ce...
Continuous Integration and Continuous Delivery (CI/CD) security has become crucial to modern software development practices. As the speed of software development increases with DevOps and Agile methodologies, there is a growing need to ensure the integrity of software across the entire development pipeline. CI/CD security encompasses the practices, tools, and methodologies that protect the software delivery pipeline from potential threats. In essence, it\'s about ensuring that the code we\'re integrating and deploying and the software comprising the pipeline itself is as secure as possible. This... |
Tool | ★★ | |
 |
2024-01-02 21:20:00 | L'Ukraine dit que la Russie a piraté des caméras Web pour espionner des cibles à Kyiv Ukraine says Russia hacked web cameras to spy on targets in Kyiv (lien direct) |
Les agents de sécurité de l'Ukraine \\ ont déclaré avoir éliminé deux caméras de surveillance en ligne qui auraient été piratées par la Russie pour espionner les forces aériennes de défense et les infrastructures critiques dans la capitale de l'Ukraine \\, Kiev.Les caméras ont été installées sur des bâtiments résidentiels de Kiev et ont été initialement utilisés par les résidents pour surveiller les environs et le parking.Après piratage
Ukraine\'s security officers said they took down two online surveillance cameras that were allegedly hacked by Russia to spy on air defense forces and critical infrastructure in Ukraine\'s capital, Kyiv. The cameras were installed on residential buildings in Kyiv and were initially used by residents to monitor the surrounding area and parking lot. After hacking |
Tool Threat | ★★★ | |
 |
2024-01-02 09:30:00 | Black Basta Ransomware Decryptor publié Black Basta Ransomware Decryptor Published (lien direct) |
Les chercheurs de SRLABS ont révélé une nouvelle suite d'outils de décryptage pour Black Basta Ransomware
Researchers at SRLabs have revealed a new suite of decryption tools for Black Basta ransomware |
Ransomware Tool | ★★ | |
|
2024-01-02 08:41:00 | 6 Exigences d'assurance cybersécurité Votre entreprise doit être prête à répondre 6 Cybersecurity Insurance Requirements Your Business Should Be Ready To Meet (lien direct) |
Every year, more companies are finding out firsthand how damaging a cyberattack can be. Research for the 2023 State of the Phish report from Proofpoint found that 30% of companies that were successfully attacked experienced a direct monetary loss. That\'s an increase of 76% year over year. And costs for these attacks are rising. IBM reports that the global average cost of a data breach went up by 15% over the last three years, hitting $4.45 million in 2023. Concerns about costs and risks mean that more companies than ever are buying cyber insurance. A World Economic Forum survey found that 71% of organizations have cyber insurance. And Allied Market Research projects that the global cyber insurance market, which is currently valued at $12.5 billion, will reach $116.7 billion by 2032. Investing in cyber insurance for your business can be a wise strategy. For one, it helps you to transfer some of the financial risks of a cybersecurity event to your insurance provider. But the cyber insurance landscape is changing. You should know that getting the coverage you want might be a challenge, and you will need to meet an array of cybersecurity insurance requirements. In this blog post, we\'ll cover six of the most common requirements you\'ll likely need to fulfill. What is cyber insurance-and what does it cover? But first, let\'s take a closer look at what cyber insurance is and why it is important. Also known as cyber liability insurance, this relatively new type of insurance helps to protect businesses and individuals from the negative impacts of cybersecurity events. It generally covers: Loss of data and the associated recovery Loss of revenue due to business interruption Loss of transferred funds from cyberattacks, like business email compromise (BEC) and phishing Loss of funds from ransomware and extortion Many policies also cover the aftermath and follow-up events associated with a data breach. This includes the costs associated with identifying and notifying victims, credit monitoring for victims and forensics expertise, to name a few. Why is cyber insurance important? For many companies, cyber insurance is an essential part of their risk management strategy. It covers many costs related to cyber events, such as legal expenses and fees for compliance violations. Depending on the policy, it might also cover: Ransomware attacks. If your business is hit with a ransomware attack, you may face demands for payment to unlock your systems. Or you may need to pay a ransom to prevent the release of sensitive data. In certain cases, cyber insurance can help cover ransom payments. Incident response and recovery. Cybersecurity insurance can help with the cost of investments you may need to make after an attack. For example, you may need to hire experts, conduct forensic investigations, and implement tools and measures to prevent future attacks. Business disruption. This may include lost revenue during downtime. This coverage can help your business stay afloat financially and continue operating in the wake of a cyber event. Want more details on the benefits of cyber insurance? Download the Proofpoint presentation, “Cyber Insurance: Facts, Figures and Policy Fundamentals.” Examples of common cyber insurance requirements As noted earlier, getting coverage is more complicated than it used to be. Because security breaches are so costly and cybercrime is so common, many insurers have become more stringent in their underwriting processes. Some have lowered caps for payouts and narrowed their coverage offerings as well. This means that the requirements your business may be expected to meet will be fairly complex. Every provider will likely conduct a risk assessment to determine if you qualify for cyber insurance. The process will help them to determine how much coverage they can offer you, and what you\'ll need to pay for it. The risk assessment might be as quick and simple as a questionnaire or as complex and time-consuming as a third-party audit. Here are six examples | Ransomware Data Breach Tool Threat | ★★★ | |
|
2024-01-02 08:00:00 | View Rendered Source – Une extension Chrome pour explorer les entrailles des pages web (lien direct) | "View Rendered Source" est une extension Chrome qui permet aux développeurs de comprendre comment le navigateur transforme le code source HTML en Document Object Model (DOM) fonctionnel. Il donne une vue en temps réel des modifications apportées par JavaScript et offre une solution pour émuler le code source pour les appareils mobiles. L'extension est gratuite et facile à utiliser. | Tool | ★★★★ | |
 |
2024-01-01 16:39:46 | Les chercheurs fissurent le pilote automatique de Tesla avec le mode \\ 'elon, \\' accéder aux données critiques Researchers Crack Tesla Autopilot with \\'Elon Mode,\\' Access Critical Data (lien direct) |
par deeba ahmed
Rechercheurs allemands de cybersécurité de Technische Universit & Auml; t Berlin a utilisé un outil A & Euro; 600 (& Pound; 520 - 660 $) pour accéder à Root accès à la carte de circuit circuit basée sur ARM64 de l'autopilote de Tesla \\.
Ceci est un article de HackRead.com Lire la publication originale: Les chercheurs fissurent le pilote automatique de Tesla avec & # 8216; Mode Elon, & # 8217;Accéder aux données critiques
By Deeba Ahmed German cybersecurity researchers from Technische Universität Berlin employed a €600 (£520 - $660) tool to gain root access to the ARM64-based circuit board of Tesla\'s autopilot. This is a post from HackRead.com Read the original post: Researchers Crack Tesla Autopilot with ‘Elon Mode,’ Access Critical Data |
Tool | ★★★ | |
|
2024-01-01 08:00:00 | Whisper Web – La reconnaissance vocale directement accessible depuis votre navigateur (lien direct) | Whisper Web est une version en ligne de l'outil d'OpenAI, Whisper, qui transcrit l'audio en texte sans installer de lourd modèle IA. Compatible avec plusieurs langues, il offre la possibilité de traduire en temps réel et convient parfaitement à la transcription d'interviews, de podcasts ou à la création de sous-titres. Son accès gratuit via un site web le rend facilement accessible. | Tool Threat | ★★★ | |
 |
2023-12-31 21:26:05 | Gardez l'histoire vivante pour Ddosecrets Keep the story alive for DDoSecrets (lien direct) |
Soutenez notre collecte de fonds pour conserver la plus grande bibliothèque de fuites en ligne
Support our fundraiser to keep the largest library of leaks online |
Tool | ★★★ | |
|
2023-12-31 19:14:22 | Microsoft désactive l'installateur de l'application après que la fonctionnalité est abusée pour les logiciels malveillants Microsoft Disables App Installer After Feature is Abused for Malware (lien direct) |
> Par deeba ahmed
Selon l'équipe Microsoft Threat Intelligence, les acteurs de la menace étiquetés comme \\ 'motivé financièrement \' utilisent le schéma URI MS-Appinstaller pour la distribution de logiciels malveillants.
Ceci est un article de HackRead.com Lire le post original: Microsoft désactive l'installateur de l'application après que la fonctionnalité est abusée pour les logiciels malveillants
>By Deeba Ahmed According to the Microsoft Threat Intelligence Team, threat actors labeled as \'financially motivated\' utilize the ms-appinstaller URI scheme for malware distribution. This is a post from HackRead.com Read the original post: Microsoft Disables App Installer After Feature is Abused for Malware |
Malware Tool Threat | ★★★ | |
 |
2023-12-29 14:39:00 | Des pirates Kimsuky déploient Appleseed, Meterpreter et Tinynuke dans les dernières attaques Kimsuky Hackers Deploying AppleSeed, Meterpreter, and TinyNuke in Latest Attacks (lien direct) |
Nation-state actors affiliated to North Korea have been observed using spear-phishing attacks to deliver an assortment of backdoors and tools such as AppleSeed, Meterpreter, and TinyNuke to seize control of compromised machines.
South Korea-based cybersecurity company AhnLab attributed the activity to an advanced persistent threat group known as Kimsuky.
“A notable point about attacks that
Nation-state actors affiliated to North Korea have been observed using spear-phishing attacks to deliver an assortment of backdoors and tools such as AppleSeed, Meterpreter, and TinyNuke to seize control of compromised machines. South Korea-based cybersecurity company AhnLab attributed the activity to an advanced persistent threat group known as Kimsuky. “A notable point about attacks that |
Tool Threat | APT 43 | ★★★ |
 |
2023-12-29 12:03:53 | L'IA est effrayante pour deviner l'emplacement des photos aléatoires AI Is Scarily Good at Guessing the Location of Random Photos (lien direct) |
wow:
Pour tester les performances de Pigeon, je lui ai donné cinq photos personnelles d'un voyage que j'ai fait à travers l'Amérique il y a des années, dont aucune n'a été publiée en ligne.Certaines photos ont été prises dans les villes, mais quelques-unes ont été prises dans des endroits nulle part près des routes ou d'autres points de repère facilement reconnaissables.
qui ne semble pas avoir beaucoup d'importance.
Il a deviné un camping à Yellowstone à environ 35 miles de l'emplacement réel.Le programme a placé une autre photo, prise dans une rue de San Francisco, à quelques blocs de ville.
Toutes les photos ne correspondaient pas faciles: le programme a lié à tort une photo prise sur le frontal du Wyoming à un endroit le long de la gamme de frontaux du Colorado, à plus de cent kilomètres.Et il a deviné qu'une photo du canyon de la rivière Snake en Idaho était de la gorge de Kawarau en Nouvelle-Zélande (en toute honnêteté, les deux paysages sont remarquablement similaires) ...
Wow: To test PIGEON’s performance, I gave it five personal photos from a trip I took across America years ago, none of which have been published online. Some photos were snapped in cities, but a few were taken in places nowhere near roads or other easily recognizable landmarks. That didn’t seem to matter much. It guessed a campsite in Yellowstone to within around 35 miles of the actual location. The program placed another photo, taken on a street in San Francisco, to within a few city blocks. Not every photo was an easy match: The program mistakenly linked one photo taken on the front range of Wyoming to a spot along the front range of Colorado, more than a hundred miles away. And it guessed that a picture of the Snake River Canyon in Idaho was of the Kawarau Gorge in New Zealand (in fairness, the two landscapes look remarkably similar)... |
Tool Threat | ★★★★ | |
|
2023-12-29 08:35:15 | Pointpoint de preuve nommé fournisseur représentatif en 2023 Gartner & Reg;Guide du marché pour la gouvernance des communications numériques Proofpoint Named as a Representative Vendor in 2023 Gartner® Market Guide for Digital Communications Governance (lien direct) |
It has been more than a year since Gartner retired its Magic Quadrant for Enterprise Information Archiving, which it had published for many years. When it first happened, many of us from the compliance, e-discovery and archiving world wondered what research would come next. Now the wait is over. On November 13, 2023, Gartner unveiled its new Market Guide for Digital Communications Governance (DCG). And it named Proofpoint as a Representative DCG solution Vendor. Gartner says, “Gartner retired the Magic Quadrant for Enterprise Information Archiving in 2022. This DCG research recognizes the rise in communication tool complexity and demand from clients to seek guidance on the selection of vendors and solutions that specialize in communications governance.” The Gartner Market Guide presents a “definition, rationale and dynamics” for the DCG market and a list of Representative Vendors. It is now up to clients to download the Market Guide so that they can learn more about digital communications governance. And they can refer to Gartner recommendations as they look into DCG solutions that will work best for their business. In this blog post, I go over some of initial coverage of DCG by Gartner. I also provide insights into some of the key points that are made in the new report. Assessing a strategic planning assumption Gartner specifies two strategic planning assumptions in the Market Guide. Here is a look at the first one: “By 2027, 40% of enterprise customers will proactively assess workstream collaboration and meeting solution content for corporate policy and general business insights, up from less than 5% in 2023.” We believe this seems reasonable at face value if you apply it to businesses that operate in regulated industries like financial services. But I question its validity if the intent is to expand it to all verticals. Customers that use a DCG solution as a way to improve their litigation readiness will likely find the deployment of a supervision/surveillance solution for “corporate policy and general business insights” to be a “nice to have,” not a “must have.” I suspect that, in general, these customers will agree to the value in principle. But they will struggle to gain executive sponsors and budget in the absence of: Regulatory mandates that compel relevant action, like the Financial Industry Regulatory Authority (FINRA) or the U.S. Securities and Exchange Commission (SEC) for financial services Widely accepted performance statistics, such as archive search performance or archive system availability It will be interesting to revisit this assumption in 2027. At that point, we\'ll see how much progress has been made on the regulatory and statistics fronts-and the percentage of enterprise customers. Compliance risk versus security risk In the Market Direction section of the report, under “Compliance risk versus security,” Gartner states, “Most frequently used for adherence to compliance use cases, solutions are expanding to broader uses in security risk.” No vendor will do integrations simply because they are cool ideas. They need compelling use cases and business cases. However, with Proofpoint you have a single vendor that offers leading technology for both digital communications governance and security. To learn more about these platforms, check out Proofpoint Aegis threat protection and the Proofpoint Sigma information protection. For more than 15 years, we have provided innovative solutions to address compliance use cases as well as security use cases. Most of the customers we work with who use Proofpoint Intelligent Compliance offerings are Proofpoint security customers, as well. The use of machine learning to improve supervision and surveillance Gartner addresses the use of these technologies in the Market Analysis section of the Market Guide, under “Supervision and surveillance capabilities.” It says, “The results can be used for improved automated monitoring/tagging, and accuracy and efficiency outcomes | Tool Threat Commercial | ★★ | |
 |
2023-12-28 12:43:18 | Les pirates militaires russes ciblent l'Ukraine avec de nouveaux logiciels malveillants Masepie Russian military hackers target Ukraine with new MASEPIE malware (lien direct) |
L'équipe d'intervention d'urgence informatique de l'Ukraine (CERT) prévient une nouvelle campagne de phishing qui a permis aux pirates de russe à déployer des logiciels malveillants invisibles auparavant sur un réseau en moins d'une heure.[...]
Ukraine\'s Computer Emergency Response Team (CERT) is warning of a new phishing campaign that allowed Russia-linked hackers to deploy previously unseen malware on a network in under one hour. [...] |
Malware Tool Threat | ★★★ | |
|
2023-12-28 11:00:00 | Sauvegarde de votre expérience en ligne: un guide pour bloquer les publicités non sollicitées avec Adblockers Safeguarding your online experience: A guide to blocking unsolicited ads with adblockers (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. The internet is a vast realm of information and entertainment. However, it\'s also riddled with a persistent nuisance: unsolicited ads. These intrusive advertisements not only disrupt your online experience but also pose significant security risks. In this comprehensive guide, we\'ll explore the intricate world of adblockers and their pivotal role in enhancing your cybersecurity by effectively blocking unsolicited ads. Understanding the ad landscape Before we delve into the realm of adblockers, it\'s essential to comprehend the complex ecosystem of online advertisements: Display ads: These are the most common ads you encounter on websites. They can be static images, animated banners, or even video ads. Pop-up ads: Pop-up ads appear in separate windows or tabs, often triggered when you visit a specific page or perform an action on a website. Video ads: These ads play within videos or before you can access certain content. They vary from short pre-roll ads to longer mid-roll ads. Social media ads: Popular social platforms often serve ads in your feed or as sponsored posts. Native ads: These advertisements seamlessly blend with the content around them, making them appear less intrusive. The intrusive nature of unsolicited ads Unsolicited ads, commonly referred to as "adware," are notorious for their disruptive and intrusive characteristics. They can: Slow down your web browsing experience by consuming bandwidth. Track your online behavior and collect personal information. Expose you to potentially malicious content and scams. Affect website aesthetics and distract from the content you want to view. The role of adblockers Adblockers are the digital shields that protect your online experience by eliminating or minimizing the impact of unsolicited ads. Let\'s explore three popular adblockers and their features: Adblock Plus (ABP): Adblock Plus is a widely used and highly customizable adblocker. It allows you to create your filters and tailor your ad-blocking preferences. uBlock Origin: uBlock Origin is a lightweight yet potent adblocker. It\'s known for its efficiency in blocking ads and its minimal impact on system resources. AdNauseam: AdNauseam is an intriguing adblocker that takes a unique approach. It not only blocks ads but also clicks on them, making it harder for advertisers to track your online behavior. Blocking unsolicited ads with Adblock Plus Adblock Plus is a robust and versatile adblocker that offers comprehensive ad-blocking capabilities. Here\'s how you can use it to block unsolicited ads: Install Adblock Plus: Visit the Adblock Plus website and download the extension for your preferred browser. It\'s available for Chrome, Firefox, Edge, and more. Install the Adblock Plus filter: Adblock Plus employs filters to block ads. Upon installation, it provides a default filter list to get you started. However, you can enhance your ad-blocking by adding additional filters, such as EasyList, which covers a wide range of ads. Customize your filters: Adblock Plus offers user-friendly settings for customizing your ad-blocking preferences. You can allow or block specific ads on individual websites, granting you fine control. Blocking unsolicited ads with uBlock Origin uBlock Origin is renowned for its efficiency and resource-friendliness. Here\'s how you can use it to block unsolicited ads: Install uBlock Origin: Visit the uBlock Origin website and download the extension for your browser. It\'s available for various browsers, including Chrome, Fir | Malware Tool | ★★ | |
|
2023-12-27 19:51:34 | Pourquoi les portails du conseil virtuel sont la clé d'une meilleure collaboration et prise de décision Why Virtual Board Portals are the Key to Better Collaboration and Decision-Making (lien direct) |
> Par owais sultan
Les réunions sans papier sont devenues une réalité grâce aux technologies avancées.Les outils numériques aident les entreprises à être plus efficaces & # 8230;
Ceci est un article de HackRead.com Lire le post original: Pourquoi les portails de conseils virtuels sont la clé d'une meilleure collaboration et prise de décision
>By Owais Sultan Meetings without paper have become a reality thanks to advanced technologies. Digital tools help companies be more efficient… This is a post from HackRead.com Read the original post: Why Virtual Board Portals are the Key to Better Collaboration and Decision-Making |
Tool | ★★ | |
|
2023-12-27 10:59:00 | AVERTISSEMENT: serveurs Linux SSH mal sécurisés sous attaque pour l'exploitation de la crypto-monnaie Warning: Poorly Secured Linux SSH Servers Under Attack for Cryptocurrency Mining (lien direct) |
Les serveurs Linux SSH mal sécurisés sont ciblés par de mauvais acteurs pour installer des scanners de port et des outils d'attaque du dictionnaire dans le but de cibler d'autres serveurs vulnérables et de les coopter dans un réseau pour effectuer l'extraction de crypto-monnaie et le déni distribué (DDOS)attaques.
"Les acteurs de la menace peuvent également choisir d'installer uniquement des scanners et de vendre la propriété intellectuelle violée et les informations d'identification du compte sur
Poorly secured Linux SSH servers are being targeted by bad actors to install port scanners and dictionary attack tools with the goal of targeting other vulnerable servers and co-opting them into a network to carry out cryptocurrency mining and distributed denial-of-service (DDoS) attacks. "Threat actors can also choose to install only scanners and sell the breached IP and account credentials on |
Tool | ★★★ | |
|
2023-12-27 09:19:46 | 3 incontournables des performances de recherche d'archives: une comparaison de logiciels d'archives de messagerie 3 Must-Haves of Archive Search Performance: An Email Archive Software Comparison (lien direct) |
Yes, it\'s true that customers who use legacy on-premises archives or even modern cloud solutions say “fast search performance” is a primary reason to migrate to Proofpoint Archive. Our customers often highlight “fast search performance” as a key email archiving solution element. For reference, look no further than Gartner Peer Insights, where “search/index” is ranked the highest out of product feature areas evaluated by our customers. However, you don\'t buy a Tesla Model X just for its top speed. You don\'t purchase a Rolex just to tell time. And you don\'t subscribe to or license an archive just for its search performance. Of course, not having adequate search performance can spell dire consequences when you need to address e-discovery requests. Think of having to settle a lawsuit early because you can\'t get search results in time to determine whether it makes better sense to litigate. But there\'s more to email archive search performance than just speed. In this blog, we\'ll explore three factors that drive positive outcomes for our customers. Speed is one, and the other two are scalability and ease of use. 1: Speed When you run a search for specific information in your email archive, how long does it take to retrieve that information? Hours? Days? Longer? Search speed dictates how fast you receive results from a search. While some vendor email archiving tools are incredibly slow, Proofpoint Archive has a financially backed search service-level agreement (SLA) that obligates us to return search results in seconds, on average, for our customers. To give you with some context, here\'s what we found when we compared the email archive search speeds of Microsoft Purview eDiscovery and Proofpoint Archive-specifically when searching 100 mailboxes and 50,000 mailboxes. For this example, a total of 200 searches were run, based on an average of 10 cases managed per month with each case requiring 20 searches to be performed. Microsoft doesn\'t have search performance SLAs. But they provide “guidelines for average search time” based on the number of mailboxes searched. (See the table below.) Guidelines for average search times for Microsoft Purview eDiscovery solutions. Based on internal, anonymous archive usage reports, as of August 2023 the average search time for Proofpoint Archive was 3.28 seconds. Also, it\'s estimated that Microsoft will take about 1.67 hours to return results when searching 100 mailboxes. Proofpoint Archive returned results in about 0.18 hours, as shown below. A comparison of search speed between Microsoft and Proofpoint. At this level of searching, the search speed difference may not seem significant. However, if you factor in rerunning searches due to new data or a system failure (like index corruption) with Microsoft, the numbers can grow rapidly. The search speed expectation with Proofpoint remains consistent, given our average search performance, particularly when you run consecutive searches. The search speed difference becomes more noteworthy when you consider highly litigious organizations that need to run hundreds or thousands of searches across hundreds or thousands of mailboxes. In the second scenario, when searching 50,000 mailboxes, it\'s estimated that Microsoft will take about 66.67 hours to return search results. That\'s like having your team “babysit” Microsoft e-discovery searches for more than a week and a half every month! Separately, Proofpoint Archive is expected to remain the same at 0.18 hours. With Proofpoint, you get search results from the archive when you need them, helping to improve your ability to respond to e-discovery requests and internal investigations in a timely fashion. 2: Scalability When you address an e-discovery request, do you run only one search? Probably not. The factor of search scalability defines your ability to achieve your expected search speed performance time and time again, regardless of whether you\'re searching 100 mailboxes or 50,000 mailboxes-and regardless of | Tool Cloud | ★★★ | |
 |
2023-12-25 11:15:35 | 2 Secrets moins connus des outils de ligne de commande de commande Windows Command… 2 less known secrets of Windows command command-driven line tools… (lien direct) |
De nombreuses commandes de prise en charge des outils Windows F.Ex.: Nous sommes très habitués à leurs invocations dans une forme de commande d'outils, mais il existe un autre moyen de les invoquer en utilisant des citations autour de ces commandes f.ex.: Cela rompt de nombreuses détections codées durs.& # 8230; Continuer la lecture & # 8594;
Many Windows tools support commands f.ex.: We are very used to their invocations in a form of tool command but there is an alternative way to invoke them by using quotes around these commands f.ex.: This breaks many hard-coded detections. … Continue reading → |
Tool Technical | ★★★★ | |
|
2023-12-22 23:30:00 | Genai Tools imprègnera tous les domaines de l'entreprise GenAI Tools Will Permeate All Areas of the Enterprise (lien direct) |
De nombreux départements et groupes voient les avantages de l'utilisation d'outils d'IA génératifs, ce qui compliquera les équipes de sécurité \\ 'de protéger l'entreprise des fuites de données et des violations de conformité et de confidentialité.
Many departments and groups see the benefits of using generative AI tools, which will complicate the security teams\' job of protecting the enterprise from data leaks and compliance and privacy violations. |
Tool | ★★★ | |
 |
2023-12-22 14:20:26 | Mises à jour CISA: Guide Microsoft 365, outil Scubagear, Mozilla Alert, QNAP & FXC Vulnérabilités Entrez Kev CISA Updates: Microsoft 365 Guidance, SCuBAGear Tool, Mozilla Alert, QNAP & FXC Vulnerabilities Enter KEV (lien direct) |
CISA a officiellement publié les bases de base de configuration sécurisée Microsoft 365, visant à aider les organisations à ...
CISA has officially released the Microsoft 365 Secure Configuration Baselines, aiming to assist organizations in... |
Tool Vulnerability | ★★ | |
|
2023-12-22 13:10:25 | Ubisoft dit que cela enquête sur les rapports d'une nouvelle violation de sécurité Ubisoft says it\\'s investigating reports of a new security breach (lien direct) |
Ubisoft examine si elle a subi une violation après que des images de logiciels internes et de développeurs internes de la société ont été divulguées en ligne.[...]
Ubisoft is investigating whether it suffered a breach after images of the company\'s internal software and developer tools were leaked online. [...] |
Data Breach Tool | ★★★ | |
 |
2023-12-22 10:50:20 | Résultats clés du rapport de la menace ESET H2 2023 & # 8211;Semaine en sécurité avec Tony Anscombe Key findings from ESET Threat Report H2 2023 – Week in security with Tony Anscombe (lien direct) |
Comment les cybercriminels profitent de la popularité de Chatgpt et d'autres outils de ses semblables pour diriger les gens vers des sites sommaires, ainsi que d'autres résultats intéressants du dernier rapport de menace d'Eset \\
How cybercriminals take advantage of the popularity of ChatGPT and other tools of its ilk to direct people to sketchy sites, plus other interesting findings from ESET\'s latest Threat Report |
Tool Threat Studies | ChatGPT | ★★★★ |
|
2023-12-22 08:30:15 | Faux extensions de chrome VPN Fake VPN Chrome extensions force-installed 1.5 million times (lien direct) |
Trois extensions de chrome malveillant présentant un VPN (réseaux privés virtuels) infectés ont été téléchargés 1,5 million de fois, agissant comme des pirateurs de navigateur, des outils de piratage de cashback et des voleurs de données.[...]
Three malicious Chrome extensions posing as VPN (Virtual Private Networks) infected were downloaded 1.5 million times, acting as browser hijackers, cashback hack tools, and data stealers. [...] |
Hack Tool | ★★ | |
 |
2023-12-22 08:09:56 | Ukraine, les partenaires internationaux lancent l'outil de mécanisme Tallinn pour la cyber-coopération Ukraine, international partners launch Tallinn Mechanism tool for cyber cooperation (lien direct) |
> Une coalition de ministères des affaires étrangères, dont l'Ukraine, le Canada, le Danemark, l'Estonie, la France, l'Allemagne, les Pays-Bas, la Pologne, la Suède, ...
>A coalition of ministries of foreign affairs, including Ukraine, Canada, Denmark, Estonia, France, Germany, the Netherlands, Poland, Sweden,... |
Tool | ★★ | |
|
2023-12-21 21:09:57 | Apache ActiveMQ Vulnerability (CVE-2023-46604) Continuously Being Exploited in Attacks (lien direct) | #### Description
AHNLAB Security Emergency Response Center (ASEC) a signalé que la vulnérabilité d'Apache ActiveMQ (CVE-2023-46604) est exploitée par divers acteurs de menace.La vulnérabilité est une vulnérabilité d'exécution de code distant dans le serveur de modèle de messagerie et d'intégration open source apache activemq.
L'attaque de vulnérabilité consiste à manipuler un type de classe sérialisé dans le protocole OpenWire pour instancier la classe dans le chemin de classe.Lorsque l'acteur de menace transmet un paquet manipulé, le serveur vulnérable fait référence au chemin (URL) contenu dans le paquet pour charger le fichier de configuration XML pour la classe.Les logiciels malveillants utilisés dans les attaques comprennent Ladon, Netcat, AnyDesk et Z0min.Ladon est l'un des outils principalement utilisés par les acteurs de la menace chinoise.NetCAT est un utilitaire pour transmettre des données à et depuis certaines cibles dans un réseau connecté par le protocole TCP / UDP.AnyDesk, Netsupport et Chrome Remote Desktop ont récemment été utilisés pour contourner les produits de sécurité.Z0miner a été signalé pour la première fois en 2020 par l'équipe de sécurité de Tencent et a été distribué via des attaques exploitant les vulnérabilités d'exécution du code distant Oracle Weblogic (CVE-2020-14882 / CVE-2020-14883).
#### URL de référence (s)
1. https://asec.ahnlab.com/en/59904/
#### Date de publication
18 décembre 2023
#### Auteurs)
Sanseo
#### Description AhnLab Security Emergency Response Center (ASEC) has reported that the Apache ActiveMQ vulnerability (CVE-2023-46604) is being exploited by various threat actors. The vulnerability is a remote code execution vulnerability in the open-source messaging and integration pattern server Apache ActiveMQ. The vulnerability attack involves manipulating a serialized class type in the OpenWire protocol to instantiate the class in classpath. When the threat actor transmits a manipulated packet, the vulnerable server references the path (URL) contained in the packet to load the XML configuration file for the class. The malware used in the attacks includes Ladon, NetCat, AnyDesk, and z0Miner. Ladon is one of the tools that are mainly used by Chinese-speaking threat actors. Netcat is a utility for transmitting data to and from certain targets in a network connected by TCP/UDP protocol. AnyDesk, NetSupport, and Chrome Remote Desktop have recently been used for bypassing security products. z0Miner was first reported in 2020 by the Tencent Security Team and was distributed via attacks exploiting the Oracle Weblogic remote code execution vulnerabilities (CVE-2020-14882/CVE-2020-14883). #### Reference URL(s) 1. https://asec.ahnlab.com/en/59904/ #### Publication Date December 18, 2023 #### Author(s) Sanseo |
Malware Tool Vulnerability Threat | ★★★ | |
 |
2023-12-21 19:52:09 | Le meilleur de RED Canary \\ est le meilleur de 2023 Red Canary\\'s best of 2023 (lien direct) |
Regardez en arrière sur la recherche, les outils, les vidéos et autres ressources éducatives dont nous sommes les plus fiers de cette année.
Take a look back at the research, tools, videos, and other educational resources we\'re most proud of this year. |
Tool | ★★★ | |
|
2023-12-21 15:00:00 | Comment l'IA façonne l'avenir de la cybercriminalité How AI Is Shaping the Future of Cybercrime (lien direct) |
Les cybercriminels utilisent de plus en plus des outils d'IA pour lancer des attaques réussies, mais les défenseurs se battent.
Cybercriminals are increasingly using AI tools to launch successful attacks, but defenders are battling back. |
Tool | ★★ | |
|
2023-12-21 05:00:25 | Battleroyal, le cluster Darkgate se propage par e-mail et les fausses mises à jour du navigateur BattleRoyal, DarkGate Cluster Spreads via Email and Fake Browser Updates (lien direct) |
Overview Throughout the summer and fall of 2023, DarkGate entered the ring competing for the top spot in the remote access trojan (RAT) and loader category. It was observed in use by multiple cybercrime actors and was spread via many methods such as email, Microsoft Teams, Skype, malvertising and fake updates. Proofpoint researchers are tracking a particularly interesting operator of the DarkGate malware. At the time of publication, researchers are not attributing this cluster of activity to a known threat actor and are temporarily calling it BattleRoyal. Between September and November 2023, at least 20 email campaigns used DarkGate malware with GroupIDs “PLEX”, “ADS5”, “user_871236672” and “usr_871663321”. The GroupID is a configuration setting that is also referred to as username, botnet, campaign, or flag 23. The campaigns are notable for: Delivery: via email and RogueRaticate fake browser updates Volumes and geography: email campaigns include tens of thousands of emails targeting dozens of industries primarily in USA and Canada Attack chain: includes a variety of notable tools such as 404 TDS, Keitaro TDS, and .URL files exploiting CVE-2023-36025 Volume of DarkGate campaigns based on four GroupIDs discussed in this report. TDS all the things! (an email campaign example) On October 2, 2023, Proofpoint identified one of the first campaigns in this cluster. It was notable due to the use of more than one traffic delivery system (TDS), specifically 404 TDS and Keitaro TDS. Additionally, the .URL files involved exploited CVE-2023-36025, a vulnerability in Windows SmartScreen. While other parts of the attack chain from this actor changed or varied, .URL files were involved in every campaign. The emails in this campaign contained: 404 TDS URLs that, if clicked by the user, redirected to Keitaro TDS Keitaro TDS was observed serving an internet shortcut (.URL) file The internet shortcut, if double clicked, downloaded a zipped VBS script The VBS in turn downloaded and executed several shell commands (cmd.exe) The shell commands (a) created a directory on C: drive, (b) copied curl.exe from system folder to this new directory, (c) used the curl to download Autoit3.exe, (d) used curl to download and save an AutoIT script, and (e) ran the downloaded AutoIT script with the downloaded AutoIT interpreter The AutoIT script ran an embedded DarkGate Attack chain summary that follows the flow of: Email > 404 TDS > Keitaro TDS > .URL > .VBS > Shell commands > AutoIT / AutoIT script > DarkGate. Screenshot of an example email from October 2 campaign. Screenshot of the .URL file involved in the October 2 campaign. Proofpoint has identified multiple cybercriminal campaigns exploiting CVE-2023-36025; however, the BattleRoyal cluster exploited this vulnerability more than any other actor observed in Proofpoint threat data. Notably, this activity cluster exploited CVE-2023-36025 before it was published by Microsoft. SmartScreen is a security feature that is designed to prevent people from visiting malicious websites. The vulnerability could allow an actor to bypass the SmartScreen defenses if a user clicked on a specially crafted .URL file or a hyperlink pointing to a .URL file. More specifically, a SmartScreen alert would not be triggered when a .URL points to a SMB or WebDav share as file:// and the malicious payload is inside a ZIP file which is specified in the URL target. RogueRaticate (fake browser update campaign example) On October 19, 2023, an external researcher identified and publicly shared details of the RogueRaticate fake update activity cluster using an interesting obfuscation technique first identified in 2020. Proofpoint subsequently identified the activity in Proofpoint data. This campaign delivered fake browser update requests to end users on their web browsers that dropped a DarkGate payload with the “ADS5” GroupID. The threat actor injected a request to a domain they controlled that used .css steganography to conceal the malicious c | Malware Tool Vulnerability Threat Prediction | ★★ | |
 |
2023-12-20 20:01:01 | Tendances de la cybersécurité à surveiller en Australie en 2024 Cyber Security Trends to Watch in Australia in 2024 (lien direct) |
Les attaques de ransomwares contre les infrastructures et les entreprises du marché intermédiaire sont inférieures à augmenter, tandis que l'utilisation de cyber-outils d'IA se développera à mesure que les clients de l'informatique recherchent plus de signal et moins de bruit des vendeurs.
Ransomware attacks on infrastructure and mid-market businesses are tipped to rise, while the use of AI cyber tools will grow as IT customers seek more signal and less noise from vendors. |
Ransomware Tool | ★★ | |
|
2023-12-20 18:12:00 | La police allemande démarre le Kingdom Market, un Emporium DarkNet de produits illicites German police take down Kingdom Market, a darknet emporium of illicit goods (lien direct) |
Les forces de l'ordre allemandes ont saisi les serveurs du marché du royaume du marché Darknet, un bazar pour la drogue, les logiciels malveillants, les faux documents et d'autres outils pour les cybercriminels.Dans un Relexe de presse Mercredi, la police a déclaré un avis de tubas sur le pointle site Web et analysent désormais l'infrastructure du serveur de Kingdom Market \\ pour identifier les personnes derrière
German law enforcement has seized the servers of the darknet marketplace Kingdom Market, a bazaar for drugs, malware, fake documents and other tools for cybercriminals. In a press release on Wednesday, the police said they posted a takedown notice on the website and are now analyzing Kingdom Market\'s server infrastructure to identify the people behind |
Malware Tool Legislation | ★★★ | |
|
2023-12-20 15:00:00 | 3 façons d'utiliser des renseignements en temps réel pour vaincre les robots 3 Ways to Use Real-Time Intelligence to Defeat Bots (lien direct) |
Les boucles de rétroaction des renseignements sur les menaces sont un outil de plus en plus vital dans l'escalade de la bataille contre les bots.
Threat intelligence feedback loops are an increasingly vital tool in the escalating battle against bots. |
Tool Threat | ★★★ | |
|
2023-12-20 14:21:01 | 4 façons dont le correctif Veracode change la donne pour DevSecops 4 Ways Veracode Fix Is a Game Changer for DevSecOps (lien direct) |
Dans le monde en évolution rapide du développement de logiciels, trop souvent la sécurité prend le siège arrière pour respecter des délais stricts et fournir de nouvelles fonctionnalités.La découverte du logiciel a accumulé une dette de sécurité substantielle qui prendra des mois à réparer peut arnaquer les horaires des meilleures équipes de développement.
Un outil propulsé par l'IA qui aide les développeurs à résoudre les défauts devient un atout inestimable dans ce contexte.Dans Veracode Fix, nous avons exploité les capacités de l'IA générative pour construire un outil spécialisé qui permet aux développeurs de remédier aux défauts en quelques minutes sans écrire manuellement une seule ligne de code.
Regardez cette démo de 3 minutes de la façon dont vous pouvez facilement prendre du code défectueux et utiliser la correction de Veracode pour générer des suggestions de correction facilement implémentées.
4 avantages majeurs de la correction du Veracode dans DevSecops
Voici quatre façons dont Veracode corrige les suraliments de DevseCops et votre SDLC avec l'assainissement rapide des défauts de sécurité.
1. Abattre la dette de sécurité avec une réparation rapide des défauts
L'un des plus importants…
In the fast-paced world of software development, too often security takes a backseat to meeting strict deadlines and delivering new features. Discovering software has accrued substantial security debt that will take months to fix can rip up the schedules of even the best development teams. An AI-powered tool that assists developers in remediating flaws becomes an invaluable asset in this context. In Veracode Fix, we\'ve harnessed the capabilities of generative AI to build a specialized tool that allows developers to remediate flaws within minutes without manually writing a single line of code. Watch this 3-minute demo of how you can easily take flawed code and use Veracode Fix to generate easily-implemented remediation suggestions. 4 Major Benefits of Veracode Fix in DevSecOps Here are four ways that Veracode Fix supercharges DevSecOps and your SDLC with the swift remediation of security flaws. 1. Tackle Security Debt with Rapid Flaw Remediation One of the most significant… |
Tool | ★★★ | |
|
2023-12-20 11:00:00 | Des mesures peuvent-elles arrêter la montée des escroqueries technologiques? Can any measures stop the rise of tech scams? (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Tech scams are continuing to grow in scale and damage. According to CBS News, Americans have reported over $2.7 billion in losses to tech scams from social media alone. Further losses are being accrued through other sources, too, of course; but with that figure coming from one source, alone, the scale of the problem is laid out quite clearly. As more of the nation moves to a digital-first footing, these attacks are only likely to increase in volume, and scale, too. There is a strong argument that concerted and decisive action is needed, today, to halt their rise and make the internet safer for all. One way to make persuasive action is, potentially, through an assessment of the costs. Making a compelling case The government and internet service providers are, of course, keen to stop tech scams. It improves the reputation of businesses; and gives the government a better record when it comes to providing for the country. The role of government is in pushing regulation that can be enforced, monitored, and proper compliance put into place; and more needs to be done. Of course, governance speaks in money, and understanding the full cost of tech scams requires an assessment of the wider economic impact - not just from direct losses to consumers, but the knock on impact on businesses and regulators. After all, there is a significant risk of reputational damage; and the wider cost of tech fraud is estimated to be approaching $343 billion globally. There has been a focus from enforcement on stopping the tide; indeed, in July the FTC announced a huge push to bring greater enforcement of the regulations, resulting in up to $2 billion in fines. However, in the face of such a huge industry, there’s an argument that more needs to be done - starting with businesses. Applying business techniques A good way to protect consumers, from the business perspective, is to look at the advice and techniques. The US Chamber of Commerce has sought to do this through a series of advisories. A large focus has been placed on how cybercriminals use social engineering tactics to scam businesses; undermining the sense of trust and compassion that many rely on to take advantage. For businesses, the crucial factor is in keeping close control over your affairs in terms of that trust. Your livery and branding should be consistent and hard to replicate. On the phone, email, and in other communications, your business should have a method that makes it absolutely clear that your business, and only it, is communicating. Tech tools can help here, too, such as the use of personal information and the all-crucial two factor authentication. Essentially, you should make it as difficult as possible for any actor apart from the customer themselves to access their data - and stay on top of new developments. Human intelligence More often than not, however, the key to preventing tech scams is in the human resources you have at your disposal. As the Vermont Small Business Development Center notes, a lot of effective scam protection comes from the good senses of individuals. Employees who learn of | Tool Legislation | ★★ | |
|
2023-12-19 22:49:43 | Le ransomware BlackCat augmente les ante après la perturbation du FBI BlackCat Ransomware Raises Ante After FBI Disruption (lien direct) |
Le Federal Bureau of Investigation (FBI) des États-Unis a révélé aujourd'hui qu'il infiltrait le deuxième gang de ransomware le plus prolifique du monde, un groupe criminel basé en Russie connu sous le nom d'ALPHV et BlackCat.Le FBI a déclaré avoir saisi le site Web de Darknet de Gang \\ et publié un outil de décryptage que des centaines de sociétés de victimes peuvent utiliser pour récupérer des systèmes.Pendant ce temps, Blackcat a répondu en "déclenchant" son site Darknet avec un message promettant des commissions de 90% pour les affiliés qui continuent de travailler avec le groupe de crimes et de la saison ouverte sur tout, des hôpitaux aux centrales nucléaires.
The U.S. Federal Bureau of Investigation (FBI) disclosed today that it infiltrated the world\'s second most prolific ransomware gang, a Russia-based criminal group known as ALPHV and BlackCat. The FBI said it seized the gang\'s darknet website, and released a decryption tool that hundreds of victim companies can use to recover systems. Meanwhile, BlackCat responded by briefly "unseizing" its darknet site with a message promising 90 percent commissions for affiliates who continue to work with the crime group, and open season on everything from hospitals to nuclear power plants. |
Ransomware Tool | ★★ | |
|
2023-12-19 21:22:00 | Le FBI élimine les ransomwares BlackCat, publie un outil de décryptage gratuit FBI Takes Down BlackCat Ransomware, Releases Free Decryption Tool (lien direct) |
Le ministère américain de la Justice (DOJ) a officiellement & NBSP; annoncé & NBSP; la perturbation de l'opération de ransomware BlackCat et a publié un outil de décryptage que les victimes peuvent utiliser pour regagner l'accès aux fichiers verrouillés par le malware.
Des documents judiciaires montrent que le Federal Bureau of Investigation (FBI) des États-Unis a fait appel à une source humaine confidentielle (CHS) pour agir en tant qu'affilié pour le BlackCat et Gain
The U.S. Justice Department (DoJ) has officially announced the disruption of the BlackCat ransomware operation and released a decryption tool that victims can use to regain access to files locked by the malware. Court documents show that the U.S. Federal Bureau of Investigation (FBI) enlisted the help of a confidential human source (CHS) to act as an affiliate for the BlackCat and gain |
Ransomware Malware Tool | ★★★ | |
|
2023-12-19 19:00:00 | Les pirates abusant de Github pour échapper à la détection et au contrôle des hôtes compromis Hackers Abusing GitHub to Evade Detection and Control Compromised Hosts (lien direct) |
Les acteurs de la menace utilisent de plus en plus Github à des fins malveillantes grâce à de nouvelles méthodes, notamment abuser des GIST secrètes et émettre des commandes malveillantes via des messages Git Commit.
"Les auteurs de logiciels malveillants placent occasionnellement leurs échantillons dans des services tels que Dropbox, Google Drive, OneDrive et Discord pour accueillir des logiciels malveillants de deuxième étape et des outils de détection de touche", inverse le chercheur Karlo Zanki & NBSP
Threat actors are increasingly making use of GitHub for malicious purposes through novel methods, including abusing secret Gists and issuing malicious commands via git commit messages. "Malware authors occasionally place their samples in services like Dropbox, Google Drive, OneDrive, and Discord to host second stage malware and sidestep detection tools," ReversingLabs researcher Karlo Zanki |
Malware Tool Threat | ★★★ | |
|
2023-12-18 11:00:00 | Dévoiler le Web Dark: un guide professionnel de l'exploration éthique Unveiling the dark web: A professional\\'s guide to ethical exploration (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. The dark web, often shrouded in mystery and intrigue, is a realm of the internet that exists beyond the reach of traditional search engines. While the Dark Web does harbor a certain notoriety for hosting illegal activities, it also contains valuable information and resources that can be beneficial for professionals involved in cybersecurity, threat intelligence, and investigations. This article will provide a comprehensive guide on how to search the dark web for information gathering in a professional and ethical manner. Understanding the dark web Before delving into the intricacies of searching on the dark web, it\'s crucial to comprehend its structure. The internet comprises three layers: the surface web, the deep web, and the dark web. Surface web: This is the portion of the internet indexed by search engines like Google and accessible to the general public. Deep web: The Deep Web includes websites and databases not indexed by search engines. These are often password-protected or behind paywalls, such as online banking or email accounts. Dark web: The dark web is a hidden network of websites that can only be accessed using specialized software, such as Tor. It\'s intentionally designed to conceal the identity of users and hosts. While it has a reputation for illegal markets, it also includes legitimate websites and forums. Ethical considerations Searching the dark web requires a strong commitment to ethical conduct. It\'s essential to respect both legal and moral boundaries. Here are some critical ethical considerations: Legal compliance: Ensure that your activities are within the bounds of the law. Engaging in any illegal activities, such as purchasing illicit goods, is strictly prohibited. Use encryption: When accessing the dark web, always use encryption tools like the Tor browser to protect your identity and maintain anonymity. Verification: Verify the legitimacy of the information you find. Misinformation and scams are prevalent on the dark web. Searching the Dark Web Get the right tools: Start by downloading the Tor browser, a free and open-source software that allows you to access the dark web while concealing your IP address. Consider using a virtual private network (VPN) in combination with the Tor browser for an additional layer of security. Deep web vs. dark web: Distinguish between the deep web and the dark web. Remember that the deep web consists of web pages not indexed by search engines but is not inherently hidden. The dark web, on the other hand, is intentionally concealed. Search engines: Dark web search engines like DuckDuckGo, Torch and notEvil can be used to find specific websites and content. These search engines access .onion domains, which are unique to the dark web. Directories: Dark web directories are like Yellow Pages for hidden services. They list websites and their categories, making it easier to find what you\'re looking for. Notable directories include The Hidden Wiki and TorLinks. Forums and communities: The dark web hosts numerous forums, discussion boards, and communities that cover a wide range of topics. Some of these can be valuable sources of information. However, exercise caution as many forums are associated with illegal activities. File sharing: File-sharing services on the dark web may contain a wealth of data, including documents, reports, and archives. Some of these files may be of intere | Tool Vulnerability Threat | ★★ | |
|
2023-12-18 06:00:21 | Une approche de risque intégrée pour briser la chaîne d'attaque juridique et de conformité: les informations de Proofpoint Protect 2023 An Integrated Risk Approach to Breaking the Legal and Compliance Attack Chain: Insights from Proofpoint Protect 2023 (lien direct) |
Last September, Proofpoint held our first in-person event since the pandemic in New York City, Protect 2023. In this blog post, our Chief Compliance Officer in Residence John Pepe shares some key insights from the leaders who participated in the Compliance Leader\'s Roundtable at that conference. A big part of that discussion was exploring how combining data points from multiple tools can help stop known risk patterns before problems escalate. “Break the Attack Chain” is a Proofpoint initiative that outlines our approach to prevent and disrupt cyberattacks that target people and their data. The attack chain can basically be broken down into eight steps and three main stages: Initial compromise Privilege escalation Data exfiltration Steps in the attack chain. We believe that breaking the attack chain is so important that we made it the theme of Protect 2023. When you break the attack chain, you reduce the risks and the impact of cyberattacks. And you avoid a lot of the financial, reputational and operational damage. Proofpoint argues that this starts by taking a people-centric approach to security that focuses on the human factors that enable and motivate attackers. But this theme isn\'t just relevant to cybersecurity. It\'s also an important concept that\'s relevant to compliance professionals and their current challenges. Recently at the Protect 2023 conference, we explored how the industry is using this idea to rethink the ways it approaches and mitigates risk. What\'s top of mind for compliance professionals right now? Part of my job at Proofpoint is to provide our customers-some of whom are highly regulated-with executive briefings on compliance and regulatory best practices. I also have a lot of critical discussions with the legal and regulatory communities. So I understand why the concept of breaking the attack chain transcends cybersecurity and really resonates with these groups. That\'s why I chose to explore it at Protect 2023 at the Compliance Leader\'s Roundtable. This panel was comprised of a chief compliance officer from a leading financial services provider, the head of surveillance for an asset manager, and a chief information security officer. And our topic was “What\'s Top of Mind for Compliance Professionals Post COVID-19." The discussion was informal and focused on work-from-home (WFH) initiatives during and after the pandemic. Two interconnected areas were of particular interest: Risks and programs related to WFH, with a special focus on collaboration platforms How behavioral indicators may help to predict potential legal or compliance issues When talking about insider risks and threats, the panelists explored: Best practices for controlling messaging apps and mitigating risks in mobile texts and chat How behavioral modeling and analytics can be used to enhance risk monitoring for user conduct How combining multiple compliance approaches can help form a holistic risk management program, which can mean integrating: Threat detection People analytics Conduct compliance applications As part of the conversation, I brought up the topic of employee behaviors and patterns that can lead to legal or compliance issues. The example scenario I offered was of a disgruntled employee who had received an underwhelming bonus or was passed up for a promotion. To get back at the company, this person stole sensitive company data and intellectual property (IP) before they left their job. The panel discussed behaviors or telemetry that might be present in such a scenario. And they talked about whether any data about user conduct might help detect and prevent potential losses. An integrated approach to breaking the attack chain What follows are some of the ways that our panelists use tools to mitigate risks. And how Proofpoint can help. Combining internal and external data One of the most crucial aspects of a surveillance analyst\'s job, especially in financial services, is monitoring employee risk. The roundtable emp | Tool Threat Mobile Prediction Conference | ★★★ | |
|
2023-12-15 21:35:08 | Ace dans le trou: exposer Gambleforce Ace in the Hole: Exposing GambleForce (lien direct) |
#### Description
Septembre 2023, la société de cybersécurité Group-IB a découvert Gambleforce, un acteur de menace inconnu spécialisé dans les attaques d'injection SQL dans la région Asie-Pacifique.Gambleforce a ciblé plus de 20 sites Web (gouvernement, jeu, vente au détail et voyages) en Australie, en Chine, en Indonésie, aux Philippines, en Inde, en Corée du Sud, en Thaïlande et au Brésil.
Le groupe a utilisé un ensemble d'outils avec des méthodes d'attaque de base mais efficaces, conduisant à des préoccupations d'une activité supplémentaire même après que le groupe-IB a enlevé son serveur de commande et de contrôle.L'ensemble du jeu d'outils était basé sur des instruments open source accessibles au public utilisés à des fins de pentisting.Après avoir examiné le jeu d'outils plus en détail, il est devenu clair que les outils étaient très probablement associés à un acteur de menace exécutant l'une des plus anciennes méthodes d'attaque: les injections de SQL.Les attaquants ont obtenu un accès initial à l'aide de SQLMAP, puis ont procédé à la téléchargement de la grève de Cobalt sur des serveurs compromis.Notamment, la version de Cobalt Strike a découvert sur le serveur du gang \\ a utilisé des commandes en chinois, mais ce fait seul n'est pas suffisant pour attribuer l'origine du groupe.
#### URL de référence (s)
1. https://www.group-ib.com/blog/gambleforce-gang/
#### Date de publication
15 décembre 2023
#### Auteurs)
Nikita Rostovcev
#### Description September 2023, cybersecurity firm Group-IB uncovered GambleForce, a previously unknown threat actor specializing in SQL injection attacks across the Asia-Pacific region. GambleForce has targeted more than 20 websites (government, gambling, retail, and travel) in Australia, China, Indonesia, the Philippines, India, South Korea, Thailand, and Brazil. The group employed a toolset with basic but effective attack methods, leading to concerns of further activity even after Group-IB took down their command and control server. The entire toolset was based on publicly available open-source instruments used for pentesting purposes. After examining the toolset in more detail, it became clear that the tools were most likely associated with a threat actor executing one of the oldest attack methods: SQL injections. The attackers gained initial access using SQLmap, then proceeded to upload Cobalt Strike on compromised servers. Notably, the version of Cobalt Strike discovered on the gang\'s server used commands in Chinese, but this fact alone is not enough to attribute the group\'s origin. #### Reference URL(s) 1. https://www.group-ib.com/blog/gambleforce-gang/ #### Publication Date December 15, 2023 #### Author(s) Nikita Rostovcev |
Tool Threat | ★★★ | |
|
2023-12-15 18:51:00 | Les cyberattaques pro-hamas ont objectif \\ 'PEROGI \\' malware à plusieurs cibles du Moyen-Orient Pro-Hamas Cyberattackers Aim \\'Pierogi\\' Malware at Multiple Mideast Targets (lien direct) |
Gaza Cybergang a créé une nouvelle version de porte dérobée remplie d'outils pour espionner et attaquer des cibles.
Gaza Cybergang has created a new backdoor version stuffed with tools to spy on and attack targets. |
Malware Tool | ★★★ | |
|
2023-12-15 06:00:41 | Comment empêcher les attaques basées sur l'identité avec ITDR How to Prevent Identity-Based Attacks with ITDR (lien direct) |
Identity-based attacks are on the rise. Research from the Identity Defined Security Alliance found that 84% of businesses experienced an identity-related breach in the past year. While that\'s a huge percentage, it\'s not all that surprising. Just consider how focused attackers have been in recent years on gaining access to your user\'s identities. In the latest Verizon 2023 Data Breach Investigations Report, Verizon found that 40% of all data breaches in 2022 involved the theft of credentials which is up from 31% in 2021. With access to just one privileged account an attacker can move around undetected on a company\'s network and cause havoc. When they look like the right employee, they have the freedom to do almost anything, from stealing sensitive data to launching ransomware attacks. What\'s worse, attackers usually have tools that make it fast and easy to exploit stolen credentials, escalate privilege and move laterally. That makes this type of attack all the more appealing. There are a bevy of cybersecurity tools that are supposed to protect companies from these attacks. So why do they fall short? The simple answer is that it\'s not their job-at least not completely. Take tools used for identity access management (IAM) as an example. Their role is to administer identities and manage their access to applications and resources. They don\'t detect malicious activity after a “legitimate” user has been authenticated and authorized. And tools for anomaly detection, like security information and event management (SIEM) systems, alert on abnormal or malicious user activity. But they are even less capable of flagging attempts at lateral movement and privilege escalation. As a result, these tools tend to generate high levels of false positives, which overwhelm security teams. However, there is a way to address the security gaps these solutions aren\'t well equipped to cover. It\'s called identity threat detection and response, or ITDR for short. What is ITDR? ITDR is an umbrella term coined by Gartner to describe a new category of security tools and best practices that companies can use to detect and respond more effectively to identity-based attacks. ITDR protects the middle of the attack chain-the point where enterprise defenses are usually the weakest. ITDR tools offer robust analytics, integrations and visibility that can help you to: Detect, investigate and respond to active threats Stop privilege escalations Identify and halt lateral movement by attackers Reduce the identity-centric attack surface before the threat actor even arrives When you use ITDR, you\'re not replacing existing tools or systems for IAM and threat detection and response like privileged access management (PAM) or endpoint detection and response (EDR). Instead, you\'re complementing them. Those tools can continue to do what they do best while ITDR addresses the identity security gaps they\'re not designed to cover. How ITDR solutions work-and help to prevent identity-based attacks ITDR tools are designed to continuously monitor user behavior patterns across systems. They scan every endpoint-clients and servers, PAM systems and identity repositories-to look for unmanaged, misconfigured and exposed identities. With a holistic view of identity risks, your security team can remove key attack pathways through Active Directory (AD) that threat actors use to install ransomware and steal data. ITDR tools can help defenders stop identity attacks and proactively get rid of risks. They allow defenders to see exactly how attackers can access and use identities to compromise the business. Essentially, ITDR provides answers to these three critical questions: Whose identity provides an attack path? What is the identity threat blast radius, and the impact to my business? Are there any identity-based attacks in progress? Leading ITDR tools can help you catch adversaries in the act by planting deceptive content, or trip wires, throughout your environment that only attackers would in | Ransomware Data Breach Tool Vulnerability Threat | ★★ |
To see everything:
Our RSS (filtrered)
