What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-03-27 21:50:12 | Eclecticiq détaille l'opération Flightnight ciblant les entités gouvernementales indiennes, le secteur de l'énergie EclecticIQ details Operation FlightNight targeting Indian government entities, energy sector (lien direct) |
> Les analystes d'EclectiCIQ ont découvert un acteur de menace non identifié, connu sous le nom d'Operation Flightnight, en utilisant une version personnalisée du ...
>EclecticIQ analysts have uncovered an unidentified threat actor, known as Operation FlightNight, utilizing a customized version of the... |
Threat | ★★★★ | |
 |
2024-03-27 20:56:32 | Flare acquiert la préclusion pour accélérer la croissance de la gestion de l'exposition aux menaces Flare Acquires Foretrace to Accelerate Threat Exposure Management Growth (lien direct) |
> Les analystes d'EclectiCIQ ont découvert un acteur de menace non identifié, connu sous le nom d'Operation Flightnight, en utilisant une version personnalisée du ...
>EclecticIQ analysts have uncovered an unidentified threat actor, known as Operation FlightNight, utilizing a customized version of the... |
Threat | ★★★ | |
 |
2024-03-27 20:54:00 | Les pirates ont frappé la défense indienne, les secteurs de l'énergie avec des logiciels malveillants se faisant passer pour l'invitation de l'Air Force Hackers Hit Indian Defense, Energy Sectors with Malware Posing as Air Force Invite (lien direct) |
Les entités gouvernementales indiennes et les sociétés énergétiques ont été ciblées par des acteurs de menace inconnus dans le but de livrer une version modifiée d'un malware d'informations open source, un voleur malveillant appelé Hackbrowserdata et des informations sensibles exfiltrates dans certains cas en utilisant Slack comme commandement et contrainte (C2).
"Le voleur d'informations a été livré via un e-mail de phishing, se faisant passer pour une lettre d'invitation
Indian government entities and energy companies have been targeted by unknown threat actors with an aim to deliver a modified version of an open-source information stealer malware called HackBrowserData and exfiltrate sensitive information in some cases by using Slack as command-and-control (C2). "The information stealer was delivered via a phishing email, masquerading as an invitation letter |
Malware Threat | ★★★ | |
 |
2024-03-27 20:13:37 | Google Tag rapporte que la surtension zéro-jour et la montée des menaces de piratage d'État Google TAG Reports Zero-Day Surge and Rise of State Hacker Threats (lien direct) |
> Par waqas
Le groupe d'analyse des menaces de Google (TAG) rapporte une augmentation préoccupante des exploits zéro-jours et une activité accrue à partir de pirates soutenus par l'État. & # 8230;
Ceci est un article de HackRead.com Lire la publication originale: Google Tag rapporte que la surtension zéro-jour et la montée des menaces de pirate d'État
>By Waqas Google’s Threat Analysis Group (TAG) reports a concerning rise in zero-day exploits and increased activity from state-backed hackers.… This is a post from HackRead.com Read the original post: Google TAG Reports Zero-Day Surge and Rise of State Hacker Threats |
Vulnerability Threat | ★★★★ | |
|
2024-03-27 20:10:46 | Des millions de chambres d'hôtel dans le monde vulnérables à l'exploitation de verrouillage de porte Millions of Hotel Rooms Worldwide Vulnerable to Door Lock Exploit (lien direct) |
Les verrous de l'hôtel sont vulnérables au cyber-compromis depuis des décennies et étendent leur course à l'ère numérique.
Hotel locks have been vulnerable to cyber compromise for decades and are extending their run into the digital age. |
Threat | ★★★ | |
 |
2024-03-27 20:00:58 | Flashpoint libère le rapport annuel de renseignement sur les menaces mondiales Flashpoint Releases Annual Global Threat Intelligence Report (lien direct) |
Flashpoint a publié son rapport de renseignement sur les menaces mondiales en 2024 qui revient à 2023 pour faire la lumière sur les cyber-menaces, les troubles géopolitiques et l'escalade des conflits physiques dans le monde pour aider les organisations à renforcer les défenses, à garantir la résilience opérationnelle et à confronter de manière proactive les menaces multifacet./ p>
-
rapports spéciaux
Flashpoint released its 2024 Global Threat Intelligence Report that looks back at 2023 to shed light on cyber threats, geopolitical turmoil, and escalating physical conflicts around the world to help organizations strengthen defenses, ensure operational resilience, and proactively confront multifaceted threats. - Special Reports |
Threat Studies | ★★★★ | |
|
2024-03-27 19:56:09 | Rapport de menace: examiner l'utilisation de l'IA dans les techniques d'attaque Threat Report: Examining the Use of AI in Attack Techniques (lien direct) |
Plus que jamais, il est essentiel pour les organisations de comprendre la nature des menaces basées sur l'IA et la façon dont elles peuvent émousser l'avantage que l'IA transmet aux mauvais acteurs.
More than ever, it\'s critical for organizations to understand the nature of AI-based threats and how they can blunt the advantage that AI conveys to bad actors. |
Threat | ★★★ | |
|
2024-03-27 18:24:00 | Microsoft Edge Bug aurait pu permettre aux attaquants d'installer silencieusement des extensions malveillantes Microsoft Edge Bug Could Have Allowed Attackers to Silently Install Malicious Extensions (lien direct) |
Un défaut de sécurité désormais réglé dans le navigateur Web Microsoft Edge aurait pu être maltraité pour installer des extensions arbitraires sur les systèmes des utilisateurs et effectuer des actions malveillantes. & Nbsp;
"Cette faille aurait pu permettre à un attaquant d'exploiter une API privée, initialement destinée à des fins de marketing, pour installer secrètement des extensions de navigateur supplémentaires avec des autorisations larges sans la connaissance de l'utilisateur", Guardio
A now-patched security flaw in the Microsoft Edge web browser could have been abused to install arbitrary extensions on users\' systems and carry out malicious actions. "This flaw could have allowed an attacker to exploit a private API, initially intended for marketing purposes, to covertly install additional browser extensions with broad permissions without the user\'s knowledge," Guardio |
Threat | ★★★ | |
|
2024-03-27 16:57:55 | \\ 'Tycoon \\' Kit malware contourne Microsoft, Google MFA \\'Tycoon\\' Malware Kit Bypasses Microsoft, Google MFA (lien direct) |
Les acteurs de la menace adoptent largement la plate-forme de phishing à faible coût à faible coût (PHAAS), qui est vendu via Telegram.
Threat actors are widely adopting the fast-growing, low-cost phishing-as-a-service (PhaaS) platform, which is sold via Telegram. |
Malware Threat | ★★ | |
|
2024-03-27 16:49:44 | Nozomi Networks étend son partenariat avec Yokogawa (lien direct) | Nozomi Networks étend son partenariat avec Yokogawa pour délivrer ses services de sécurité OT et IoT dans le monde entier Les fonctionnalités de Nozomi Networks sur la visibilité OT / IoT et la détection des menaces sont désormais intégrées aux services gérés de cybersécurité de Yokogawa et proposés à des clients dans 60 pays à travers le monde. - Business | Threat Industrial | ★★ | |
|
2024-03-27 16:09:00 | Vulnérabilité de plate-forme Ray Ai non corrigée critique exploitée pour l'exploration de crypto-monnaie Critical Unpatched Ray AI Platform Vulnerability Exploited for Cryptocurrency Mining (lien direct) |
Les chercheurs en cybersécurité avertissent que les acteurs de la menace exploitent activement une vulnérabilité "contestée" et non corrigée dans une plate-forme d'intelligence artificielle open source (IA) appelée Anyscale Ray à détourner le pouvoir de calcul pour l'extraction de crypto-monnaie illicite.
"Cette vulnérabilité permet aux attaquants de prendre le contrôle de la puissance de calcul des sociétés et de divulguer des données sensibles", cherche des chercheurs en sécurité Oligo AVI
Cybersecurity researchers are warning that threat actors are actively exploiting a "disputed" and unpatched vulnerability in an open-source artificial intelligence (AI) platform called Anyscale Ray to hijack computing power for illicit cryptocurrency mining. "This vulnerability allows attackers to take over the companies\' computing power and leak sensitive data," Oligo Security researchers Avi |
Vulnerability Threat | ★★ | |
|
2024-03-27 15:27:37 | Le bonanza zéro-jour conduit plus d'exploits contre les entreprises Zero-Day Bonanza Drives More Exploits Against Enterprises (lien direct) |
Les adversaires avancés se concentrent de plus en plus sur les technologies d'entreprise et leurs fournisseurs, tandis que les plates-formes d'utilisateurs finaux réussissent à étouffer les exploits zéro-jour avec les investissements en cybersécurité, selon Google.
Advanced adversaries are increasingly focused on enterprise technologies and their vendors, while end-user platforms are having success stifling zero-day exploits with cybersecurity investments, according to Google. |
Vulnerability Threat | ★★★ | |
 |
2024-03-27 13:50:41 | Rapport Google: Malgré la montée des attaques zéro-jour, les atténuations d'exploitation fonctionnent Google Report: Despite Surge in Zero-Day Attacks, Exploit Mitigations Are Working (lien direct) |
> Malgré une augmentation des attaques zéro-jour, les données montrent que les investissements de sécurité dans les expositions d'exploitation du système d'exploitation et des logiciels obligent les attaquants à trouver de nouvelles surfaces d'attaque et des modèles de bogues.
>Despite a surge in zero-day attacks, data shows that security investments into OS and software exploit mitigations are forcing attackers to find new attack surfaces and bug patterns. |
Vulnerability Threat | ★★★ | |
 |
2024-03-27 13:01:00 | Les vulnérabilités zéro-jour ont bondi par plus de 50% par an, explique Google Zero-Day Vulnerabilities Surged by Over 50% Annually, Says Google (lien direct) |
Google a détecté des vulnérabilités de près de 100 jours zéro exploitées dans la nature en 2023
Google detected nearly 100 zero-day vulnerabilities exploited in the wild in 2023 |
Vulnerability Threat | ★★★ | |
 |
2024-03-27 13:00:00 | Les logiciels espions et les exploits zéro-jours vont de plus en plus de pair, les chercheurs trouvent Spyware and zero-day exploits increasingly go hand-in-hand, researchers find (lien direct) |
> Les chercheurs ont trouvé 97 jours zéro exploités dans la nature en 2023;Près des deux tiers des défauts mobiles et du navigateur ont été utilisés par les entreprises spyware.
>Researchers found 97 zero-days exploited in the wild in 2023; nearly two thirds of mobile and browser flaws were used by spyware firms. |
Vulnerability Threat Mobile | ★★ | |
 |
2024-03-27 13:00:00 | Les jours zéro exploités dans la nature ont bondi de 50% en 2023, alimenté par des vendeurs de logiciels espions Zero-days exploited in the wild jumped 50% in 2023, fueled by spyware vendors (lien direct) |
Les experts en cybersécurité avertissent que les exploits zéro-jours, qui peuvent être utilisés pour compromettre les appareils avant que quiconque ne sache qu'ils sont vulnérables, sont devenus plus courants en tant que pirates et cybercriminels à l'État-nation et en train de trouver des moyens sophistiqués de mener à bien leurs attaques.Des chercheurs de Google ont déclaré mercredi avoir observé 97 jours zéro exploités dans la nature en 2023, comparés
Cybersecurity experts are warning that zero-day exploits, which can be used to compromise devices before anyone is aware they\'re vulnerable, have become more common as nation-state hackers and cybercriminals find sophisticated ways to carry out their attacks. Researchers from Google on Wednesday said they observed 97 zero-days exploited in the wild in 2023, compared |
Vulnerability Threat | ★★★ | |
 |
2024-03-27 11:15:00 | Cyber Spies, pas les cybercriminels, derrière la plupart des exploitations zéro-jours Cyber spies, not cyber criminals, behind most zero-day exploitation (lien direct) |
Les experts en cybersécurité avertissent que les exploits zéro-jours, qui peuvent être utilisés pour compromettre les appareils avant que quiconque ne sache qu'ils sont vulnérables, sont devenus plus courants en tant que pirates et cybercriminels à l'État-nation et en train de trouver des moyens sophistiqués de mener à bien leurs attaques.Des chercheurs de Google ont déclaré mercredi avoir observé 97 jours zéro exploités dans la nature en 2023, comparés
Cybersecurity experts are warning that zero-day exploits, which can be used to compromise devices before anyone is aware they\'re vulnerable, have become more common as nation-state hackers and cybercriminals find sophisticated ways to carry out their attacks. Researchers from Google on Wednesday said they observed 97 zero-days exploited in the wild in 2023, compared |
Vulnerability Threat | ★★★ | |
 |
2024-03-27 10:02:56 | L'analyse du laboratoire de menace de WatchGuard montre une augmentation des logiciels malveillants évasifs WatchGuard Threat Lab Analysis Shows Surge in Evasive Malware (lien direct) |
WatchGuard & Reg;Technologies, une entreprise unifiée de cybersécurité, a annoncé les conclusions de son dernier rapport de sécurité Internet, détaillant les principales tendances des logiciels malveillants et les menaces de sécurité du réseau et des points finaux analysées par les chercheurs WatchGuard Threat Lab.Les principales résultats des données montrent une augmentation spectaculaire des logiciels malveillants évasifs qui ont alimenté une forte augmentation des logiciels malveillants totaux, les acteurs de menace [& # 8230;]
Le post Watchguard Threat Lab Lab Lab Analysis AnalysisMontre une augmentation des logiciels malveillants évasifs apparu pour la première fois sur gourou de la sécurité informatique .
WatchGuard® Technologies, a unified cybersecurity company, has announced the findings of its latest Internet Security Report, detailing the top malware trends and network and endpoint security threats analysed by WatchGuard Threat Lab researchers. Key findings from the data show a dramatic surge in evasive malware that fueled a large increase of total malware, threat actors […] The post WatchGuard Threat Lab Analysis Shows Surge in Evasive Malware first appeared on IT Security Guru. |
Malware Threat | ★★ | |
 |
2024-03-27 10:00:00 | Techniques avancées de numérisation NMAP Advanced Nmap Scanning Techniques (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.
Beyond its fundamental port scanning capabilities, Nmap offers a suite of advanced techniques designed to uncover vulnerabilities, bypass security measures, and gather valuable insights about target systems. Let\'s take a look at these techniques:
1. Vulnerability Detection
Syntax: nmap -sV --script=vulners
Nmap\'s vulnerability detection feature, facilitated by the \'vulners\' script, enables users to identify outdated services susceptible to known security vulnerabilities. By querying a comprehensive vulnerability database, Nmap provides valuable insights into potential weaknesses within target systems.
2. Idle Scanning
Syntax: nmap -sI
Idle scanning represents a stealthy approach to port scanning, leveraging a "zombie" host to obfuscate the origin of scan requests. By monitoring changes in the zombie host\'s IP identification number (IP ID) in response to packets sent to the target, Nmap infers the state of the target\'s ports without direct interaction.
3. Firewall Testing (Source Port Spoofing)
Syntax: nmap --source-port
This technique involves testing firewall rules by sending packets with unusual source ports. By spoofing the source port, security professionals can evaluate the effectiveness of firewall configurations and identify potential weaknesses in network defenses.
4. Service-Specific Probes (SMB Example)
Syntax: nmap -sV -p 139,445 --script=smb-vuln*
Nmap\'s service-specific probes enable detailed examination of services, such as the Server Message Block (SMB) protocol commonly used in Windows environments. By leveraging specialized scripts, analysts can identify vulnerabilities and assess the security posture of target systems.
5. Web Application Scanning (HTTP title grab)
Syntax: nmap -sV -p 80 --script=http-title
Web application scanning with Nmap allows users to gather information about web servers, potentially aiding in vulnerability identification and exploitation.
By analyzing HTTP response headers, Nmap extracts valuable insights about target web applications and server configurations.
Nmap Scripting Engine:
One of the standout features of Nmap is its robust scripting engine (NSE), which allows users to extend the tool\'s functionality through custom scripts and plugins. NSE scripts enable users to automate tasks, perform specialized scans, gather additional information, and even exploit vulnerabilities in target systems.
nmap --script-help scriptname Shows help about scripts. For each script matching the given specification, Nmap prints the script name, its categories, and its description. The specifications are the same as those accepted by --script; so, for example if you want help about the ssl-enum-ciphers script, you would run nmap --script-help ssl-enum-ciphers
Users can leverage existing NSE scripts or develop custom scripts tailored to their specific requirements. |
Tool Vulnerability Threat | ★★★ | |
|
2024-03-27 09:50:00 | Deux groupes de l'APT chinois accélèrent le cyber-espionnage contre les pays de l'ANASE Two Chinese APT Groups Ramp Up Cyber Espionage Against ASEAN Countries (lien direct) |
Deux groupes avancés de menaces persistants (APT) liés à la Chine ont été observés en ciblage des entités et des pays membres affiliés à l'Association des nations d'Asie du Sud-Est (ANASE) dans le cadre d'une campagne de cyber-espionnage au cours des trois derniers mois.
Cela comprend l'acteur de menace connu sous le nom de & nbsp; Mustang Panda, qui a été récemment lié à & nbsp; Cyber Attacks contre Myanmar & nbsp; ainsi que
Two China-linked advanced persistent threat (APT) groups have been observed targeting entities and member countries affiliated with the Association of Southeast Asian Nations (ASEAN) as part of a cyber espionage campaign over the past three months. This includes the threat actor known as Mustang Panda, which has been recently linked to cyber attacks against Myanmar as well as |
Threat | ★★ | |
 |
2024-03-27 09:00:00 | Google: les fournisseurs de logiciels espions derrière 50% des jours zéro exploités en 2023 Google: Spyware vendors behind 50% of zero-days exploited in 2023 (lien direct) |
Le groupe d'analyse des menaces de Google (TAG) et la filiale de Google Mandiant ont déclaré avoir observé une augmentation significative du nombre de vulnérabilités de jour nul exploitées dans les attaques en 2023, beaucoup d'entre elles sont liées aux fournisseurs de logiciels espions et à leurs clients.[...]
Google\'s Threat Analysis Group (TAG) and Google subsidiary Mandiant said they\'ve observed a significant increase in the number of zero-day vulnerabilities exploited in attacks in 2023, many of them linked to spyware vendors and their clients. [...] |
Vulnerability Threat | ★★★ | |
 |
2024-03-27 00:00:00 | Le rapport du Threat Lab de WatchGuard révèle une montée en puissance des malwares évasifs alimentant une vague de menaces déjà puissante (lien direct) | Paris, le 27 mars 2024 – WatchGuard® Technologies, l\'un des leaders mondiaux de la cybersécurité unifiée, livre les conclusions de son dernier rapport sur la sécurité Internet, détaillant les principales tendances en matière de logiciels malveillants et de cybermenaces ciblant les réseaux et endpoints, analysées par les chercheurs du WatchGuard Threat Lab. Les principales conclusions du rapport font état d\'une augmentation spectaculaire des logiciels malveillants évasifs, qui a entraîné une forte hausse du nombre total de logiciels malveillants et de cyberattaquants qui considèrent les serveurs de messagerie on-premise comme des cibles privilégiées à exploiter. Par ailleurs, le nombre de détections de ransomware continue de diminuer, ce qui pourrait s\'expliquer par les efforts déployés par les forces de l\'ordre pour démanteler les cyber-gangs spécialisés dans le ransomware à l\'échelle internationale. Corey Nachreiner, Chief Security Officer chez WatchGuard analyse : " Les dernières recherches du Threat Lab révèlent que les cyberattaquants emploient diverses techniques pour identifier les vulnérabilités à cibler, y compris dans les logiciels et systèmes plus anciens. C\'est pourquoi les entreprises doivent adopter une approche de défense en profondeur pour se protéger contre de telles menaces. La mise à jour des systèmes et des logiciels sur lesquels les entreprises s\'appuient est une étape essentielle pour remédier à ces vulnérabilités. En outre, les plateformes de sécurité modernes administrées par des fournisseurs de services managés peuvent offrir la sécurité complète et unifiée dont les entreprises ont besoin et leur permettre de lutter contre les menaces les plus récentes ". Parmi les principales conclusions, le dernier rapport sur la sécurité Internet basé sur des données du quatrième trimestre 2023 révèle les éléments suivants : Une augmentation du nombre de logiciels malveillants évasifs, basiques et chiffrés, au quatrième trimestre 2023, qui a généré une hausse du nombre total de logiciels malveillants détectés. Le nombre moyen de détections de logiciels malveillants par les WatchGuard Firebox a augmenté de 80 % par rapport au trimestre précédent, ce qui illustre le volume important de menaces de logiciels malveillants parvenant au périmètre du réseau. Sur le plan géographique, la plupart des cas de logiciels malveillants ont touché le continent américain et la région Asie-Pacifique. Une augmentation des malwares de type TLS et " Zero-Day " : environ 55 % des logiciels malveillants transitent par le biais de connexions chiffrées, ce qui représente une augmentation de 7 % par rapport au troisième trimestre. Les détections de malwares de type " Zero-Day " ont atteint 60 % de l\'ensemble des détections de logiciels malveillants, contre 22 % au trimestre précédent. Toutefois, les détections de malwares de type " Zero-Day " par le biais du protocole TLS ont reculé pour atteindre 61 %, soit une baisse de 10 % par rapport au troisième trimestre, ce qui témoigne de l\'imprévisibilité des logiciels malveillants qui circulent. Redirection de deux des cinq principales variantes de logiciels malveillants vers le réseau DarkGate. Parmi les cinq détections de logiciels malveillants les plus répandues figurent JS.Agent.USF et Trojan.GenericKD.67408266. Les deux variantes redirigent les utilisateurs vers des | Ransomware Threat | ★★★ | |
|
2024-03-26 22:24:00 | Package NuGet malveillant lié à l'espionnage industriel cible les développeurs Malicious NuGet Package Linked to Industrial Espionage Targets Developers (lien direct) |
Les chasseurs de menaces ont identifié un ensemble suspect dans le & nbsp; Nuget Package Manager & NBSP; qui a probablement conçu pour cibler les développeurs travaillant avec des outils fabriqués par une entreprise chinoise spécialisée dans la fabrication d'équipements industriels et numériques.
Le package en question est & nbsp; sqzrframework480, qui inverselabs a déclaré a été publié pour la première fois le 24 janvier 2024. Il a été & nbsp; téléchargé & nbsp;
Threat hunters have identified a suspicious package in the NuGet package manager that\'s likely designed to target developers working with tools made by a Chinese firm that specializes in industrial- and digital equipment manufacturing. The package in question is SqzrFramework480, which ReversingLabs said was first published on January 24, 2024. It has been downloaded |
Tool Threat Industrial | ★★ | |
 |
2024-03-26 18:31:39 | Piratage d\'ENT : un papa raconte ! (lien direct) | Sécurité renforcée dans les académies suite à l'exploitation par des hackers malveillants d'Espaces Numériques de Travail (ENT). ZATAZ a rencontré un père dont le fils s'est retrouvé en garde à vue après que son compte ENT, piraté, a diffusé des menaces de mort !... | Threat | ★★ | |
|
2024-03-26 17:21:58 | L'IA et l'automatisation ont aidé les organisations à répondre aux incidents de sécurité jusqu'à 99% plus rapidement que l'année dernière, selon une nouvelle étude de Reliaquest AI and automation have helped organizations respond to security incidents up to 99% faster than last year, according to new study from ReliaQuest (lien direct) |
L'IA et l'automatisation ont aidé les organisations à répondre aux incidents de sécurité jusqu'à 99% plus rapidement que l'année dernière, selon une nouvelle étude de Reliaquest
Avec l'ingénierie sociale toujours la plus grande menace pour les organisations, l'IA est en train d'être exploitée des deux côtés pour augmenter la menace et la vitesse de défense;Organisations en train de tirer parti de l'IA et de l'automatisation peut répondre aux menaces dans les 7 minutes ou moins
-
rapports spéciaux
AI and automation have helped organizations respond to security incidents up to 99% faster than last year, according to new study from ReliaQuest With social engineering still the biggest threat to organizations, AI is being leveraged on both sides to increase the threat and the speed of defense; Organizations fully leveraging AI and automation can respond to threats within 7 minutes or less - Special Reports |
Threat Studies | ★★★ | |
|
2024-03-26 17:19:21 | Le rapport Keeper Security Insight révèle que les dirigeants informatiques ne sont pas préparés à la nouvelle vague de vecteurs de menace Keeper Security Insight Report reveals IT leaders are unprepared for the new wave of threat vectors (lien direct) |
Le rapport sur la sécurité du gardien révèle que les dirigeants informatiques ne sont pas préparés à la nouvelle vague de vecteurs de menace
-
rapports spéciaux
Keeper Security Insight Report reveals IT leaders are unprepared for the new wave of threat vectors - Special Reports |
Threat | ★★ | |
 |
2024-03-26 17:11:47 | Campagne à grande échelle de Strelaslateal au début de 2024 Large-Scale StrelaStealer Campaign in Early 2024 (lien direct) |
#### Description
Strelastealer est un logiciel malveillant qui cible les clients de messagerie pour voler des données de connexion, en l'envoyant au serveur de l'attaquant \\ pour des attaques potentielles supplémentaires.Depuis l'émergence de Strelaslealer \\ en 2022, l'acteur de menace a lancé plusieurs campagnes de messagerie à grande échelle, ses dernières campagnes ayant un impact sur 100 organisations à travers l'UE et les attaquants américains ont ciblé des organisations dans une variété d'industries, mais des organisations dans laL'industrie de la haute technologie a été la plus grande cible.L'analyse technique de Strelaslaster révèle une chaîne d'infection en évolution utilisant des pièces jointes ZIP, des fichiers JScript et des charges utiles de DLL mises à jour, démontrant l'adaptabilité du malware \\ et le défi qu'il pose aux analystes et produits de sécurité.
#### URL de référence (s)
1. https: // Unit42.paloaltonetworks.com/strelastealer-campage/
#### Date de publication
22 mars 2024
#### Auteurs)
Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhapurwal, Anmol Maurya et Vishwa Thothathri
#### Description StrelaStealer is a malware that targets email clients to steal login data, sending it to the attacker\'s server for potential further attacks. Since StrelaStealer\'s emergence in 2022, the threat actor has launched multiple large-scale email campaigns, with its most recent campaigns impacting over 100 organizations across the EU and U.S. Attackers have targeted organizations in a variety of industries, but organizations in the high tech industry have been the biggest target. Technical analysis of StrelaStealer reveals an evolving infection chain using ZIP attachments, JScript files, and updated DLL payloads, demonstrating the malware\'s adaptability and the challenge it poses to security analysts and products. #### Reference URL(s) 1. https://unit42.paloaltonetworks.com/strelastealer-campaign/ #### Publication Date March 22, 2024 #### Author(s) Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya, and Vishwa Thothathri |
Malware Threat Technical | ★★ | |
|
2024-03-26 16:42:12 | Les cyberattaques sont plus sophistiquées que jamais, les attaques basées sur l\'IA représentant le plus grand risque (lien direct) | Les cyberattaques sont plus sophistiquées que jamais, les attaques basées sur l'IA représentant le plus grand risque Le rapport Keeper Security Insight révèle que les responsables IT ne sont pas préparés à la nouvelle vague de vecteurs de menaces. - Investigations | Threat | ★★ | |
|
2024-03-26 15:13:15 | Patch maintenant: bug critique de Fortinet RCE sous attaque active Patch Now: Critical Fortinet RCE Bug Under Active Attack (lien direct) |
Un exploit de preuve de concept publié la semaine dernière a suscité des attaques contre la vulnérabilité, que la CISA a signalée en tant que priorité urgente de patch.
A proof-of-concept exploit released last week has spurred attacks on the vulnerability, which the CISA has flagged as an urgent patch priority. |
Vulnerability Threat | ★★ | |
|
2024-03-26 14:51:32 | Les pirates exploitent le framework Ray Flaw pour violer les serveurs, les ressources de détournement Hackers exploit Ray framework flaw to breach servers, hijack resources (lien direct) |
Une nouvelle campagne de piratage surnommée "ShadowRay" cible une vulnérabilité non corrigée dans Ray, un cadre d'IA à source ouverte populaire, pour détourner la puissance de calcul et divulguer des données sensibles de milliers d'entreprises.[...]
A new hacking campaign dubbed "ShadowRay" targets an unpatched vulnerability in Ray, a popular open-source AI framework, to hijack computing power and leak sensitive data from thousands of companies. [...] |
Vulnerability Threat | ★★ | |
 |
2024-03-26 14:39:15 | Alerte de menace: les conséquences de la violation Anydesk Threat Alert: The Anydesk Breach Aftermath (lien direct) |
Cybearason Problèmes de menace Alertes pour informer les clients de l'émergence des menaces impactantes, y compris les vulnérabilités critiques.Les alertes de menaces de cyberéasie résument ces menaces et fournissent des recommandations pratiques pour se protéger contre elles.
Cybereason issues Threat Alerts to inform customers of emerging impacting threats, including critical vulnerabilities. Cybereason Threat Alerts summarize these threats and provide practical recommendations for protecting against them. |
Vulnerability Threat | ★★★ | |
 |
2024-03-26 13:00:38 | La nouvelle vulnérabilité GoFetch dans les puces M d'Apple \\ permet une fuite de clés secrètes sur des ordinateurs compromis New GoFetch Vulnerability in Apple\\'s M Chips Allows Secret Keys Leak on Compromised Computers (lien direct) |
La vulnérabilité GoFetch, qui affecte la série de puces M d'Apple \\, permet à un attaquant de voler des clés secrètes du Mac dans certaines conditions.Lisez des conseils sur l'atténuation de la menace de sécurité de GoFetch.
The GoFetch vulnerability, which affects Apple\'s M series of chips, allows an attacker to steal secret keys from the Mac under certain conditions. Read tips on mitigating the GoFetch security threat. |
Vulnerability Threat | ★★ | |
 |
2024-03-26 11:08:16 | Sur les systèmes de vote sécurisés On Secure Voting Systems (lien direct) |
Andrew Appel Shepherd a Commentaire public & # 8212; Signé par vingt experts en cybersécurité électorale, y compris moi-même & # 8212; sur les meilleures pratiques pour les appareils de marquage des bulletins de vote et la tabulation de vote.Il a été écrit pour la législature de Pennsylvanie, mais il est de nature générale. .
du résumé de l'exécutif:
Nous pensons qu'aucun système n'est parfait, chacun ayant des compromis.Les bulletins de vote à la main et à la main enlèvent l'incertitude introduite par l'utilisation de machines électroniques et la capacité des mauvais acteurs à exploiter les vulnérabilités électroniques pour modifier à distance les résultats.Cependant, une partie des électeurs marquent à tort les bulletins de vote en papier d'une manière qui ne sera pas comptée dans la façon dont l'électeur voulait, ou qui annule même le bulletin de vote.Les comptages à main retardent la déclaration en temps opportun des résultats et introduisent la possibilité d'erreur humaine, de biais ou d'interprétation erronée ...
Andrew Appel shepherded a public comment—signed by twenty election cybersecurity experts, including myself—on best practices for ballot marking devices and vote tabulation. It was written for the Pennsylvania legislature, but it’s general in nature. From the executive summary: We believe that no system is perfect, with each having trade-offs. Hand-marked and hand-counted ballots remove the uncertainty introduced by use of electronic machinery and the ability of bad actors to exploit electronic vulnerabilities to remotely alter the results. However, some portion of voters mistakenly mark paper ballots in a manner that will not be counted in the way the voter intended, or which even voids the ballot. Hand-counts delay timely reporting of results, and introduce the possibility for human error, bias, or misinterpretation... |
Vulnerability Threat | ★★★ | |
|
2024-03-26 10:00:00 | L'importance croissante du CAASM dans la stratégie de cybersécurité de l'entreprise The Growing Importance of CAASM in Company Cybersecurity Strategy (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. The recent years\' events, including the proliferation of ransomware, the pandemic, and political tensions, have fast-tracked the development of both offensive and defensive tools in the cyber domain. Cybersecurity concepts that were nascent a few years ago are now being refined, demonstrating the practical benefits of modern digital risk management strategies. Gartner analysts have highlighted the expansion of the attack surface as a significant risk for corporate cyber environments in the upcoming years. The most vulnerable entities include IoT devices, cloud apps, open-source systems, and complex software supply chains. There is an increasing demand for concepts like Cyber Asset Attack Surface Management (CAASM), External Attack Surface Management (EASM), and Cloud Security Posture Management (CSPM) in corporate security frameworks. This trend is also documented in Gartner\'s "hype" chart. Let\'s discuss the concept of CAASM, which is centered on identifying and managing all digital assets within an organization, whether they are internal or external. This approach aims to provide a comprehensive view and control over the organization\'s cyber environment, enhancing security measures and management practices. What Is CAASM CAASM assists IT departments in achieving end-to-end visibility of a company\'s cyber assets. This strategy creates a fuller understanding of the actual state of the infrastructure, enabling the security team to respond promptly to existing threats and potential future ones. CAASM-based products and solutions integrate with a broad array of data sources and security tools. CAASM gathers and aggregates data and analyzes perimeter traffic, providing a continuous, multi-dimensional view of the entire attack surface. Having access to current asset data enables information security officers to visualize the infrastructure and address security gaps promptly. They can prioritize the protection of assets and develop a unified perspective on the organization\'s actual security posture. This sets the stage for proactive risk management strategies. Exploring CAASM\'s Core Functions The CAASM approach equips security professionals with a variety of tools necessary for effectively managing an organization\'s attack surface and addressing risks. Asset Discovery A lack of visibility into all of an organization\'s assets heightens the risk of cyberattacks. Cyber Asset Attack Surface Management products automatically detect and catalog every component of a company\'s digital infrastructure, encompassing local, cloud, and various remote systems, including shadow IT. A company employing CAASM gains a clear overview of all its deployed web applications, servers, network devices, and cloud services. CAASM facilitates a comprehensive inventory of the devices, applications, networks, and users constituting the company\'s attack surface. Vulnerability Detection It is important to understand the risks each asset poses, such as missing the latest security updates or opportunities to access sensitive data. CAASM systems integrate asset data, helping security teams identify misconfigurations, vulnerabilities, and oth | Ransomware Tool Vulnerability Threat Prediction Cloud | ★★★ | |
|
2024-03-26 07:00:00 | L'Afrique aborde les campagnes de désinformation en ligne au cours de l'année électorale majeure Africa Tackles Online Disinformation Campaigns During Major Election Year (lien direct) |
Les campagnes de cyber-disinformation ciblant l'Afrique ont décollé en 2024, alors que 18 nations se préparent à organiser des élections, et les efforts de cybersécurité sont essentiels pour apprivoiser la menace.
Cyber-disinformation campaigns targeting Africa have taken off in 2024, as 18 nations prepare to hold elections, and cybersecurity efforts are key to taming the threat. |
Threat | ★★ | |
 |
2024-03-26 06:00:09 | Proofpoint Discloses Technique Pivot by Attacker Group TA577: Targeting Windows NTLM (lien direct) | Proofpoint was the first to uncover a concerning new development in the world of cyberthreats that involves a group known as TA577. These cybercriminals, which typically act as initial access brokers (IAB), have pivoted to attacking an old, but widely deployed Windows service to steal sensitive information. Specifically, they aim to steal at scale the hash of the NT LAN Manager (NTLM) authentication session details. Then it is expected that they either sell the data, or they exploit it for various downstream activities like stealing sensitive data and ransoming systems. The planned end result is the same, a significant business-impacting breach of the targeted organizations. How did the new attack happen? Proofpoint detected two distinct email-based campaigns that TA577 carried out on February 26 and 27, 2024. The campaigns targeted hundreds of businesses globally via tens of thousands of emails. The attackers cleverly disguised the emails as replies to previous emails. This is an effective social engineering tactic known as thread hijacking. The emails contained HTML attachments compressed into zip files. Each malicious attachment had its own unique identifier. And the HTML files contained within the attachment were customized for each recipient. Because all the hashes were unique, a simple signature-based detection system could not consistently detect and block these emails. When the email recipient opened the files, it triggered a connection to a Server Message Block (SMB) server that the threat actor controlled. No malware was directly delivered through these connections. However, the attackers\' objective was clear-to capture the details of the challenge/response transaction and the NTLM hashes of the user\'s Windows machine, which include the user\'s password authentication data. The attackers can use this data in the next stage of the attack either in hash form or by cracking the hash first to retrieve the password. Note: In this case, the use of multifactor authentication (MFA) would not stop the attack, as TA577 targeted previously authenticated users on active Windows machines. If targeted businesses used MFA, that authentication step would have already occurred; thus, it would not significantly hinder this attack. What was the attackers\' intent? As noted earlier, TA577 usually acts as an IAB. So, the group likely aimed to exploit the data that they collected by cracking password hashes or facilitating “pass-the-hash” attacks. They could sell access to other threat actors who seek to penetrate targeted companies\' networks more deeply. As part of our investigation, Proofpoint identified the use of a well-known toolkit, Impacket, on the SMB servers involved in the attack. This discovery further confirmed that the malicious intent behind TA577\'s activities is to go well beyond the initial account or system compromise. What is especially concerning about this attack approach is that any connection to the SMB servers would compromise sensitive information that includes: Usernames Passwords Session hashes Domain names Computer names More troubling is the fact that the attackers delivered the malicious HTML files within zip archives. That means they bypassed measures in Outlook mail clients last patched before July 2023. If your email security provider did not block the inbound email and a user engaged with the message, your last hope to avoid the compromise is the timeliness of your software patching program. The impacts on businesses This attack is based on an old protocol (NTLM) from the 1990s. But this new twist by TA577 is noteworthy because it represents a departure from the group\'s usual tactics of delivering malware and bots directly. It suggests that the group is adapting and evolving. They are seeking new ways to bypass security measures and monetize their campaigns. This cyberthreat poses a significant risk to businesses that run Microsoft Windows. Through the theft of NTLM authenti | Malware Threat Patching | ★★★ | |
|
2024-03-26 06:00:09 | ProofPoint révèle la technique PIVOT par un groupe d'attaquant TA577: Cibler Windows NTLM Proofpoint Discloses Technique Pivot by Attacker Group TA577: Targeting Windows NTLM (lien direct) |
Proofpoint was the first to uncover a concerning new development in the world of cyberthreats that involves a group known as TA577. These cybercriminals, which typically act as initial access brokers (IAB), have pivoted to attacking an old, but widely deployed Windows service to steal sensitive information. Specifically, they aim to steal at scale the hash of the NT LAN Manager (NTLM) authentication session details. Then it is expected that they either sell the data, or they exploit it for various downstream activities like stealing sensitive data and ransoming systems. The planned end result is the same, a significant business-impacting breach of the targeted organizations. How did the new attack happen? Proofpoint detected two distinct email-based campaigns that TA577 carried out on February 26 and 27, 2024. The campaigns targeted hundreds of businesses globally via tens of thousands of emails. The attackers cleverly disguised the emails as replies to previous emails. This is an effective social engineering tactic known as thread hijacking. The emails contained HTML attachments compressed into zip files. Each malicious attachment had its own unique identifier. And the HTML files contained within the attachment were customized for each recipient. Because all the hashes were unique, a simple signature-based detection system could not consistently detect and block these emails. When the email recipient opened the files, it triggered a connection to a Server Message Block (SMB) server that the threat actor controlled. No malware was directly delivered through these connections. However, the attackers\' objective was clear-to capture the details of the challenge/response transaction and the NTLM hashes of the user\'s Windows machine, which include the user\'s password authentication data. The attackers can use this data in the next stage of the attack either in hash form or by cracking the hash first to retrieve the password. Note: In this case, the use of multifactor authentication (MFA) would not stop the attack, as TA577 targeted previously authenticated users on active Windows machines. If targeted businesses used MFA, that authentication step would have already occurred; thus, it would not significantly hinder this attack. What was the attackers\' intent? As noted earlier, TA577 usually acts as an IAB. So, the group likely aimed to exploit the data that they collected by cracking password hashes or facilitating “pass-the-hash” attacks. They could sell access to other threat actors who seek to penetrate targeted companies\' networks more deeply. As part of our investigation, Proofpoint identified the use of a well-known toolkit, Impacket, on the SMB servers involved in the attack. This discovery further confirmed that the malicious intent behind TA577\'s activities is to go well beyond the initial account or system compromise. What is especially concerning about this attack approach is that any connection to the SMB servers would compromise sensitive information that includes: Usernames Passwords Session hashes Domain names Computer names More troubling is the fact that the attackers delivered the malicious HTML files within zip archives. That means they bypassed measures in Outlook mail clients last patched before July 2023. If your email security provider did not block the inbound email and a user engaged with the message, your last hope to avoid the compromise is the timeliness of your software patching program. The impacts on businesses This attack is based on an old protocol (NTLM) from the 1990s. But this new twist by TA577 is noteworthy because it represents a departure from the group\'s usual tactics of delivering malware and bots directly. It suggests that the group is adapting and evolving. They are seeking new ways to bypass security measures and monetize their campaigns. This cyberthreat poses a significant risk to businesses that run Microsoft Windows. Through the theft of NTLM authenti | Malware Threat Patching | ★★★ | |
|
2024-03-25 23:00:00 | Éric Leblond, Stamus Networks : Le NDR est un outil incourtanble (lien direct) | Lors du Forum InCyber, Stamus Networks présentera Stamus Security Platform(SSP) une solution NDR qui utilise une inspection approfondie des paquets pour découvrir les menaces graves et les activités non autorisées qui se cachent dans les réseaux de nos entreprises clientes. Éric Leblond, Chief Technology Officer (CTO) de Stamus Networks estime que le NDR est un outil incourtanble. Global Security Mag : Quelle sera votre actualité lors du Forum InCyber 2024 ? Éric Leblond : Bien que (...) - Interviews / evenement_milieu, INCYBER 2024 | Threat | ★★ | |
|
2024-03-25 21:20:40 | Des pirates chinois parrainés par l'État chargés, des sanctions perçues par nous Chinese State-Sponsored Hackers Charged, Sanctions Levied by US (lien direct) |
Les États-Unis et le Royaume-Uni facturent à sept ressortissants chinois pour avoir fonctionné dans le cadre du groupe de menaces APT31.
The US and the UK charge seven Chinese nationals for operating as part of threat group APT31. |
Threat | APT 31 | ★★★ |
|
2024-03-25 17:28:00 | Hackers Hijack Github Comptes dans l'attaque de la chaîne d'approvisionnement affectant Top -g et autres Hackers Hijack GitHub Accounts in Supply Chain Attack Affecting Top-gg and Others (lien direct) |
Les adversaires non identifiés ont orchestré une campagne d'attaque sophistiquée qui a eu un impact sur plusieurs développeurs individuels ainsi que le compte de l'organisation GitHub associé à TOP.GG, un site de découverte de bot Discord.
"Les acteurs de la menace ont utilisé plusieurs TTPs dans cette attaque, y compris le rachat de compte via des cookies de navigateur volés, contribuant du code malveillant avec des commits vérifiés, en configurant une coutume
Unidentified adversaries orchestrated a sophisticated attack campaign that has impacted several individual developers as well as the GitHub organization account associated with Top.gg, a Discord bot discovery site. "The threat actors used multiple TTPs in this attack, including account takeover via stolen browser cookies, contributing malicious code with verified commits, setting up a custom |
Threat | ★★★ | |
|
2024-03-25 17:07:00 | Leçon clé du piratage de pulvérisation de mot de passe de Microsoft \\: sécuriser chaque compte Key Lesson from Microsoft\\'s Password Spray Hack: Secure Every Account (lien direct) |
En janvier 2024, Microsoft a découvert qu'ils étaient les & nbsp; victime d'un hack & nbsp; orchestré par des pirates de blizzard de Midnight à l'état russe (parfois connu sous le nom de Nobelium).Le détail préoccupant de cette affaire est la facilité avec laquelle il était facile de violer le géant du logiciel.Ce n'était pas un hack hautement technique qui a exploité une vulnérabilité zéro-jour & # 8211;Les pirates ont utilisé une simple attaque par pulvérisation de mot de passe pour prendre le contrôle de
In January 2024, Microsoft discovered they\'d been the victim of a hack orchestrated by Russian-state hackers Midnight Blizzard (sometimes known as Nobelium). The concerning detail about this case is how easy it was to breach the software giant. It wasn\'t a highly technical hack that exploited a zero-day vulnerability – the hackers used a simple password spray attack to take control of |
Hack Vulnerability Threat Technical | ★★ | |
 |
2024-03-25 17:00:00 | Statistiques de Netkope Threat Labs pour février 2024 Netskope Threat Labs Stats for February 2024 (lien direct) |
> Netskope Threat Labs publie un article de blog de résumé mensuel des principales menaces que nous suivons sur la plate-forme NetSkope.Cet article vise à fournir une intelligence stratégique et exploitable sur les menaces actives contre les utilisateurs d'entreprise du monde entier.Résumé OneDrive et Github étaient en haut de la liste des applications cloud top utilisées pour les téléchargements de logiciels malveillants, montrant un [& # 8230;]
>Netskope Threat Labs publishes a monthly summary blog post of the top threats we track on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. Summary OneDrive and GitHub were on the top of the list of top cloud apps used for malware downloads, showing a […] |
Malware Threat Cloud | ★★ | |
 |
2024-03-25 15:49:15 | Venant dans une ville près de chez vous, il est rouge que Red Canary en direct! Coming to a city near you, it\\'s Red Canary Live! (lien direct) |
Rejoignez-nous en personne pour apprendre à comprendre, détecter et répondre aux menaces identifiées dans notre sixième rapport annuel de détection des menaces.
Join us in person to learn how to understand, detect, and respond to threats identified in our sixth annual Threat Detection Report. |
Threat | ★★ | |
 |
2024-03-25 14:56:27 | 25 mars & # 8211;Rapport de renseignement sur les menaces 25th March – Threat Intelligence Report (lien direct) |
> Pour les dernières découvertes de cyber-recherche pour la semaine du 25 mars, veuillez télécharger notre bulletin de menace_ingence.Les principales attaques et violations la société de technologie japonaise Fujitsu ont découvert des logiciels malveillants sur ses ordinateurs de travail, risquant l'exposition des données des clients.La société, une société informatique de premier plan, a détecté un accès non autorisé qui a potentiellement permis aux informations personnelles et clients d'être [& # 8230;]
>For the latest discoveries in cyber research for the week of 25th March, please download our Threat_Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese tech company Fujitsu discovered malware on its work computers, risking exposure of customer data. The company, a leading IT firm, detected unauthorized access that potentially allowed personal and customer information to be […] |
Malware Threat | ★★ | |
|
2024-03-25 13:28:48 | Faits saillants hebdomadaires, 25 mars 2024 Weekly OSINT Highlights, 25 March 2024 (lien direct) |
La semaine dernière, les rapports OSINT de \\ présentent une gamme de cyber-menaces, des campagnes d'espionnage parrainées par l'État russe par Secret Blizzard à l'infosteller malware comme Formbook et le lecteur Adobe Infosaler, démontrant l'adaptabilité et la persistance entre les acteurs de la menace.Des tactiques trompeuses telles que la typosquat et la distribution de faux logiciels sont utilisées pour le camouflage des activités et ciblent des groupes d'utilisateurs spécifiques, comme on le voit dans le cas du ciblage chinois des moteurs de recherche.De plus, le malvertising basé sur la recherche, notamment avec le malware FakeBat, met en évidence l'abus de sites Web légitimes et de certificats numériques pour échapper aux mesures de sécurité.Dans l'ensemble, ces tendances soulignent la nécessité de mesures de cybersécurité robustes et de l'intelligence continue des menaces pour atténuer efficacement les menaces en évolution. 1. ** [Campagne d'espionnage de Turla] (https://security.microsoft.com/intel-explorer/articles/bf6723e9?): ** Le groupe d'espionnage russe Turla, également connu sous le nom de Blizzard secret par Microsoft, orchestraciblant une ONG européenne, employant des tactiques comme le vol d'information et l'infiltration du réseau.Les activités post-compromises de Turla \\ impliquent le déploiement d'implants comme Tinyturla-ng et la reconnaissance de la reconnaissance, la démonstration de persistance et de furtivité dans leurs opérations. 2. ** [Linux Server RCE Attack] (https://security.microsoft.com/intel-explorer/articles/9b8f807f?): ** Cybereason Security Services rapporte un incident impliquant un serveur Linux exploité via une exécution de code distante (RCE) Vulnérabilité dans Apache ActiveMQ, facilitant le déploiement de VADes charges utiles malveillantes comme Mirai Botnet, Hellokitty Ransomware et Coinminers.Attaquer les méthodologiesClude l'automatisation et les séances interactives via les coquilles inversées de Netcat, mettant en évidence le divers arsenal des acteurs de la menace et leurs tactiques adaptables. 3. ** [Formbook InfoSteller Malware] (https://security.microsoft.com/intel-explorer/articles/7b321c6c?): ** Formbook, un logiciel malveillant infoséaler, présente des capacités avancées comme le suivi de la touche et la capture de l'écran, pendant l'évasion de l'évasion, comme le suivi des touches de touche et la capture d'écran, pendant l'évadisation, toutDétection par des techniques d'obscurcissement et de chiffrement.Les cybercriminels distribuent Formbook par courrier électronique, avec des cas d'utilisation notés lors des conflits géopolitiques, soulignant sa flexibilité et sa menace persistante. 4. ** [Ciblage de moteurs de recherche chinois] (https://security.microsoft.com/intel-explorer/articles/5a806c77?): ** Kaspersky découvre une menace ciblant les utilisateurs chinois via des versions modifiées de rédacteurs de texte populaires distribués via le type typosquattinget d'autres techniques trompeuses, soulignant les acteurs de la menace \\ 'efforts pour imiter les ressources légitimes à des fins malveillantes. 5. ** [Phantomblu Malware Campaign] (https://security.microsoft.com/intel-explorer/articles/356f4d44?): ** Perception Point révèle la campagne Phantomblu ciblant les organisations américaines avec le rat Netsupport, l'utilisation de la campagne avancée AdvanceLes tactiques d'évasion comme la manipulation des modèles OLE et l'ingénierie sociale pour compromettre efficacement les systèmes, présentant une évolution des stratégies de livraison de logiciels malveillants mélangeant l'évasion et l'ingénierie sociale. 6. ** [Surge malvertising basé sur la recherche] (https://security.microsoft.com/intel-explorer/articles/7cc81ecb?): ** MalwareBytes rapporte une augmentation des incidents malvertisons basés sur la recherche, impliquant notamment le malware FakeBat malveillant FakeBat.Distribué par le biais des installateurs de MSIX avec le code PowerShell obsc | Ransomware Spam Malware Tool Vulnerability Threat | ★★★ | |
|
2024-03-25 13:07:00 | Muddywater lié à l'Iran déploie Atera pour la surveillance dans les attaques de phishing Iran-Linked MuddyWater Deploys Atera for Surveillance in Phishing Attacks (lien direct) |
L'acteur de menace affilié à l'Iran a suivi comme & nbsp; muddywater & nbsp; (aka mango sandstorm ou TA450) a été lié à une nouvelle campagne de phishing en mars 2024 qui vise à fournir une solution de surveillance et de gestion à distance légitime (RMM) appelée Atera.
L'activité, qui a eu lieu du 7 mars à la semaine du 11 mars, a ciblé des entités israéliennes couvrant la fabrication mondiale, la technologie et
The Iran-affiliated threat actor tracked as MuddyWater (aka Mango Sandstorm or TA450) has been linked to a new phishing campaign in March 2024 that aims to deliver a legitimate Remote Monitoring and Management (RMM) solution called Atera. The activity, which took place from March 7 through the week of March 11, targeted Israeli entities spanning global manufacturing, technology, and |
Threat | ★★ | |
 |
2024-03-25 12:00:00 | Les cyberattaques conscientes du nuage augmentent 110% alors que les groupes de menaces aiguisent leurs compétences d'attaque Cloud-Conscious Cyber Attacks Spike 110% as Threat Groups Sharpen their Attack Skills (lien direct) |
Les nouvelles données montrent une expertise accrue dans la mise en œuvre et l'exploitation des environnements cloud.
New data shows increased expertise in leveraging and exploiting cloud environments. |
Threat Cloud | ★★★ | |
|
2024-03-25 10:00:00 | Décodage des implications de cybersécurité de l'avancement rapide de l'AI \\ Decoding the Cybersecurity Implications of AI\\'s Rapid Advancement (lien direct) |
The genius at the heart of AI—its ability to sift through mountains of data, actually spot a needle in a haystack, and act on threats before they blossom into full-scale emergencies—it’s undeniable. However, here’s the rub—every part of that impressive arsenal? It’s also up for grabs by the other side, and can (and will) arm them to launch attacks of unprecedented sophistication and elusiveness, the likes of which we’ve thankfully never seen up to now. How do we wield this impressive technology to fortify our defenses, while preventing it from falling into the wrong hands? Can such a thing even be accomplished? Join me below as we take a closer look at how AI’s rapid rise is changing the landscape of cybersecurity. AI as a Defense Tool AI is a reliable navigator for charting the digital deluge—it has the ability to handle vast quantities of information rapidly on a level that no human could ever hope to match. It doesn’t take a huge leap to come to the conclusion that those capabilities can very easily be leveraged for defense. Automated Threat Detection Think of AI as the ever-watchful eye, tirelessly scanning the horizon for signs of trouble in the vast sea of data. Its capability to detect threats with speed and precision beyond human ken is our first line of defense against the shadows that lurk in the network traffic, camouflaged in ordinary user behavior, or embedded within the seemingly benign activities of countless applications. AI isn’t just about spotting trouble; it’s about understanding it. Through machine learning, it constructs models that learn from the DNA of malware, enabling it to recognize new variants that bear the hallmarks of known threats. This is akin to recognizing an enemy’s tactics, even if their strategy evolves. All of what I’ve said also here applies to incident response—with AI’s ability to automatically meet threats head-on making a holistic cybersecurity posture both easier to achieve and less resource-intensive for organizations of all sizes. Predictive Analytics By understanding the patterns and techniques used in previous breaches, AI models can predict where and how cybercriminals might strike next. This foresight enables organizations to reinforce their defenses before an attack occurs, transforming cybersecurity from a reactive discipline into a proactive strategy that helps prevent breaches rather than merely responding to them. The sophistication of predictive analytics lies in its use of diverse data sources, including threat intelligence feeds, anomaly detection reports, and global cybersecurity trends. This comprehensive view allows AI systems to identify correlations and causations that might elude human analysts. Phishing Detection and Email Filtering AI has stepped up as a pivotal ally in the ongoing skirmish against phishing and other forms of social engineering attacks, which too often lay the groundwork for more invasive security breaches. Through meticulous analysis of email content, context, and even the | Spam Tool Vulnerability Threat Prediction Technical | Deloitte | ★★ |
|
2024-03-25 06:58:00 | La démocratie de la Grande-Bretagne sous la menace des cyberattaquants chinois, avertit le gouvernement Britain\\'s democracy under threat from Chinese cyber attackers, government warns (lien direct) |
The genius at the heart of AI—its ability to sift through mountains of data, actually spot a needle in a haystack, and act on threats before they blossom into full-scale emergencies—it’s undeniable. However, here’s the rub—every part of that impressive arsenal? It’s also up for grabs by the other side, and can (and will) arm them to launch attacks of unprecedented sophistication and elusiveness, the likes of which we’ve thankfully never seen up to now. How do we wield this impressive technology to fortify our defenses, while preventing it from falling into the wrong hands? Can such a thing even be accomplished? Join me below as we take a closer look at how AI’s rapid rise is changing the landscape of cybersecurity. AI as a Defense Tool AI is a reliable navigator for charting the digital deluge—it has the ability to handle vast quantities of information rapidly on a level that no human could ever hope to match. It doesn’t take a huge leap to come to the conclusion that those capabilities can very easily be leveraged for defense. Automated Threat Detection Think of AI as the ever-watchful eye, tirelessly scanning the horizon for signs of trouble in the vast sea of data. Its capability to detect threats with speed and precision beyond human ken is our first line of defense against the shadows that lurk in the network traffic, camouflaged in ordinary user behavior, or embedded within the seemingly benign activities of countless applications. AI isn’t just about spotting trouble; it’s about understanding it. Through machine learning, it constructs models that learn from the DNA of malware, enabling it to recognize new variants that bear the hallmarks of known threats. This is akin to recognizing an enemy’s tactics, even if their strategy evolves. All of what I’ve said also here applies to incident response—with AI’s ability to automatically meet threats head-on making a holistic cybersecurity posture both easier to achieve and less resource-intensive for organizations of all sizes. Predictive Analytics By understanding the patterns and techniques used in previous breaches, AI models can predict where and how cybercriminals might strike next. This foresight enables organizations to reinforce their defenses before an attack occurs, transforming cybersecurity from a reactive discipline into a proactive strategy that helps prevent breaches rather than merely responding to them. The sophistication of predictive analytics lies in its use of diverse data sources, including threat intelligence feeds, anomaly detection reports, and global cybersecurity trends. This comprehensive view allows AI systems to identify correlations and causations that might elude human analysts. Phishing Detection and Email Filtering AI has stepped up as a pivotal ally in the ongoing skirmish against phishing and other forms of social engineering attacks, which too often lay the groundwork for more invasive security breaches. Through meticulous analysis of email content, context, and even the | Threat | ★★★ | |
|
2024-03-25 06:00:56 | DNS pendante: nettoyage de printemps pour protéger contre le risque d'identification Dangling DNS: Spring Cleaning to Protect Against Impersonation Risk (lien direct) |
It is well-established that email is the number one threat vector for cyberattacks. It\'s a go-to for many bad actors because they don\'t need to be highly skilled to initiate an email-based attack. Nor do they need to do elaborate work upfront. Their success hinges on their ability to be convincing. Targets must believe that they are interacting with a trusted source if they\'re going to voluntarily hand over sensitive data, provide their authentication credentials, make a wire transfer or install malware. That\'s why a critical part of any company\'s security posture is using protocols and policies that reduce impersonation risk. And a major step in this direction is to enable and enforce email authentication methods across all your domains. These include: Sender Policy Framework (SPF). This is a published authoritative list of approved sending IP addresses. It can help recipient email systems confirm that an email is coming from a legitimate source and is not impersonating a person or entity through spoofing. DomainKeys Identified Mail (DKIM). This email authentication method stamps a digital signature to outgoing emails. It helps recipient email systems verify, with proper alignment, that the email was sent by the domain it claims to be from and that it hasn\'t been altered in transit. Domain-based Message Authentication, Reporting, and Conformance (DMARC). This email authentication protocol builds on SPF and DKIM by allowing senders to set policies for handling emails that fail these authentication checks. If you don\'t maintain your systems, bad actors can exploit out-of-date information and nullify your email authentication efforts. In this blog, we will highlight a key bad actor impersonation tactic to inspire you to regularly spring clean your records moving forward. The tactic in focus: “dangling DNS” Dangling DNS refers to a misconfiguration in your email-related domain name system (DNS) records. A reference domain or subdomain is left pointing to a domain that no longer exists or is not under the control of the original domain owner. The term “dangling" implies that the DNS entry is pointing to something that is hanging without proper support. In this case, it is a domain that has expired. Bad actors have gotten wise to the fact that these expired domains create a crack in your defense that they can exploit. The risk of subdomain takeover If a subdomain is left pointing to an external service that the domain owner no longer controls, an attacker can register that domain to gain control of any DNS records that are pointed toward it. So, when they initiate their impersonation-based attack, they have the added benefit of passing email authentication! Using SPF records with all your sending infrastructure listed, rather than hidden behind an SPF macro, also discloses sensitive data about your company\'s infrastructure. Attackers can use this data to plan and execute targeted attacks. Actions you can take to reduce risk To mitigate the risks associated with dangling DNS records, domain owners must review their email-related DNS configurations regularly. It is especially important when you decommission or change services. Here are some actions that can help you to reduce your risk exposure. Regularly review and remove unused DNS records You should promptly remove DNS records that point to deprecated or unused services: SPF records. Review and minimize the entries that are posted within your SPF record. Review every “Include” and “Reference”, especially for third parties and expired domains, or if domains change owners. Access to SPF telemetry data can help simplify your investigations. DKIM selector records. Review CNAMEd DKIM selector records that point to third parties for expired domains, or if domains change owners. DMARC policy records. Review CNAMEd DMARC records that point to third parties for expired domains, or if domains change owners. MX records. Review MX records for your domains to see if any old entries are still inc | Malware Threat Cloud | ★★★ |
To see everything:
Our RSS (filtrered)
