What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-04-18 07:46:32 | Analyse du rat nautique utilisé dans les attaques contre les systèmes Linux Analysis of Pupy RAT Used in Attacks Against Linux Systems (lien direct) |
Pupy est une souche malveillante de rat qui offre un soutien à la plate-forme croisée.Parce qu'il s'agit d'un programme open-source publié sur GitHub, il est continuellement utilisé par divers acteurs de menace, y compris des groupes APT.Par exemple, il est connu pour avoir été utilisé par APT35 (qui aurait des liens avec l'Iran) [1] et a également été utilisé dans l'opération Earth Berberoka [2] qui ciblait les sites de jeux en ligne.Récemment, une souche de logiciels malveillante nommée Disy Dog a été découverte, qui est une version mise à jour de Pupy Rat ....
Pupy is a RAT malware strain that offers cross-platform support. Because it is an open-source program published on GitHub, it is continuously being used by various threat actors including APT groups. For example, it is known to have been used by APT35 (said to have ties to Iran) [1] and was also used in Operation Earth Berberoka [2] which targeted online gambling websites. Recently, a malware strain named Decoy Dog was discovered, which is an updated version of Pupy RAT.... |
Malware Threat | APT 35 | ★★ |
 |
2024-04-18 06:00:36 | FAQ à partir de l'état du rapport Phish 2024, partie 2: comportements et attitudes des utilisateurs envers la sécurité FAQs from the 2024 State of the Phish Report, Part 2: User Behaviors and Attitudes Toward Security (lien direct) |
Welcome to the second installment of our two-part blog series where we answer the most frequently asked questions about the 2024 State of the Phish Report. In our previous article, we answered questions related to the threat landscape findings. Here, we answer questions related to user behaviors and attitudes, as well as how to grow your security awareness program. One of the most interesting findings that came out of the 2024 State of the Phish report was the fact that 71% of users admitted to engaging in a risky action and 96% of those users understood the risk. This suggests that people are not acting out of ignorance. Despite knowing that their actions could compromise themselves or their organization, people chose to proceed anyway. This information is crucial for the growth of any security awareness program. It enables organizations to tailor their efforts. By observing and analyzing how users interact with security policies, organizations can identify knowledge gaps and areas of resistance. When you engage users in this manner, you not only educate them but also transform them into active participants in protecting your organization. 96% of users who took a risky action knew that it was risky. (Source: 2024 State of the Phish from Proofpoint.) Our findings inspired hundreds of questions from audiences across the world. What follows are some of the questions that repeatedly came up. Frequently asked questions What are some ways to get users to care about security and get engaged? Two-way communication is key. Take a moment to explain to your employees why you\'re running a behavior change program, what the expectations are and what projected outcomes you foresee. Make it personal. Let people know that cybersecurity isn\'t just a work skill but a portable skill they can take home to help themselves and their families be safer in life. Keep your employees up to speed on what\'s happening in the current threat landscape. For example: What types of threats does your business see? Which departments are under attack? How does the security team handle these incidents? What can people do to defend against emerging threats that target them? Research for the 2024 State of the Phish report found that 87% of end users are more motivated to prioritize security when they see increased engagement from leadership or the security team. In short: You need to open up the lines of communication, listen to your employees and incorporate their feedback, and establish a security champion network to help facilitate communication more effectively. Any ideas on why the click rate for phishing simulations went up for many industries this year? There may be a few possible reasons. For starters, there has been an increase in the number of phishing tests sent. Our customers sent out a total of 183 million simulated phishing tests over a 12-month period, up from 135 million in the previous 12-month period. This 36% increase suggests that our customers may have either tested their users more frequently or tested more users in general. Also, some users might be new to these tests, resulting in a higher click rate. Regardless, if you are conducting a phishing campaign throughout the year, the click rates of phishing tests are expected to go up and down because you want to challenge your employees with new attack tactics they have not seen. Otherwise, the perception would be, “Oh, this is the face of a phish,” if you keep phishing your users with the same test. At Proofpoint, we use machine learning-driven leveled phishing to provide a more reliable way to accurately assess user vulnerability. This unique feature allows security teams to examine the predictability of a phishing template and obtain more consistent outcomes while improving users\' resilience against human-activated threats. People need to understand how attackers exploit human vulnerability. Phishing tests should reflect reality and be informed by real-world threats. They are designed to help people spot and re | Tool Vulnerability Threat | ★★ | |
 |
2024-04-17 21:47:14 | From Social Engineering to DMARC Abuse: TA427\'s Art of Information Gathering (lien direct) | #### Géolocations ciblées
- États-Unis
- Corée
#### Industries ciblées
- Organisation non gouvernementale
- Think Tank - Multidiscipline
## Instantané
ProofPoint a publié un article détaillant les tactiques de collecte d'informations que TA427, suivies par Microsoft comme Emerald Sleet, mène.
## Description
TA427, un acteur de menace aligné avec la Corée du Nord, est connu pour utiliser des tactiques d'ingénierie sociale sophistiquées et des balises Web pour la reconnaissance.TA427 s'engage dans des campagnes de démarrage de conversation bénigne pour recueillir des renseignements stratégiques liés aux initiatives de politique étrangère des États-Unis et de la Corée du Sud.L'acteur de menace s'appuie fortement sur des tactiques d'ingénierie sociale, notamment l'authentification des messages basée sur le domaine, les reportages et la conformité (DMARC), la typosquat et l'usurpation des comptes de messagerie privé, pour usurper l'identité des individus de diverses verticales tels que les groupes de réflexion, les ONG et le gouvernement.De plus, TA427 utilise des balises Web pour la reconnaissance initiale afin de valider les comptes de messagerie actifs et de collecter des informations fondamentales sur les environnements réseau des destinataires.
TA427 est un acteur de menace persistant et adaptable car ils sont rapidement en mesure de développer de nouvelles infrastructures et personnages.En outre, TA427 est identifié comme l'un des acteurs de menace les plus actifs alignés par l'État actuellement suivis par Proofpoint.L'acteur de menace utilise des balises Web, de suivi des balises et des bogues Web pour la reconnaissance initiale afin de recueillir des informations sur les environnements réseau des destinataires.TA427 a fait l'identité d'identité des principaux experts en matière nord-coréenne dans le monde universitaire, le journalisme et les recherches indépendantes pour cibler d'autres experts et prendre pied dans leurs organisations respectives pour la collecte de renseignement stratégique à long terme.Les activités de l'acteur de menace sont axées sur l'obtention d'informations et d'influence plutôt que sur les gains financiers, ne démontrant aucune indication de ralentissement ou de perte de son agilité dans l'ajustement des tactiques et des infrastructures.
## Les références
[https://www.poolinpoint.com/us/blog/thereat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gatheringmenace-insight / social-ingénierie-dmarc-abuse-ta427s-art-information-gattering)
#### Targeted Geolocations - United States - Korea #### Targeted Industries - Non-Government Organization - Think Tank - Multi-discipline ## Snapshot Proofpoint published an article detailing the information gathering tactics that TA427, tracked by Microsoft as Emerald Sleet, conducts. ## Description TA427, a threat actor aligned with North Korea, is known for using sophisticated social engineering tactics and web beacons for reconnaissance. TA427 engages in benign conversation starter campaigns to gather strategic intelligence related to US and South Korea foreign policy initiatives. The threat actor heavily relies on social engineering tactics, including Domain-based Message Authentication, Reporting and Conformance (DMARC) abuse, typosquatting, and private email account spoofing, to impersonate individuals from various verticals such as think tanks, NGOs, and government. Additionally, TA427 uses web beacons for initial reconnaissance to validate active email accounts and gather fundamental information about the recipients\' network environments. TA427 is a persistent and adaptable threat actor as they are quickly able to stand up new infrastructure and personas. Furthermore, TA427 is identified as one of the most active state-aligned threat actors currently tracked by Proofpoint. The threat actor uses web beacons, tracking beaco |
Threat | ★★ | |
|
2024-04-17 20:31:47 | Débout APT44: Russie \\ est le cyber-sabotage de la Russie Unearthing APT44: Russia\\'s Notorious Cyber Sabotage Unit Sandworm (lien direct) |
#### Géolocations ciblées
- Ukraine
## Instantané
Parrainé par le renseignement militaire russe, l'APT44 est un acteur de menace dynamique et mature opérationnel qui est activement engagé dans le spectre complet des opérations d'espionnage, d'attaque et d'influence.
** Microsoft suit cet apt en tant que blizzard de coquille.[En savoir plus à leur sujet ici.] (Https://sip.security.microsoft.com/intel-profiles/cf1e406a16835d56cf614430aea3962d7ed99f01ee3d9ee3048078288e5201bb) **
## Description
APT44 est un acteur de menace dynamique et mature opérationnel qui est activement engagé dans le spectre complet des opérations d'espionnage, d'attaque et d'influence.Le groupe a perfectionné chacune de ces capacités et a cherché à les intégrer dans un livre de jeu unifié au fil du temps.APT44 a poursuivi de manière agressive un effort à plusieurs volets pour aider les militaires russes à obtenir un avantage en temps de guerre et est responsable de presque toutes les opérations perturbatrices et destructrices contre l'Ukraine au cours de la dernière décennie.Le groupe présente une menace persistante et de forte gravité pour les gouvernements et les opérateurs d'infrastructures critiques dans le monde entier où les intérêts nationaux russes se croisent.L'APT44 est considéré par le Kremlin comme un instrument flexible de pouvoir capable de desservir les intérêts et les ambitions nationaux de la Russie, y compris les efforts visant à saper les processus démocratiques à l'échelle mondiale.Le soutien du groupe des objectifs politiques du Kremlin a abouti à certaines des cyberattaques les plus importantes et les plus consécutives de l'histoire.En raison de son histoire de l'utilisation agressive des capacités d'attaque du réseau dans des contextes politiques et militaires, l'APT44 présente un risque de prolifération significatif de nouveaux concepts et méthodes de cyberattaques.L'APT44 continuera certainement à présenter l'une des cyber-menaces de gravité la plus large et la plus élevée dans le monde.
## Recommandations
[Pour plus de CIO, visitez leur collection Virustotal ici.] (Https://www.virustotal.com/gui/collection/0bd93a520cae1fd917441e6e54ff263c88069ac5a7f8b9e55ef99cd961b6a1c7/iocs)
## Les références
https://cloud.google.com/blog/topics/thereat-intelligence/apt44-unearthing-sandworm
https://services.google.com/fh/files/misc/apt44-unithing-sandworm.pdf
https://sip.security.microsoft.com/intel-profiles/cf1e406a16835d56cf614430aea3962d7ed99f01ee3d9ee3048078288e5201bb
#### Targeted Geolocations - Ukraine ## Snapshot Sponsored by Russian military intelligence, APT44 is a dynamic and operationally mature threat actor that is actively engaged in the full spectrum of espionage, attack, and influence operations. **Microsoft tracks this APT as Seashell Blizzard. [Read more about them here.](https://sip.security.microsoft.com/intel-profiles/cf1e406a16835d56cf614430aea3962d7ed99f01ee3d9ee3048078288e5201bb)** ## Description APT44 is a dynamic and operationally mature threat actor that is actively engaged in the full spectrum of espionage, attack, and influence operations. The group has honed each of these capabilities and sought to integrate them into a unified playbook over time. APT44 has aggressively pursued a multi-pronged effort to help the Russian military gain a wartime advantage and is responsible for nearly all of the disruptive and destructive operations against Ukraine over the past decade. The group presents a persistent, high severity threat to governments and critical infrastructure operators globally where Russian national interests intersect. APT44 is seen by the Kremlin as a flexible instrument of power capable of servicing Russia\'s wide-ranging national interests and ambitions, including efforts to undermine democratic processes globally. The group\'s support of the Kremlin\'s political objectives has resulted in some of the largest and mo |
Threat Cloud | ★★ | |
 |
2024-04-17 19:02:00 | Russian APT déploie de nouveaux \\ 'Kapeka \\' Backdoor dans les attaques d'Europe de l'Est Russian APT Deploys New \\'Kapeka\\' Backdoor in Eastern European Attacks (lien direct) |
Une porte dérobée "flexible" sans documentation, sans documentation, appelée & nbsp; kapeka & nbsp; a été "sporadiquement" observée dans les cyberattaques ciblant l'Europe de l'Est, notamment l'Estonie et l'Ukraine, depuis au moins au milieu de 2022.
Les résultats proviennent de la société de cybersécurité finlandaise avec Sésence, qui a attribué le groupe de logiciels malveillants au groupe avancé de menace persistante avancée (APT) suivi comme & nbsp; Sandworm & nbsp; (AKA APT44 ou
A previously undocumented "flexible" backdoor called Kapeka has been "sporadically" observed in cyber attacks targeting Eastern Europe, including Estonia and Ukraine, since at least mid-2022. The findings come from Finnish cybersecurity firm WithSecure, which attributed the malware to the Russia-linked advanced persistent threat (APT) group tracked as Sandworm (aka APT44 or |
Malware Threat | ★★★ | |
|
2024-04-17 18:00:31 | Réduire le désabonnement d'incitation avec une composition de modèle explosive Reducing Prompting Churn with Exploding Template Composition (lien direct) |
Engineering Insights is an ongoing blog series that gives a behind-the-scenes look into the technical challenges, lessons and advances that help our customers protect people and defend data every day. Each post is a firsthand account by one of our engineers about the process that led up to a Proofpoint innovation. In the nascent world of large language models (LLMs), prompt engineering has emerged as a critical discipline. However, as LLM applications expand, it is becoming a more complex challenge to manage and maintain a library of related prompts. At Proofpoint, we developed Exploding Prompts to manage the complexity through exploding template composition. We first created the prompts to generate soft labels for our data across a multitude of models and labeling concerns. But Exploding Prompts has also enabled use cases for LLMs that were previously locked away because managing the prompt lifecycle is so complex. Recently, we\'ve seen exciting progress in the field of automated prompt generation and black-box prompt optimization through DSPy. Black-box optimization requires hand-labeled data to generate prompts automatically-a luxury that\'s not always an option. You can use Exploding Prompts to generate labels for unlabeled data, as well as for any prompt-tuning application without a clear (or tractable) objective for optimization. In the future, Exploding Prompts could be used with DSPy to achieve a human-in-the-loop feedback cycle. We are also thrilled to announce that Exploding Prompts is now an open-source release. We encourage you to explore the code and consider how you might help make it even better. The challenge: managing complexity in prompt engineering Prompt engineering is not just about crafting queries that guide intelligent systems to generate the desired outputs; it\'s about doing it at scale. As developers push the boundaries of what is possible with LLMs, the need to manage a vast array of prompts efficiently becomes more pressing. Traditional methods often need manual adjustments and updates across numerous templates, which is a process that\'s both time-consuming and error-prone. To understand this problem, just consider the following scenario. You need to label a large quantity of data. You have multiple labels that can apply to each piece of data. And each label requires its own prompt template. You timebox your work and find a prompt template that achieves desirable results for your first label. Happily, most of the template is reusable. So, for the next label, you copy-paste the template and change the portion of the prompt that is specific to the label itself. You continue doing this until you figure out the section of the template that has persisted through each version of your labels can be improved. Now you now face the task of iterating through potentially dozens of templates to make a minor update to each of the files. Once you finish, your artificial intelligence (AI) provider releases a new model that outperforms your current model. But there\'s a catch. The new model requires another small update to each of your templates. To your chagrin, the task of managing the lifecycle of your templates soon takes up most of your time. The solution: exploding prompts from automated dependency graphs Prompt templating is a popular way to manage complexity. Exploding Prompts builds on prompt templating by introducing an “explode” operation. This allows a few single-purpose templates to explode into a multitude of prompts. This is accomplished by building dependency graphs automatically from the directory structure and the content of prompt template files. At its core, Exploding Prompts embodies the “write it once” philosophy. It ensures that every change made in a template correlates with a single update in one file. This enhances efficiency and consistency, as updates automatically propagate across all relevant generated prompts. This separation ensures that updates can be made with speed and efficiency so you can focus on innovation rather th | Malware Tool Threat Studies Cloud Technical | ★★★ | |
 |
2024-04-17 17:00:47 | La menace évolutive des ransomwares - un appel à l'action pour la cybersécurité The Evolving Threat of Ransomware - A Call to Action for Cybersecurity (lien direct) |
> Témoignage devant le sous-comité des services financiers de la Chambre sur la sécurité nationale, la finance illicite et les institutions financières internationales sur les ransomwares.
>Testifying before the House Financial Services Subcommittee on National Security, Illicit Finance and International Financial Institutions on ransomware. |
Ransomware Threat | ★★ | |
|
2024-04-17 16:27:00 | Flaw atlassien critique exploité pour déployer la variante Linux de Cerber Ransomware Critical Atlassian Flaw Exploited to Deploy Linux Variant of Cerber Ransomware (lien direct) |
Les acteurs de la menace exploitent les serveurs Atlassian non corrigés pour déployer une variante Linux du ransomware Cerber (AKA C3RB3R).
Les attaques Levier et NBSP; CVE-2023-22518 & NBSP; (Score CVSS: 9.1), une vulnérabilité de sécurité critique ayant un impact sur le centre de données de Confluence Atlassian qui permet un attaquant non authentifié pour réinitialiser la confluence et créer un compte administrateur.
Armé de cet accès, un
Threat actors are exploiting unpatched Atlassian servers to deploy a Linux variant of Cerber (aka C3RB3R) ransomware. The attacks leverage CVE-2023-22518 (CVSS score: 9.1), a critical security vulnerability impacting the Atlassian Confluence Data Center and Server that allows an unauthenticated attacker to reset Confluence and create an administrator account. Armed with this access, a |
Ransomware Vulnerability Threat | ★★ | |
 |
2024-04-17 16:25:58 | Paysage cyber-menace pour le secteur américain de l'eau et des eaux usées OT Cyber Threat Landscape for the U.S. Water & Wastewater Sector (lien direct) |
> Dragos OT Cyber Threat Intelligence Les chasseurs et les analystes d'adversaire effectuent des recherches sur les opérations adversaires et leurs tactiques, techniques et procédures ...
Le post OT Cyber Threat Landscape pour l'US Water &Le secteur des eaux usées est apparu pour la première fois sur dragos .
>Dragos OT Cyber Threat Intelligence adversary hunters and analysts conduct research on adversary operations and their tactics, techniques, and procedures... The post OT Cyber Threat Landscape for the U.S. Water & Wastewater Sector first appeared on Dragos. |
Threat Industrial | ★★ | |
 |
2024-04-17 16:00:00 | Variante de ransomware Linux Cerber Exploite les serveurs atlassiens Linux Cerber Ransomware Variant Exploits Atlassian Servers (lien direct) |
Les attaques exploitent CVE-2023-22518, une faille critique dans le centre de données et le serveur Atlassian Confluence
The attacks exploit CVE-2023-22518, a critical flaw in Atlassian Confluence Data Center and Server |
Ransomware Threat | ★★ | |
|
2024-04-17 15:53:00 | Les pirates exploitent Fortinet Flaw, Deploy ScreenConnect, Metasploit dans une nouvelle campagne Hackers Exploit Fortinet Flaw, Deploy ScreenConnect, Metasploit in New Campaign (lien direct) |
Les chercheurs en cybersécurité ont découvert une nouvelle campagne qui exploite une faille de sécurité récemment divulguée dans les appareils EMS Fortinet Forticlient pour livrer ScreenConnect et Metasploit PowerFun Tasklods.
L'activité implique l'exploitation de & nbsp; CVE-2023-48788 & nbsp; (score CVSS: 9.3), un défaut d'injection SQL critique qui pourrait permettre à un attaquant non authentifié d'exécuter du code non autorisé ou
Cybersecurity researchers have discovered a new campaign that\'s exploiting a recently disclosed security flaw in Fortinet FortiClient EMS devices to deliver ScreenConnect and Metasploit Powerfun payloads. The activity entails the exploitation of CVE-2023-48788 (CVSS score: 9.3), a critical SQL injection flaw that could permit an unauthenticated attacker to execute unauthorized code or |
Threat | ★★ | |
 |
2024-04-17 13:16:42 | Au-delà du bruit: la sécurité sans friction habilite les analystes cyberops Beyond the Noise: Frictionless Security Empowers CyberOps Analysts (lien direct) |
La sécurité sans friction est l'arme silencieuse qui permet aux analystes de sécurité de naviguer dans le paysage des menaces en constante évolution avec une concentration au laser et un bruit réduit.Le barrage implacable de faux positifs est une source majeure de frottement pour les analystes.La sécurité sans friction tire parti de l'IA pour régler le SIEM, filtrer les faux positifs et hiérarchiser uniquement les menaces légitimes de grande priorité.Plus de triage d'alerte sans fin & # 8211;Les analystes peuvent se concentrer sur les alertes de haute priorité qui exigent une attention immédiate.
Frictionless Security is the silent weapon that empowers security analysts to navigate the ever-evolving threat landscape with laser focus and reduced noise. The relentless barrage of false positives is a major source of friction for analysts. Frictionless Security leverages AI to tune the SIEM, filter out false positives and prioritize only high priority legitimate threats. No more endless alert triaging – analysts can focus on the high-priority alerts that demand immediate attention. |
Threat | ★★ | |
 |
2024-04-17 10:00:00 | Introduction à l'analyse de la composition logicielle et comment sélectionner un outil SCA Introduction to Software Composition Analysis and How to Select an SCA Tool (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Software code is constantly growing and becoming more complex, and there is a worrying trend: an increasing number of open-source components are vulnerable to attacks. A notable instance was the Apache Log4j library vulnerability, which posed serious security risks. And this is not an isolated incident. Using open-source software necessitates thorough Software Composition Analysis (SCA) to identify these security threats. Organizations must integrate SCA tools into their development workflows while also being mindful of their limitations. Why SCA Is Important Open-source components have become crucial to software development across various industries. They are fundamental to the construction of modern applications, with estimates suggesting that up to 96% of the total code bases contain open-source elements. Assembling applications from diverse open-source blocks presents a challenge, necessitating robust protection strategies to manage and mitigate risks effectively. Software Composition Analysis is the process of identifying and verifying the security of components within software, especially open-source ones. It enables development teams to efficiently track, analyze, and manage any open-source element integrated into their projects. SCA tools identify all related components, including libraries and their direct and indirect dependencies. They also detect software licenses, outdated dependencies, vulnerabilities, and potential exploits. Through scanning, SCA creates a comprehensive inventory of a project\'s software assets, offering a full view of the software composition for better security and compliance management. Although SCA tools have been available for quite some time, the recent open-source usage surge has cemented their importance in application security. Modern software development methodologies, such as DevSecOps, emphasize the need for SCA solutions for developers. The role of security officers is to guide and assist developers in maintaining security across the Software Development Life Cycle (SDLC), ensuring that SCA becomes an integral part of creating secure software. Objectives and Tasks of SCA Tools Software Composition Analysis broadly refers to security methodologies and tools designed to scan applications, typically during development, to identify vulnerabilities and software license issues. For effective management of open-source components and associated risks, SCA solutions help navigate several tasks: 1) Increasing Transparency A developer might incorporate various open-source packages into their code, which in turn may depend on additional open-source packages unknown to the developer. These indirect dependencies can extend several levels deep, complicating the understanding of exactly which open-source code the application uses. Reports indicate that 86% of vulnerabilities in node.js projects stem from transitive (indirect) dependencies, w | Tool Vulnerability Threat Patching Prediction Cloud Commercial | ★★ | |
 |
2024-04-17 10:00:00 | Le groupe \\ 'Sandworm \\' est la principale unité de cyberattaque de la Russie en Ukraine \\'Sandworm\\' Group Is Russia\\'s Primary Cyberattack Unit in Ukraine (lien direct) |
Mais même avec cet objectif, le groupe de menaces sophistiqué a continué ses opérations contre les cibles dans le monde, y compris les États-Unis, explique Mandiant de Google \\.
But even with that focus, the sophisticated threat group has continued operations against targets globally, including the US, says Google\'s Mandiant. |
Threat | ★★ | |
 |
2024-04-17 07:21:35 | TEHTRIS dévoile les coulisses de l\'économie florissante du Phishing-as-a-Service (PhaaS), dans son nouveau rapport Threat Intelligence (lien direct) | TEHTRIS dévoile les coulisses de l'économie florissante du Phishing-as-a-Service (PhaaS), dans son nouveau rapport Threat Intelligence Au-delà d'une analyse des nouvelles mécaniques de PhaaS utilisées par les cybercriminels et des recommandations pour s'en prémunir, ce rapport lève le voile sur deux affaires inédites : le développement de camps du cybercrime en Asie et les premiers résultats d'une enquête sur le groupe d'attaquants Codex 40. - Malwares | Threat | ★★★★ | |
 |
2024-04-17 02:55:50 | Navigation de l'IA et de la cybersécurité: aperçus du Forum économique mondial (WEF) Navigating AI and Cybersecurity: Insights from the World Economic Forum (WEF) (lien direct) |
La cybersécurité a toujours été un domaine complexe.Sa nature contradictoire signifie que les marges entre l'échec et le succès sont beaucoup plus fines que dans d'autres secteurs.Au fur et à mesure que la technologie évolue, ces marges deviennent encore plus fines, avec les attaquants et les défenseurs qui se précipitent pour les exploiter et gagner un avantage concurrentiel.Cela est particulièrement vrai pour l'IA.En février, le Forum économique mondial (WEF) a publié un article intitulé "AI et cybersécurité: comment naviguer dans les risques et les opportunités", mettant en évidence les impacts existants et potentiels de l'AI \\ sur la cybersécurité.L'essentiel?L'IA profite à la fois les bons et les méchants, donc c'est ...
Cybersecurity has always been a complex field. Its adversarial nature means the margins between failure and success are much finer than in other sectors. As technology evolves, those margins get even finer, with attackers and defenders scrambling to exploit them and gain a competitive edge. This is especially true for AI. In February, the World Economic Forum (WEF) published an article entitled " AI and cybersecurity: How to navigate the risks and opportunities ," highlighting AI\'s existing and potential impacts on cybersecurity. The bottom line? AI benefits both the good and bad guys, so it\'s... |
Threat | ★★ | |
|
2024-04-16 22:00:00 | Comment les planches peuvent se préparer aux ordinateurs quantiques How Boards Can Prepare for Quantum Computers (lien direct) |
L'informatique quantique au niveau qui constitue une menace pour les mesures de cybersécurité actuelles est encore des années de congé.Voici ce que les entreprises peuvent faire maintenant pour éviter les perturbations futures.
Quantum computing on the level that poses a threat to current cybersecurity measures is still years off. Here\'s what enterprises can do now to avoid future disruptions. |
Threat | ★★ | |
|
2024-04-16 19:09:00 | TA558 Hackers Armez des images pour les attaques de logiciels malveillants à grande échelle TA558 Hackers Weaponize Images for Wide-Scale Malware Attacks (lien direct) |
L'acteur de menace suivi comme & nbsp; TA558 & nbsp; a été observé en tirant la stéganographie comme une technique d'obscuscation pour fournir un large éventail de logiciels malveillants tels que l'agent Tesla, le formbook, Remcos Rat, Lokibot, Guloader, Snake Keylogger et Xworm, entre autres.
"Le groupe a utilisé beaucoup de stéganographie en envoyant des VBS, du code PowerShell, ainsi que des documents RTF avec un exploit intégré, à l'intérieur
The threat actor tracked as TA558 has been observed leveraging steganography as an obfuscation technique to deliver a wide range of malware such as Agent Tesla, FormBook, Remcos RAT, LokiBot, GuLoader, Snake Keylogger, and XWorm, among others. "The group made extensive use of steganography by sending VBSs, PowerShell code, as well as RTF documents with an embedded exploit, inside |
Malware Threat | ★★★ | |
|
2024-04-16 18:08:40 | Le duo cybercriminal mondial est en cas d'emprisonnement après le programme de rats Hive Global Cybercriminal Duo Face Imprisonment After Hive RAT Scheme (lien direct) |
Les deux auraient vendu le Trojan sur les forums de piratage, permettant à d'autres acteurs de menace d'obtenir un contrôle non autorisé, de désactiver les programmes, de parcourir les fichiers, d'enregistrer des frappes et de voler des informations d'identification.
The two allegedly sold the Trojan on Hack Forums, allowing other threat actors to gain unauthorized control, disable programs, browse files, record keystrokes, and steal credentials. |
Hack Threat | ★★ | |
 |
2024-04-16 18:00:00 | Couverture des menaces de netskope: ransomware de fourmis maléfique Netskope Threat Coverage: Evil Ant Ransomware (lien direct) |
> Résumé Netskope Threat Labs a récemment analysé une nouvelle souche de ransomware nommée Evil Ant.Evil Ant Ransomware est un logiciel malveillant basé sur Python compilé à l'aide de Pyinstaller qui cherche à crypter tous les fichiers stockés sur les dossiers personnels et les lecteurs externes de la victime.Cette souche de ransomware nécessite la continuité du traitement du chiffrement jusqu'à la récupération du fichier.Redémarrer, fermer ou mettre fin au [& # 8230;]
>Summary Netskope Threat Labs recently analyzed a new ransomware strain named Evil Ant. Evil Ant ransomware is a Python-based malware compiled using PyInstaller that looks to encrypt all files stored on the victim’s personal folders and external drives. This ransomware strain requires process continuity from encryption until file recovery. Rebooting, shutting down, or ending the […] |
Ransomware Malware Threat | ★★ | |
 |
2024-04-16 13:00:44 | Sécuriser le secteur financier avec Check Point Infinity Global Services Securing the Financial Sector with Check Point Infinity Global Services (lien direct) |
> La transformation numérique a une efficacité considérablement améliorée dans le secteur financier, mais non sans élever le paysage cyber-risque.Les résultats récents du Fonds monétaire international (FMI) révèlent une réalité frappante: les cyberattaques ont plus que doublé depuis la pandémie, mettant en lumière la vulnérabilité du secteur financier en raison de sa gestion des données et des transactions sensibles.Les entreprises ont été confrontées à d'énormes sanctions pour les violations de données, les pertes quadruples à 2,5 milliards de dollars depuis 2017. L'interdépendance de l'industrie financière facilite non seulement ces attaques, mais aussi leur potentiel de saper la confiance dans le système financier mondial. Les recherches sur le point de contrôle confirment que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cela confirme que cetteMenace, notre intelligence des menaces a trouvé [& # 8230;]
>The digital transformation has significantly enhanced efficiency within the financial sector, but not without elevating the cyber risk landscape. Recent findings by the International Monetary Fund (IMF) reveal a stark reality: cyberattacks have more than doubled since the pandemic, spotlighting the financial sector’s vulnerability due to its handling of sensitive data and transactions. Companies have faced enormous penalties for data breaches, with losses quadrupling to $2.5 billion since 2017. The financial industry’s interconnectedness not only facilitates these attacks but also their potential to undermine trust in the global financial system. Check Point Research confirms this threat, our threat intelligence found […] |
Vulnerability Threat | ★★ | |
|
2024-04-16 12:59:13 | Crest lance un nouveau guide pour la cyber-menace intelligence CREST launches new guide to cyber threat intelligence (lien direct) |
Crest lance un nouveau guide pour la cyber-menace intelligence
Crest a mis à jour son guide sur les renseignements sur la cyber-menace pour des organisations de conseils sur la façon de garder une longueur d'avance dans la cybersécurité.
-
Livre blanc
/ /
Livreblanchome
CREST launches new guide to cyber threat intelligence CREST has updated its guide on Cyber Threat Intelligence to advice organisations on how to stay one step ahead in cyber security. - WHITE PAPER / livreBlancHome |
Threat | ★★ | |
 |
2024-04-16 12:00:33 | Synergie des solutions avancées de détection et de réponse des menaces d'identité Synergizing Advanced Identity Threat Detection & Response Solutions (lien direct) |
Explorez la synergie de la sécurité duo de Cisco \\ & # 038;Intelligence d'identité, renforçant la cyber-défense avec détection avancée des menaces & # 038;capacités de réponse
Explore the synergy of Cisco\'s Duo Security & Identity Intelligence, bolstering cyber defense with advanced threat detection & response capabilities |
Threat | ★★ | |
|
2024-04-16 10:00:00 | Facteur humain de la cybersécurité: fusion de la technologie avec des stratégies centrées sur les personnes Cybersecurity\\'s Human Factor: Merging Tech with People-Centric Strategies (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. In a digital era marked by rapidly evolving threats, the complexity of cybersecurity challenges has surged, pressing organizations to evolve beyond traditional, tech-only defense strategies. As the cyber landscape grows more intricate, there\'s a pivotal shift towards embracing methods that are not just robust from a technical standpoint but are also deeply human-centric. This also means that a significant percentage of employees, driven by the high demands of operational pressures, may engage in risky cybersecurity behaviors. Such statistics illuminate the urgent need for a more nuanced approach to cybersecurity—one that not only fortifies defenses but also resonates with and supports the people behind the screens. Integrating human-centric design with continuous threat management emerges as a forward-thinking strategy, promising a balanced blend of technical excellence and user empathy to navigate the complex cybersecurity challenges of today and tomorrow. Embracing the Human Element in Cybersecurity Diving into the realm of human-centric security design and culture, it\'s clear that the future of cybersecurity isn\'t just about the latest technology—it\'s equally about the human touch. This approach puts the spotlight firmly on enhancing the employee experience, ensuring that cybersecurity measures don\'t become an unbearable burden that drives people to take shortcuts. By designing systems that people can use easily and effectively, the friction often caused by stringent security protocols can be significantly reduced. Gartner\'s insights throw a compelling light on this shift, predicting that by 2027, half of all Chief Information Security Officers (CISOs) will have formally embraced human-centric security practices. This isn\'t just a hopeful guess but a recognition of the tangible benefits these practices bring to the table—reducing operational friction and bolstering the adoption of essential controls. This strategic pivot also acknowledges a fundamental truth. When security becomes a seamless part of the workflow, its effectiveness skyrockets. It\'s a win-win, improving both the user experience and the overall security posture. CTEM: Your Cybersecurity Compass in Stormy Seas Imagine that your organization\'s cybersecurity landscape isn\'t just a static battleground. Instead, it’s more like the open sea, with waves of threats coming and going, each with the potential to breach your defenses. That\'s where Continuous Threat Exposure Management (CTEM) sails in, serving as your trusted compass, guiding you through these treacherous waters. CTEM isn\'t your average, run-of-the-mill security tactic. It\'s about being proactive, scanning the horizon with a spyglass, looking for potential vulnerabilities before they even become a blip on a hacker\'s radar. Think of it as your cybersecurity early-warning system, constantly on the lookout for trou | Vulnerability Threat Studies Prediction Medical Technical | ★★ | |
|
2024-04-16 06:00:54 | De l'ingénierie sociale aux abus DMARC: Ta427 \\'s Art of Information Gathering From Social Engineering to DMARC Abuse: TA427\\'s Art of Information Gathering (lien direct) |
Key takeaways TA427 regularly engages in benign conversation starter campaigns to establish contact with targets for long-term exchanges of information on topics of strategic importance to the North Korean regime. In addition to using specially crafted lure content, TA427 heavily leverages think tank and non-governmental organization-related personas to legitimize its emails and increase the chances that targets will engage with the threat actor. To craftily pose as its chosen personas, TA427 uses a few tactics including DMARC abuse in concert with free email addresses, typosquatting, and private email account spoofing. TA427 has also incorporated web beacons for initial reconnaissance of its targets, establishing basic information like that the email account is active. Overview Proofpoint researchers track numerous state-sponsored and state-aligned threat actors. TA427 (also known as Emerald Sleet, APT43, THALLIUM or Kimsuky), a Democratic People\'s Republic of Korea (DPRK or North Korea) aligned group working in support of the Reconnaissance General Bureau, is particularly prolific in email phishing campaigns targeting experts for insight into US and the Republic of Korea (ROK or South Korea) foreign policy. Since 2023, TA427 has directly solicited foreign policy experts for their opinions on nuclear disarmament, US-ROK policies, and sanction topics via benign conversation starting emails. In recent months, Proofpoint researchers have observed (Figure 1) a steady, and at times increasing, stream of this activity. While our researchers have consistently observed TA427 rely on social engineering tactics and regularly rotating its email infrastructure, in December 2023 the threat actor began to abuse lax Domain-based Message Authentication, Reporting and Conformance (DMARC) policies to spoof various personas and, in February 2024, began incorporating web beacons for target profiling. It is this initial engagement, and the tactics successfully leveraged by TA427, which this blog is focused on. Figure 1. Volume of TA427 phishing campaigns observed between January 2023 and March 2024. Social engineering TA427 is a savvy social engineering expert whose campaigns are likely in support of North Korea\'s strategic intelligence collection efforts on US and ROK foreign policy initiatives. Based on the targets identified and the information sought, it is believed that TA427\'s goal is to augment North Korean intelligence and inform its foreign policy negotiation tactics (example Figure 2). TA427 is known to engage its targets for extended periods of time through a series of benign conversations to build a rapport with targets that can occur over weeks to months. They do so by constantly rotating which aliases are used to engage with the targets on similar subject matter. Figure 2. Example of TA427 campaign focused on US policy during an election year. Using timely, relevant lure content (as seen in Figure 3) customized for each victim, and often spoofing individuals in the DPRK research space with whom the victim is familiar to encourage engagement, targets are often requested to share their thoughts on these topics via email or a formal research paper or article. Malware or credential harvesting are never directly sent to the targets without an exchange of multiple messages, and based on Proofpoint visibility, rarely utilized by the threat actor. It is possible that TA427 can fulfill its intelligence requirements by directly asking targets for their opinions or analysis rather than from an infection. Additionally, insight gained from the correspondence is likely used to improve targeting of the victim organization and establish rapport for later questions and engagement. Figure 3. Timeline of real-world events based on international press reporting, side-by-side with Proofpoint observed subject lures. Lure content often includes invitations to attend events about North Korean policies regarding international affairs, questions regarding topics such as how deterr | Malware Tool Threat Conference | APT 37 APT 43 | ★★ |
|
2024-04-15 20:31:45 | Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) (lien direct) | ## Instantané
Le 10 avril 2024, la volexité a découvert l'exploitation zéro-jour d'une vulnérabilité dans la fonctionnalité GlobalProtect de Palo Alto Networks Pan-OS à l'un de ses clients de surveillance de la sécurité des réseaux (NSM).La vulnérabilité a été confirmée comme un problème d'injection de commande de système d'exploitation et attribué CVE-2024-3400.Le problème est une vulnérabilité d'exécution de code distante non authentifiée avec un score de base CVSS de 10,0.L'acteur de menace, que volexité suit sous l'alias UTA0218, a pu exploiter à distance l'appareil de pare-feu, créer un shell inversé et télécharger d'autres outils sur l'appareil.L'attaquant s'est concentré sur l'exportation des données de configuration des appareils, puis en le tirant en tirant comme point d'entrée pour se déplacer latéralement au sein des organisations victimes.Au cours de son enquête, Volexity a observé que l'UTA0218 avait tenté d'installer une porte dérobée Python personnalisée, que volexité appelle Upstyle, sur le pare-feu.La porte dérobée Upstyle permet à l'attaquant d'exécuter des commandes supplémentaires sur l'appareil via des demandes de réseau spécialement conçues.UTA0218 a été observé en exploitant des appareils de pare-feu pour déployer avec succès des charges utiles malveillantes.Après avoir réussi à exploiter les appareils, UTA0218 a téléchargé des outils supplémentaires à partir de serveurs distants qu'ils contrôlaient afin de faciliter l'accès aux réseaux internes des victimes.Ils se sont rapidement déplacés latéralement à travers les réseaux victimes de victimes, extrait les informations d'identification sensibles et autres fichiers qui permettraient d'accéder pendant et potentiellement après l'intrusion.Le métier et la vitesse employés par l'attaquant suggèrent un acteur de menace hautement capable avec un livre de jeu clair sur quoi accéder pour poursuivre leurs objectifs.Il est probable que l'exploitation du dispositif de pare-feu, suivie d'une activité de planche pratique, a été limitée et ciblée.Cependant, les preuves d'une activité de reconnaissance potentielle impliquant une exploitation plus répandue visant à identifier les systèmes vulnérables semblent avoir eu lieu au moment de la rédaction.
## Les références
[https://security.paloaltonetworks.com/CVE-2024-3400#new_tab.
[https://www.volexity.com/blog/2024/04/12/zero-ay-exploitation-of-unauthenticated-remote-code-execution-vulnerabilité-in-GlobalProtect-CVE-2024-3400 /] (https://www.volexity.com/blog/2024/04/12/zero-kay-exploitation-of-unauthenticated-remote-code-execution-vulnerabilité-in-globalprotect-CVE-2024-3400 /)
## Snapshot On April 10, 2024, Volexity discovered zero-day exploitation of a vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS at one of its network security monitoring (NSM) customers. The vulnerability was confirmed as an OS command injection issue and assigned CVE-2024-3400. The issue is an unauthenticated remote code execution vulnerability with a CVSS base score of 10.0. The threat actor, which Volexity tracks under the alias UTA0218, was able to remotely exploit the firewall device, create a reverse shell, and download further tools onto the device. The attacker focused on exporting configuration data from the devices, and then leveraging it as an entry point to move laterally within the victim organizations. During its investigation, Volexity observed that UTA0218 attempted to install a custom Python backdoor, which Volexity calls UPSTYLE, on the firewall. The UPSTYLE backdoor allows the attacker to execute additional commands on the device via specially crafted network requests. UTA0218 was observed exploiting firewall devices to successfully deploy malicious payloads. After successfully exploiting devices, UTA0218 downloaded additional tooling from remote servers they controlled in order to facilitate access to victims\' internal networks. They quickly moved laterally thr |
Tool Vulnerability Threat | ★★ | |
|
2024-04-15 19:28:57 | Palo Alto Network émet des chaussettes pour un bug zéro-jour dans son pare-feu OS Palo Alto Network Issues Hotfixes for Zero-Day Bug in Its Firewall OS (lien direct) |
Un acteur de menace sophistiqué tire parti du bug pour déployer une porte dérobée Python pour voler des données et exécuter d'autres actions malveillantes.
A sophisticated threat actor is leveraging the bug to deploy a Python backdoor for stealing data and executing other malicious actions. |
Vulnerability Threat | ★★ | |
|
2024-04-15 18:59:00 | Les changements de Balance confondus se concentrent sur le SaaS et le nuage pour les attaques d'extorsion et de vol de données Muddled Libra Shifts Focus to SaaS and Cloud for Extortion and Data Theft Attacks (lien direct) |
L'acteur de menace connu sous le nom de & nbsp; Mouddled Balance & NBSP; a été observé activement ciblant les applications logicielles en tant que logiciels (SaaS) et les environnements du fournisseur de services cloud (CSP) dans le but d'exfiltrer des données sensibles.
«Les organisations stockent souvent une variété de données dans les applications SaaS et les services d'utilisation des CSP», Palo Alto Networks Unit 42 & NBSP; Said & NBSP; dans un rapport publié la semaine dernière.
"La menace
The threat actor known as Muddled Libra has been observed actively targeting software-as-a-service (SaaS) applications and cloud service provider (CSP) environments in a bid to exfiltrate sensitive data. "Organizations often store a variety of data in SaaS applications and use services from CSPs," Palo Alto Networks Unit 42 said in a report published last week. "The threat |
Threat Cloud | ★★ | |
 |
2024-04-15 16:43:18 | PALO Alto Networks Relaying Corrections pour les jours zéro alors que les attaquants essaiffent la vulnérabilité VPN Palo Alto Networks releases fixes for zero-day as attackers swarm VPN vulnerability (lien direct) |
L'acteur de menace connu sous le nom de & nbsp; Mouddled Balance & NBSP; a été observé activement ciblant les applications logicielles en tant que logiciels (SaaS) et les environnements du fournisseur de services cloud (CSP) dans le but d'exfiltrer des données sensibles.
«Les organisations stockent souvent une variété de données dans les applications SaaS et les services d'utilisation des CSP», Palo Alto Networks Unit 42 & NBSP; Said & NBSP; dans un rapport publié la semaine dernière.
"La menace
The threat actor known as Muddled Libra has been observed actively targeting software-as-a-service (SaaS) applications and cloud service provider (CSP) environments in a bid to exfiltrate sensitive data. "Organizations often store a variety of data in SaaS applications and use services from CSPs," Palo Alto Networks Unit 42 said in a report published last week. "The threat |
Vulnerability Threat | ★★★ | |
|
2024-04-15 16:15:00 | Russie et Ukraine Top Inaugural World Cybercrime Index Russia and Ukraine Top Inaugural World Cybercrime Index (lien direct) |
Une équipe internationale de chercheurs a publié les tout premiers pays de classement des indices par le niveau de menace de cybercriminalité
An international team of researchers published the first-ever index ranking countries by cybercrime threat level |
Threat | ★★ | |
|
2024-04-15 16:07:11 | Des pirates soutenus par l'Iran font exploser des textes menaçants aux Israéliens Iran-Backed Hackers Blast Out Threatening Texts to Israelis (lien direct) |
Handala Threat Group prétend avoir piraté les systèmes radar en Israël à mesure que les tensions augmentent entre les deux nations.
Handala threat group claims to have hacked radar systems in Israel as tensions rise between the two nations. |
Threat | ★★★ | |
|
2024-04-15 15:15:00 | Faits saillants hebdomadaires, 15 avril 2024 Weekly OSINT Highlights, 15 April 2024 (lien direct) |
## Snapshot Last week\'s OSINT reporting reveals a landscape of diverse cyber threats characterized by sophisticated attack tactics and adaptable threat actors. One key trend was the increasing use of artificial intelligence (AI) by cybercriminals, including AI-powered malvertising on social media platforms and suspected LLM-generated content in a malware campaign targeting German organizations. Additionally, several OSINT articles reported on the trend of exploiting popular platforms like YouTube and GitHub to distribute malware. Threat actors demonstrate a keen understanding of user behavior, leveraging enticing content and fake webpages to lure victims into downloading malicious payloads, highlighting the importance of proactive defense strategies to mitigate evolving threats effectively. ## Description 1. **[German Organizations Targeted with Rhadamanthys Malware](https://security.microsoft.com/intel-explorer/articles/119bde85):** Proofpoint identifies TA547 launching an email campaign targeting German organizations with Rhadamanthys malware, representing a shift in techniques for the threat actor. The campaign involves impersonating a German retail company in emails containing password-protected ZIP files containing LNK files triggering PowerShell scripts to load Rhadamanthys into memory, bypassing disk writing. The incorporation of suspected LLM-generated content into the attack chain provides insight into how threat actors are leveraging LLM-generated content in malware campaigns. 2. **[Russian-Language Cybercrime Operation Leveraging Fake Web3 Gaming Projects](https://security.microsoft.com/intel-explorer/articles/0cdc08b5):** The Insikt Group uncovers a large-scale Russian-language cybercrime operation distributing infostealer malware through fake Web3 gaming projects targeting both macOS and Windows users. Threat actors entice users with the potential for cryptocurrency earnings, distributing malware like Atomic macOS Stealer (AMOS), Stealc, Rhadamanthys, or RisePro upon visiting imitation Web3 gaming projects\' webpages. 3. **[AI-Powered Malvertising Campaigns on Social Media](https://security.microsoft.com/intel-explorer/articles/1e1b0868):** Bitdefender discusses the use of artificial intelligence (AI) by cybercriminals in malvertising campaigns on social media platforms, impersonating popular AI software to distribute stealers like Rilide, Vidar, IceRAT, and Nova Stealer. These campaigns target European users through fake AI software webpages on Facebook, organized by taking over existing accounts and boosting page popularity through engaging content. 4. **[Exploitation of YouTube Channels for Infostealer Distribution](https://security.microsoft.com/intel-explorer/articles/e9f5e219):** AhnLab identifies a trend where threat actors exploit YouTube channels to distribute Infostealers like Vidar and LummaC2, disguising them as cracked versions of legitimate software. Attackers hijack popular channels with hundreds of thousands of subscribers, distributing malicious links through video descriptions and comments, highlighting concerns about the potential reach and impact of distributed malware. 5. **[VenomRAT Distribution via Phishing Email with Malicious SVG Files](https://security.microsoft.com/intel-explorer/articles/98d69c76):** FortiGuard Labs reveals a threat actor distributing VenomRAT and other plugins through phishing emails containing malicious Scalable Vector Graphics (SVG) files. The email attachment downloads a ZIP file containing an obfuscated Batch file, subsequently loading VenomRAT using ScrubCrypt to maintain a connection with a command and control (C2) server and install plugins on victims\' environments. 6. **[Malware Distribution through GitHub Repositories Manipulation](https://security.microsoft.com/intel-explorer/articles/4d0ffb2c):** Checkmarx reports a cybercriminal attack campaign manipulating GitHub\'s search functionality to distribute malware through repositories. Attackers create repositories with popular names and topics, hiding malicious code withi | Ransomware Spam Malware Tool Threat Prediction | ★★ | |
|
2024-04-15 14:34:00 | Les logiciels espions iOS liés à listes chinoises ciblent les utilisateurs d'iPhone sud-asiatique Chinese-Linked LightSpy iOS Spyware Targets South Asian iPhone Users (lien direct) |
Les chercheurs en cybersécurité ont découvert une campagne de cyber-espionnage "renouvelée" ciblant les utilisateurs en Asie du Sud dans le but de livrer un implant de logiciel espant de l'Apple iOS appelé & nbsp; LightSpy.
"La dernière itération de LightSpy, surnommée \\ 'f_warehouse, \' possède un cadre modulaire avec des fonctionnalités d'espionnage étendues", l'équipe de recherche et de renseignement sur les menaces BlackBerry & NBSP; Said & Nbsp; Dans un rapport publié en dernier
Cybersecurity researchers have discovered a "renewed" cyber espionage campaign targeting users in South Asia with the aim of delivering an Apple iOS spyware implant called LightSpy. "The latest iteration of LightSpy, dubbed \'F_Warehouse,\' boasts a modular framework with extensive spying features," the BlackBerry Threat Research and Intelligence Team said in a report published last |
Threat Mobile | ★★ | |
|
2024-04-15 14:30:00 | Palo Alto Networks Flaw Zero-Day exploité dans des attaques ciblées Palo Alto Networks Zero-Day Flaw Exploited in Targeted Attacks (lien direct) |
Désigné CVE-2024-3400 et avec un score CVSS de 10,0, la faille permet aux acteurs non autorisés d'exécuter un code arbitraire sur les pare-feu affectés
Designated CVE-2024-3400 and with a CVSS score of 10.0, the flaw enables unauthorized actors to execute arbitrary code on affected firewalls |
Vulnerability Threat | ★★ | |
|
2024-04-15 13:00:33 | Microsoft et Google en tête de liste des attaques de phishing du premier tri Microsoft and Google Top the List in Q1 2024 Phishing Attacks: Check Point Research Highlights a Surge in Cyber Threats (lien direct) |
> L'entrée Airbnb & # 8217; dans le top 10 des marques a imité les signaux élargissant les horizons cybercriminaux dans le paysage en constante évolution des cyber-menaces, les attaques de phishing continuent de présenter un risque important pour les individus et les organisations dans le monde.Check Point Research (RCR), la branche de renseignement des menaces de Check Point & Reg;Software Technologies Ltd., a récemment publié son dernier classement de phishing de marque pour le premier trimestre de 2024. Ce classement a mis en lumière les marques les plus fréquemment imitées par les cybercriminels dans leurs tentatives implacables de tromper et de voler des informations personnelles ou des informations d'identification de paiement.Au cours du premier trimestre de 2024, Microsoft a continué d'être la marque la plus imitée en phishing [& # 8230;]
>Airbnb’s Entry into Top 10 imitated Brands Signals Expanding Cybercriminal Horizons In the ever-evolving landscape of cyber threats, phishing attacks continue to pose a significant risk to individuals and organizations worldwide. Check Point Research (CPR), the Threat Intelligence arm of Check Point® Software Technologies Ltd., has recently released its latest Brand Phishing Ranking for the first quarter of 2024. This ranking shed light on the brands most frequently imitated by cybercriminals in their relentless attempts to deceive and steal personal information or payment credentials. During the first quarter of 2024, Microsoft continued to be the most imitated brand in phishing […] |
Threat | ★★★ | |
|
2024-04-15 11:16:11 | 15 avril & # 8211;Rapport de renseignement sur les menaces 15th April – Threat Intelligence Report (lien direct) |
> Pour les dernières découvertes en cyberLes principales attaques et violation du géant de l'optique japonaise Hoya Corporation ont été victimes d'une attaque de ransomware qui a eu un impact sur sa principale infrastructure informatique et diverses divisions commerciales.Hunters International Ransomware Gang a revendiqué la responsabilité de l'attaque et [& # 8230;]
>For the latest discoveries in cyber research for the week of 15th April, please download our Threat_Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese optics giant Hoya Corporation has been a victim of a ransomware attack that impacted its major IT infrastructure and various business divisions. Hunters International ransomware gang claimed responsibility for the attack and […] |
Ransomware Threat | ★★ | |
|
2024-04-15 09:39:45 | HarfangLab et Filigran s\'allient pour optimiser la réponse à incidents (lien direct) | HarfangLab et Filigran s'allient pour optimiser la réponse à incidents Les deux experts en cybersécurité s'associent pour aider les équipes cyber de toutes tailles à intégrer et à automatiser la gestion des données sur les menaces afin d'accélérer la détection et les réponses aux incidents. - Business | Threat | ★★ | |
 |
2024-04-15 09:08:44 | L\'impact de l\'intelligence artificielle sur la société et les menaces croissantes des cybercriminels (lien direct) | L'intelligence artificielle (IA) a progressivement infiltré les recoins de nos vies, comme les plus sombres d'internet, transformant de nombreux aspects de notre vie quotidienne. Avec l'augmentation de la demande de logiciels alimentés par l'IA pour les créateurs de contenu, les cybercriminels n'ont... | Threat | ★★ | |
|
2024-04-15 06:00:31 | Comment la protection d'identification de la preuve peut vous aider à répondre aux exigences de conformité CMMC How Proofpoint Impersonation Protection Can Help You Meet CMMC Compliance Requirements (lien direct) |
The Cybersecurity Maturity Model Certification (CMMC) program enforces the protection of sensitive unclassified information that the U.S. Department of Defense (DoD) shares with its contractors and subcontractors. Threat actors know how to hijack your trusted organization communications. They can impersonate you, your brand or your organization partners. And they can make a nice profit doing it. The FBI\'s 2023 Internet Crime Report notes that last year\'s adjusted losses from organization email compromise (BEC) cases exceeded $2.9 billion-up 7.4% from 2022. Bad actors use spoofed domains, lookalike domains, compromised supplier accounts and other tactics in their attacks. So it\'s important to keep communications with trusted partners, customers and suppliers safe. This should be a top focus for government agencies and the organizations that they work with since they are key targets for bad actors. Proofpoint helps you mitigate the risk of impersonation abuse with a holistic, multilayered approach. With Proofpoint Impersonation Protection, you can: Protect your organization\'s communications from impersonation threats Stop attackers from impersonating your brand Detect and defend against risky suppliers, including compromised supplier accounts Secure user and application emails so that they can be trusted We help our federal and defense industrial base customers with Level 3 CMMC controls around the Risk Assessment (RA) and Identification and Authentication (IA) Practices. Here\'s how. CMMC overviews for Level 3 controls In this section, we match CMMC compliance requirements with the capabilities of Proofpoint Impersonation Protection. CMMC Level 3 – Risk Assessment Practice RA.L3-3.11.1e – Threat-Informed Risk Assessment CMMC compliance requirement Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting and response and recovery activities. RA.L3-3.11.3e – Advanced Risk Identification CMMC compliance requirement Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems and system components. RA.L3-3.11.6e – Supply Chain Risk Response CMMC compliance requirement Assess, respond to and monitor supply chain risks associated with organizational systems and system components. RA.L3-3.11.7e – Supply Chain Risk Plan CMMC compliance requirement Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually, and upon receipt of relevant cyber threat information, or in response to a relevant cyber incident. How Proofpoint Impersonation Protection meets the Risk Assessment (RA) Practice needs above Proofpoint Nexus Supplier Risk Explorer gives you insights into supplier risk. This includes threats where attackers are impersonating your agency as well as compromised suppliers and third parties. Supplier Risk can also be used as part of a vendor risk management process when sourcing and choosing new vendors/suppliers. Proofpoint provides visibility into supply chain threats, lookalike detection, and impersonations of your brand with Supplier Risk and Domain Discover. This helps to create the supply chain risk plans that are needed to comply with CMMC. Supplier Risk Explorer identifies supplier domains and shows you which suppliers pose a risk to your organization. As noted above, Supplier Risk Explorer assesses the risk level of supplier domains by evaluating several dimensions, including: Threats sent to your organization Threats sent to other Proofpoint customers The lookalikes of supplier domains Whether a domain was recently registered Whether a domain has a DMARC reject policy By ranking an | Threat Industrial Prediction Commercial | ★★ | |
|
2024-04-13 13:55:00 | Les pirates déploient la porte dérobée Python dans l'attaque de Palo Alto-Day Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack (lien direct) |
Les acteurs de la menace ont exploité la faille de zéro jour nouvellement divulguée à Palo
Alto Networks Pan-OS Software datant du 26 mars 2024, près de trois
Des semaines avant, il se révèle hier.
La division Unit 42 de la société de sécurité du réseau est & nbsp; suivi & nbsp; l'activité sous le nom & nbsp; opération MidnightClipse, l'attribuant comme le travail d'un seul acteur de menace de
Threat actors have been exploiting the newly disclosed zero-day flaw in Palo Alto Networks PAN-OS software dating back to March 26, 2024, nearly three weeks before it came to light yesterday. The network security company\'s Unit 42 division is tracking the activity under the name Operation MidnightEclipse, attributing it as the work of a single threat actor of |
Vulnerability Threat | ★★ | |
 |
2024-04-13 10:00:16 | Hacker affirme que la violation des données géantes du tigre, fuit 2,8 m de dossiers en ligne Hacker claims Giant Tiger data breach, leaks 2.8M records online (lien direct) |
Le géant canadien de la chaîne de vente au détail Tiger a révélé une violation de données en mars 2024. Un acteur de menace a maintenant publiquement revendiqué la responsabilité de la violation de données et a divulgué 2,8 millions de dossiers sur un forum de pirates qu'ils prétendent être des clients géants Tiger.[...]
Canadian retail chain Giant Tiger disclosed a data breach in March 2024. A threat actor has now publicly claimed responsibility for the data breach and leaked 2.8 million records on a hacker forum that they claim are of Giant Tiger customers. [...] |
Data Breach Threat | ★★★ | |
|
2024-04-13 08:35:15 | PALO Alto Networks Zero-Day exploité depuis mars dans des pare-feu de porte dérobée Palo Alto Networks zero-day exploited since March to backdoor firewalls (lien direct) |
Les pirates suspects parrainés par l'État ont exploité une vulnérabilité zéro jour dans les pare-feu Palo Alto suivis comme CVE-2024-3400 depuis le 26 mars, en utilisant les appareils compromis pour violer les réseaux internes, voler des données et des informations d'identification.[...]
Suspected state-sponsored hackers have been exploiting a zero-day vulnerability in Palo Alto Networks firewalls tracked as CVE-2024-3400 since March 26, using the compromised devices to breach internal networks, steal data and credentials. [...] |
Vulnerability Threat | ★★★ | |
 |
2024-04-12 22:29:44 | CVE-2024-3400: Ce que vous devez savoir sur le Pan-OS Zero-Day critique CVE-2024-3400: What You Need to Know About the Critical PAN-OS Zero-Day (lien direct) |
MISE À JOUR: Il a été confirmé que la désactivation de la télémétrie ne bloquera pas cet exploit.L'application d'un correctif dès que possible est la correction la plus efficace pour cette vulnérabilité.Des correctifs pour 8 des 18 versions vulnérables ont été publiées;Les correctifs pour les versions vulnérables restantes sont attendues avant le 19 avril.Crowdsstrike travaille constamment à [& # 8230;]
UPDATE: It has been confirmed that disabling telemetry will not block this exploit. Applying a patch as soon as possible is the most effective remediation for this vulnerability. Patches for 8 of the 18 vulnerable versions have been released; patches for the remaining vulnerable versions are expected by April 19th. CrowdStrike is constantly working to […] |
Vulnerability Threat | ★★ | |
|
2024-04-12 20:50:01 | La plate-forme d'analyse des logiciels malveillants de CISA \\ pourrait favoriser une meilleure menace Intel CISA\\'s Malware Analysis Platform Could Foster Better Threat Intel (lien direct) |
Mais la façon dont le gouvernement différencie sa plate-forme des options similaires du secteur privé reste à voir.
But just how the government differentiates its platform from similar private-sector options remains to be seen. |
Malware Threat | ★★ | |
|
2024-04-12 18:11:30 | TA547 cible les organisations allemandes avec Rhadamanthys Stealer TA547 Targets German Organizations with Rhadamanthys Stealer (lien direct) |
#### Géolocations ciblées
- Allemagne
## Instantané
Proofpoint a identifié TA547 lancement d'une campagne de courriel ciblant les organisations allemandes avec Rhadamanthys malware, marquant la première utilisation connue de Rhadamanthys par cet acteur de menace.La campagne consistait à usurper l'identité d'une entreprise de vente au détail allemande dans des e-mails contenant des fichiers ZIP protégés par mot de passe prétendument liés aux factures, ciblant plusieurs industries en Allemagne.
## Description
Les fichiers zip contenaient des fichiers LNK qui, lorsqu'ils sont exécutés, ont déclenché un script PowerShell pour exécuter un script distant chargeant des Rhadamanthys en mémoire, en contournant l'écriture de disque.Le script PowerShell affichait des caractéristiques suggérant un contenu généré par la machine, potentiellement à partir de modèles de langues grands (LLM).
La récente campagne en Allemagne représente un changement dans les techniques de TA547, y compris l'utilisation de LNK comprimés et du voleur Rhadamanthys non observé auparavant.L'incorporation de contenu suspecté de LLM dans la chaîne d'attaque donne un aperçu de la façon dont les acteurs de la menace tirent parti du contenu généré par LLM dans les campagnes de logiciels malveillants, bien qu'il n'ait pas modifié la fonctionnalité ou l'efficacité du malware ou la façon dont les outils de sécurité ont défendu contre lui.
## Recommandations
[Consultez la rédaction de Microsoft \\ sur les voleurs d'informations ici.] (Https://sip.security.microsoft.com/intel-profiles/2296d491ea381b532b24f2575f9418d4b6723c17b8a1f507d20c2140a75d16d6)
[Consultez OSINT supplémentaire sur Rhadamanthys ici.] (Https://sip.security.microsoft.com/intel-explorer/articles/0131b256)
## Les références
[https://www.poolinpoint.com/us/blog/thereat-insight/security-brief-ta547-targets-geman-organizations-rhadamanthys-tealermenace-insight / sécurité-Brief-Ta547-Targets-German-Organisations-Rhadamanthys-Stealer)
#### Targeted Geolocations - Germany ## Snapshot Proofpoint has identified TA547 launching an email campaign targeting German organizations with Rhadamanthys malware, marking the first known use of Rhadamanthys by this threat actor. The campaign involved impersonating a German retail company in emails containing password-protected ZIP files purportedly related to invoices, targeting multiple industries in Germany. ## Description The ZIP files contained LNK files which, when executed, triggered a PowerShell script to run a remote script loading Rhadamanthys into memory, bypassing disk writing. The PowerShell script displayed characteristics suggestive of machine-generated content, potentially from large language models (LLMs). The recent campaign in Germany represents a shift in techniques for TA547, including the use of compressed LNKs and the previously unobserved Rhadamanthys stealer. The incorporation of suspected LLM-generated content into the attack chain provides insight into how threat actors are leveraging LLM-generated content in malware campaigns, although it did not change the functionality or efficacy of the malware or the way security tools defended against it. ## Recommendations [Check out Microsoft\'s write-up on information stealers here.](https://sip.security.microsoft.com/intel-profiles/2296d491ea381b532b24f2575f9418d4b6723c17b8a1f507d20c2140a75d16d6) [Check out additional OSINT on Rhadamanthys here.](https://sip.security.microsoft.com/intel-explorer/articles/0131b256) ## References [https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-organizations-rhadamanthys-stealer](https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-organizations-rhadamanthys-stealer) |
Malware Tool Threat | ★★ | |
 |
2024-04-12 17:02:59 | Exploitation zéro-jour de la vulnérabilité d'exécution du code distant non authentifié dans GlobalProtect (CVE-2024-3400) Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) (lien direct) |
> La volexité tient à remercier les réseaux Palo Alto pour leur partenariat, leur coopération et leur réponse rapide à ce problème critique.Leurs recherches peuvent être trouvées ici.Le 10 avril 2024, la volexité a identifié l'exploitation zéro-jour d'une vulnérabilité trouvée dans la fonctionnalité GlobalProtect de Palo Alto Networks Pan-OS à l'un de ses clients de surveillance de la sécurité des réseaux (NSM).La volexité a reçu des alertes concernant le trafic de réseau suspect émanant du pare-feu du client.Une enquête ultérieure a déterminé que le dispositif avait été compromis.Le lendemain, le 11 avril 2024, la volexité a observé plus loin, une exploitation identique à un autre de ses clients NSM par le même acteur de menace.L'acteur de menace, que volexité suit sous l'alias UTA0218, a pu exploiter à distance l'appareil de pare-feu, créer un shell inversé et télécharger d'autres outils sur l'appareil.L'attaquant s'est concentré sur l'exportation des données de configuration des périphériques, puis en le tirant en tirant comme point d'entrée pour se déplacer latéralement dans [& # 8230;]
>Volexity would like to thank Palo Alto Networks for their partnership, cooperation, and rapid response to this critical issue. Their research can be found here. On April 10, 2024, Volexity identified zero-day exploitation of a vulnerability found within the GlobalProtect feature of Palo Alto Networks PAN-OS at one of its network security monitoring (NSM) customers. Volexity received alerts regarding suspect network traffic emanating from the customer\'s firewall. A subsequent investigation determined the device had been compromised. The following day, April 11, 2024, Volexity observed further, identical exploitation at another one of its NSM customers by the same threat actor. The threat actor, which Volexity tracks under the alias UTA0218, was able to remotely exploit the firewall device, create a reverse shell, and download further tools onto the device. The attacker focused on exporting configuration data from the devices, and then leveraging it as an entry point to move laterally within […] |
Tool Vulnerability Threat | ★★★ | |
|
2024-04-12 15:19:00 | Les pirates iraniens de Muddywater adoptent un nouvel outil C2 \\ 'darkbeatc2 \\' dans la dernière campagne Iranian MuddyWater Hackers Adopt New C2 Tool \\'DarkBeatC2\\' in Latest Campaign (lien direct) |
L'acteur de menace iranien connue sous le nom de Muddywater a été attribué à une nouvelle infrastructure de commandement et de contrôle (C2) appelé & nbsp; darkbeatc2, devenant le dernier outil de ce type dans son arsenal après & nbsp; middyc2go.
"Tout en passant occasionnellement à un nouvel outil d'administration à distance ou en modifiant leur cadre C2, les méthodes de Muddywater \\ restent constantes"
The Iranian threat actor known as MuddyWater has been attributed to a new command-and-control (C2) infrastructure called DarkBeatC2, becoming the latest such tool in its arsenal after SimpleHarm, MuddyC3, PhonyC2, and MuddyC2Go. "While occasionally switching to a new remote administration tool or changing their C2 framework, MuddyWater\'s methods remain constant," Deep |
Tool Threat | ★★ | |
|
2024-04-12 14:36:02 | Palo Alto Networks met en garde contre le produit zéro dans le produit VPN Palo Alto Networks warns of zero-day in VPN product (lien direct) |
L'acteur de menace iranien connue sous le nom de Muddywater a été attribué à une nouvelle infrastructure de commandement et de contrôle (C2) appelé & nbsp; darkbeatc2, devenant le dernier outil de ce type dans son arsenal après & nbsp; middyc2go.
"Tout en passant occasionnellement à un nouvel outil d'administration à distance ou en modifiant leur cadre C2, les méthodes de Muddywater \\ restent constantes"
The Iranian threat actor known as MuddyWater has been attributed to a new command-and-control (C2) infrastructure called DarkBeatC2, becoming the latest such tool in its arsenal after SimpleHarm, MuddyC3, PhonyC2, and MuddyC2Go. "While occasionally switching to a new remote administration tool or changing their C2 framework, MuddyWater\'s methods remain constant," Deep |
Vulnerability Threat | ★★★ | |
|
2024-04-12 14:26:00 | Alerte zéro-jour: réseaux Palo Alto critiques Pan-OS Flaw sous attaque active Zero-Day Alert: Critical Palo Alto Networks PAN-OS Flaw Under Active Attack (lien direct) |
Palo Alto Networks avertit qu'un défaut critique impactant son logiciel Pan-OS utilisé dans ses passerelles GlobalProtect est exploité dans la nature.
Suivi en AS & NBSP; CVE-2024-3400, le problème a un score CVSS de 10,0, indiquant une gravité maximale.
"Une vulnérabilité d'injection de commande dans la fonctionnalité GlobalProtect de Palo Alto Networks Pan-OS Logiciel pour des versions PAN-OS spécifiques et une fonctionnalité distincte
Palo Alto Networks is warning that a critical flaw impacting its PAN-OS software used in its GlobalProtect gateways is being exploited in the wild. Tracked as CVE-2024-3400, the issue has a CVSS score of 10.0, indicating maximum severity. "A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature |
Vulnerability Threat | ★★ | |
 |
2024-04-12 13:33:29 | La menace croissante du harcèlement sur les réseaux sociaux.Voici comment vous protéger. The Rising Threat of Social Media Harassment. Here\\'s How to Protect Yourself. (lien direct) |
> 
Certaines conversations sur les réseaux sociaux peuvent devenir… chauffées.Certains peuvent franchir la ligne dans le harcèlement.Ou pire.Harcèlement sur ...
> 
Some conversations on social media can get … heated. Some can cross the line into harassment. Or worse. Harassment on...
|
Threat | ★★ |
To see everything:
Our RSS (filtrered)
