What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-01-18 12:00:45 | Les logiciels malveillants exploitent 9HIT Malware Exploits 9Hits, Turns Docker Servers into Traffic Boosted Crypto Miners (lien direct) |
> Par deeba ahmed
9Hits, double coup: malware imite l'outil Web pour exploiter la crypto, générer un faux trafic de site Web.
Ceci est un article de HackRead.com Lire le post original: Les logiciels malveillants exploitent 9HITS, transforment les serveurs Docker en mineurs de cryptographie boostés du trafic
>By Deeba Ahmed 9Hits, Double Hit: Malware Mimics Web Tool to Mine Crypto, Generate Fake Website Traffic. This is a post from HackRead.com Read the original post: Malware Exploits 9Hits, Turns Docker Servers into Traffic Boosted Crypto Miners |
Malware Tool | ★★ | |
 |
2024-01-18 11:00:00 | Quatre tendances de cybersécurité que vous devriez connaître pour 2024 Four cybersecurity trends you should know for 2024 (lien direct) |
This is part three of a three-part series written by AT&T Cybersecurity evangelist Theresa Lanowitz. It’s intended to be future-looking, provocative, and encourage discussion. The author wants to assure you that no generative AI was used in any part of this blog. Part one: Unusual, thought-provoking predictions for cybersecurity in 2024 Part two: Cybersecurity operations in 2024: The SOC of the future While there are many big things to prepare for in 2024 (see first two posts), some important smaller things don’t get the same attention. Yet, these things are good to know and probably won’t come as a huge surprise. Because they, too, are evolving, it’s important not to take your eye off the ball. Compliance creates a new code of conduct and a new need for compliance logic. Compliance and governance are often overlooked when developing software because a different part of the business typically owns those responsibilities. That is all about to change. Cybersecurity policies (internal and external, including new regulations) need to move upstream in the software development lifecycle and need compliance logic built in to simplify the process. Software is designed to work globally; however, the world is becoming more segmented and parsed. Regulations are being created at country, regional, and municipal levels. To be realistic, the only way to handle compliance is via automation. To avoid the constant forking of software, compliance logic will need to be a part of modern applications. Compliance logic will allow software to function globally but adjust based on code sets that address geographic locations and corresponding regulations. In 2024, expect compliance logic to become a part of the larger conversation regarding compliance, governance, regulation, and policy. This will require cross-functional collaboration across IT, security, legal, line of business, finance, and other organizational stakeholders. MFA gets physical. Multi-factor authentication (MFA) is a way of life. The benefits far outweigh the slight inconvenience imposed. Think about why MFA is so critical. MFA helps with authorization and authentication for mission-critical and safety-critical work. It prevents unauthorized access to critical information. MFA is an easy-to-implement step for good cyber hygiene. Our current way of thinking about MFA is generally based on three things: something you know, a passcode; something you have, a device; and something you are, a fingerprint, your face, etc. Now, let’s take this a step further and look at how the something you are part of MFA can improve safety. Today, MFA routinely accepts fingerprints, facial recognition, or retina scans. That’s just the beginning. MFA can go a step further in helping with business outcomes; here’s how. Biometric and behavioral MFA can help with identifying the veracity of an individual as well as the fitness to perform a function. For example, a surgeon can access the hospital, restricted areas, and the operating room through MFA verifications. But, once in the operating room, how is it determined that the surgeon is fit to perform the surgical task? Behavioral MFA will soon be in play to ensure the surgeon is fit by adding another layer of something you are. Behavioral MFA will determine fitness for a task by identifying things such as entering a series of numbers on a keypad, handwriting on a tablet, or voice analysis. The goal is to compare current behavior with past behavior to ensur | Tool Threat Prediction | ★★★ | |
 |
2024-01-18 09:00:00 | Google: les pirates de FSB russes déploient de nouveaux logiciels malveillants SPICA Backdoor Google: Russian FSB hackers deploy new Spica backdoor malware (lien direct) |
Google dit que le groupe de piratage à dos russe Coldriver pousse des logiciels malveillants de porte dérobée auparavant inconnus en utilisant des charges utiles se faisant passer pour un outil de décryptage PDF.[...]
Google says the ColdRiver Russian-backed hacking group is pushing previously unknown backdoor malware using payloads masquerading as a PDF decryption tool. [...] |
Malware Tool | ★★ | |
 |
2024-01-18 05:00:52 | Mémoire de sécurité: TA866 revient avec une grande campagne de messagerie Security Brief: TA866 Returns with a Large Email Campaign (lien direct) |
What happened Proofpoint researchers identified the return of TA866 to email threat campaign data, after a nine-month absence. On January 11, 2024, Proofpoint blocked a large volume campaign consisting of several thousand emails targeting North America. Invoice-themed emails had attached PDFs with names such as “Document_[10 digits].pdf” and various subjects such as “Project achievements”. The PDFs contained OneDrive URLs that, if clicked, initiated a multi-step infection chain eventually leading to the malware payload, a variant of the WasabiSeed and Screenshotter custom toolset. Screenshot of an email with an attached PDF. If the user clicked on the OneDrive URL inside the PDF, they were: Served a JavaScript file hosted on OneDrive. The JavaScript, if run by the user, downloaded and ran an MSI file. The MSI file executed an embedded WasabiSeed VBS script. The WasabiSeed VBS script then downloaded and executed a second MSI file as well as continued polling for additional payloads in a loop. The additional payloads are currently unknown. Finally, the second MSI file contained components of the Screenshotter screenshot utility which took a screenshot of the desktop and sent it the C2. Attack chain summary: Email > PDF > OneDrive URL > JavaScript > MSI / VBS (WasabiSeed) > MSI (Screenshotter). The attack chain was similar to the last documented email campaign using this custom toolset observed by Proofpoint on March 20, 2023. The similarities helped with attribution. Specifically, TA571 spam service was similarly used, the WasabiSeed downloader remained almost the same, and the Screenshotter scripts and components remained almost the same. (Analyst Note: While Proofpoint did not initially associate the delivery TTPs with TA571 in our first publication on TA866, subsequent analysis attributed the malspam delivery of the 2023 campaigns to TA571, and subsequent post-exploitation activity to TA866.) One of the biggest changes in this campaign from the last observed activity was the use of a PDF attachment containing a OneDrive link, which was completely new. Previous campaigns used macro-enabled Publisher attachments or 404 TDS URLs directly in the email body. Screenshot of “TermServ.vbs” WasabiSeed script whose purpose is to execute an infinite loop, reaching out to C2 server and attempting to download and run an MSI file (empty lines were removed from this script for readability). Screenshot of “app.js”, one of the components of Screenshotter. This file runs “snap.exe”, a copy of legitimate IrfanView executable, (also included inside the MSI) to save a desktop screenshot as “gs.jpg”. Screenshot of “index.js”, another Screenshotter component. This code is responsible for uploading the desktop screenshot ”gs.jpg” to the C2 server. Attribution There are two threat actors involved in the observed campaign. Proofpoint tracks the distribution service used to deliver the malicious PDF as belonging to a threat actor known as TA571. TA571 is a spam distributor, and this actor sends high volume spam email campaigns to deliver and install a variety malware for their cybercriminal customers. Proofpoint tracks the post-exploitation tools, specifically the JavaScript, MSI with WasabiSeed components, and MSI with Screenshotter components as belonging to TA866. TA866 is a threat actor previously documented by Proofpoint and colleagues in [1][2] and [3]. TA866 is known to engage in both crimeware and cyberespionage activity. This specific campaign appears financially motivated. Proofpoint assesses that TA866 is an organized actor able to perform well thought-out attacks at scale based on their availability of custom tools, and ability and connections to purchase tools and services from other actors. Why it matters The following are notable characteristics of TA866\'s return to email threat data: TA866 email campaigns have been missing from the landscape for over nine months (although there are indications that the actor was meanwhile | Spam Malware Tool Threat | ★★ | |
|
2024-01-17 19:33:02 | L'outil Ishutdown de Kaspersky \\ détecte les logiciels espions Pegasus sur les appareils iOS Kaspersky\\'s iShutdown Tool Detects Pegasus Spyware on iOS Devices (lien direct) |
par waqas
Kaspersky a récemment lancé un outil appelé Ishutdown, conçu non seulement pour détecter le logiciel spymétrique de Pegasus notoire, mais aussi pour identifier d'autres menaces de logiciels malveillants sur les appareils iOS.
Ceci est un article de HackRead.com Lire la publication originale: L'outil Ishutdown de Kaspersky détecte les logiciels espions Pegasus sur les appareils iOS
By Waqas Kaspersky has recently launched a tool called iShutdown, designed not only to detect the notorious Pegasus spyware but also to identify other malware threats on iOS devices. This is a post from HackRead.com Read the original post: Kaspersky’s iShutdown Tool Detects Pegasus Spyware on iOS Devices |
Malware Tool | ★★★ | |
 |
2024-01-17 18:38:30 | DOE annonce un financement de 30 millions de dollars pour les outils de cybersécurité pour protéger les infrastructures d'énergie propre DOE announces $30 million funding for cybersecurity tools to protect clean energy infrastructure (lien direct) |
Le Bureau de la cybersécurité, de la sécurité énergétique et des interventions d'urgence (CESER) au sein du département américain de l'énergie (DOE) a ...
The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) within the U.S. Department of Energy (DOE) has... |
Tool Industrial | ★★★★ | |
 |
2024-01-17 08:19:01 | Gestion du travail collaboratif : l\'opportunisme guide l\'adoption (lien direct) | Le Magic Quadrant des outils de gestion du travail collaboratif dénote une tendance aux déploiements " tactiques ". Quels fournisseurs s'y distinguent ? | Tool Commercial | ★★★ | |
|
2024-01-17 06:00:02 | Comment mettre en place un programme de gestion des menaces d'initié et de prévention des pertes de données How to Set Up an Insider Threat Management and Data Loss Prevention Program (lien direct) |
This blog post is adapted from our e-book, Getting Started with DLP and ITM. The last few years have brought unprecedented change. An increasingly distributed workforce, access to more data through more channels and a shift to the cloud have transformed the nature of work. These trends have made protecting sensitive data more complicated and demanding. What\'s clear is that organizations are struggling to rise to the challenge. Between 2020 and 2022, insider threats increased by a staggering 44%. And the costs of addressing them increased 34%-from $11.45 million to $15.38 million. This upswing mainly comes down to two factors. For starters, most security teams have little visibility into people-caused data loss and insider-led security incidents. And few have the tools or resources to handle it. That\'s why Gartner sees platforms for data loss prevention and insider threat management (DLP and ITM) increasingly converging. Businesses need tools and processes that give them holistic, contextualized insights that take user behavior into account. It\'s no longer enough to focus on data-and where it\'s moving. To prevent data loss, industry leaders need to take a people-centric approach that expands beyond traditional drivers like compliance. In this blog post, we\'ll explore some basics for designing an ITM and DLP program. This can help you approach information protection in a way that\'s built for how modern organizations work. Why information protection is so challenging Risks are everywhere in today\'s complex landscape. Here are a few changes making it difficult for companies to protect their data. More data is open to exposure and theft. As businesses go digital, more data is being generated than ever before. According to IDC\'s Worldwide Global DataSphere Forecast, the total amount of data generated data will double from 2022 to 2026. That means malicious insiders will have more access to more sensitive data through more channels. It will also be easier for careless users to expose data inadvertently. Plus, any security gap between channels, any misconfiguration or any accidental sharing of files can give external attackers more opportunities to steal data. New data types are hard to detect. Data isn\'t just growing in volume. It\'s also becoming more diverse, which makes it harder to detect and control. With traditional DLP program tools, data typically fits within very tightly defined data patterns (such as payment card number). But even then, it generates too many false positives. Now, key business data is more diverse and can be graphical, tabular or even source code. The network security perimeter no longer exists. With more employees and contractors working remotely, the security perimeter has shifted from brick and mortar to one based on people. Add to the mix bring-your-own-device (BYOD) practices, where the personal and professional tend to get blurred, and security teams have even more risks to contend with. In a survey for the 2023 State of the Phish report from Proofpoint, 72% of respondents said they use one or more of their personal devices for work. Employee churn is high. Tech industry layoffs in 2022 and 2023 have seen many employees leaving and joining businesses at a rapid rate. The result is greater risk of data exfiltration, infiltration and sabotage. Security leaders know it, too-39% of chief information security officers rated improving information protection as the top priority over the next two years. Security talent is in short supply. A lack of talent has left many security teams under-resourced. And the situation is likely to get worse. In 2023, the cybersecurity workforce gap hit an all-time high-there are 4 million more jobs than there are skilled workers. DLP vs. ITM What\'s the difference between DLP and ITM? Both DLP and ITM work to prevent data loss. But they achieve it in different ways. DLP tracks data movement and exfiltration DLP monitors file activity and scans content to see whether users are handling sen | Tool Threat Cloud Technical | ★★ | |
 |
2024-01-16 16:30:00 | Un nouvel outil identifie Pegasus et d'autres logiciels espions iOS New Tool Identifies Pegasus and Other iOS Spyware (lien direct) |
Les experts de Kaspersky ont développé l'outil après avoir analysé Shutdown.log, un fichier de conservation des informations de redémarrage
Kaspersky experts developed the tool after analyzing Shutdown.log, a file retaining reboot information |
Tool | ★★★ | |
 |
2024-01-16 12:16:39 | Mise en œuvre de l'IA: équilibrer les objectifs commerciaux et les exigences de sécurité Implementing AI: Balancing Business Objectives and Security Requirements (lien direct) |
L'intelligence artificielle (IA) et l'apprentissage automatique sont devenus des outils intégrés pour les organisations dans diverses industries.Cependant, l'adoption réussie de ces technologies nécessite un équilibre minutieux entre les objectifs commerciaux et les exigences de sécurité.Je me suis assis avec Glenn Schmitz, le directeur de la sécurité de l'information du Département de la santé comportementale et des services de développement en Virginie, alors qu'il partageait des informations précieuses sur la mise en œuvre de l'IA tout en garantissant la sécurité, la sécurité et les considérations éthiques.Voici quelques-uns des principaux plats à retenir.
Comprendre les objectifs commerciaux et les exigences de sécurité commence par les fondamentaux
Lorsque Schmitz a rejoint l'organisation, il a reconnu la nécessité de comprendre le niveau global de maturité de la sécurité.En alignant les objectifs de l'entreprise sur les exigences de sécurité, il visait à permettre à l'entreprise d'atteindre ses objectifs de manière sûre et sécurisée.
Schmitz a partagé: "J'ai commencé à un niveau très fondamental. La sécurité est là pour protéger l'entreprise et…
Artificial Intelligence (AI) and machine learning have become integral tools for organizations across various industries. However, the successful adoption of these technologies requires a careful balance between business objectives and security requirements. I sat down with Glenn Schmitz, the Chief Information Security Officer of the Department of Behavioral Health and Developmental Services in Virginia, as he shared valuable insights on implementing AI while ensuring safety, security, and ethical considerations. Here are some of the key takeaways. Understanding Business Objectives and Security Requirements Starts with Fundamentals When Schmitz joined the organization, he recognized the need to understand the overall security maturity level. By aligning business objectives with security requirements, he aimed to enable the business to achieve its goals in a safe and secure manner. Schmitz shared: "I started at a very fundamental level. Security is here to protect the business and… |
Tool | ★★ | |
|
2024-01-16 11:14:05 | ChatGPT : OpenAI prépare des outils contre la désinformation électorale (lien direct) | Alors que 2024 sera une année d'élections majeures, notamment aux Etats-Unis ; OpenAI annonce le lancement de nouveaux outils pour prévenir les manipulations à des fins politiques provenant de ChatGPT et DALL-E. | Tool | ChatGPT | ★★★ |
|
2024-01-16 11:00:00 | Prédictions inhabituelles et stimulantes pour la cybersécurité en 2024 Unusual, thought-provoking predictions for cybersecurity in 2024 (lien direct) |
This is part one of a three-part series written by AT&T Cybersecurity evangelist Theresa Lanowitz. It’s intended to be future-looking and provocative and to encourage discussion. The author wants to assure you that no generative AI was used in any part of this blog. Entering 2024 brings us well into the third decade of the new millennium. Do you recall how tentatively and maybe naively we approached the year 2000, otherwise known as Y2K? We stressed over two bytes in COBOL programs and regression tested every line of code to ensure our systems were ready to go at midnight on January 1, 2000. The clock struck 12, and the world breathed a collective sigh of relief – we survived the predicted digital disaster. And just like that, off we went - to create web, mobile, and cloud apps, to turn embedded software into the Internet of Things (IoT), and to democratize computing in a way that was only a dream just 23 years ago. With massive shifts and changes in computing in the wake, it’s time to ask: where are we going in 2024, and what cybersecurity opportunities and challenges lie ahead? Maturing the industry: It’s the business that matters. Cybersecurity is not about fear, uncertainty, and doubt (FUD). It is about delivering business outcomes such as boarding a plane quicker to mitigate flight delay penalties, heating or cooling my house efficiently to manage energy consumption in various climates, or reducing waste in manufacturing to minimize product recalls. Notice there was no mention of security, data, network, coding, or anything remotely IT-centric or technical in the stated business outcomes above. We must aspire to this when thinking about our businesses and cybersecurity. It must be about the business first, advancing the customer experience, and removing friction. Cybersecurity is now a business requirement. For cybersecurity to be part of business planning, cybersecurity teams need to become members of the business teams. Over the past three years, the cybersecurity market has rapidly matured. We are in the midst of market consolidation, with individual point products being acquired and integrated into platform offerings. These platform offerings will continue to evolve by acquiring smaller vendors, partnering, and innovating. The platform vendors clearly see the need for cybersecurity to be a part of the business conversation and want to act as a business partner and trusted advisor, not merely a product provider. Cybersecurity budgets are changing, creating an approach to get funding differently. This year, our research revealed an unexpected change: money is being redistributed as computing moves closer to the data source. Our respondents reported they are investing in new computing development – in this case, edge computing - in a way that’s different from what we’ve seen in the past. They are proactively investing in strategy and planning, the network, application development, and security to create a balanced, collaborative ecosystem. The big surprise isn’t a new secret weapon or killer application. The surprise is what’s needed: a new way of thinking about resource allocation. You’ll still need your usual hardware, software, storage, and security buckets. How you balance those expenses is what’s different. As computing moves closer to the data source, every deployment should contribute to the b | Tool Mobile Prediction Cloud Technical | ★★★ | |
 |
2024-01-16 10:36:36 | Les outils de décryptage gratuits de Kaspersky ont été téléchargés 360 000 fois, aidant les victimes de ransomware à récupérer leurs données (lien direct) | >Les outils de déchiffrement de Kaspersky, développés dans le cadre de l’initiative No More Ransom et disponibles sur le portail dédié No Ransom, ont été téléchargés plus de 360 000 fois. Ces outils gratuits permettent aux victimes de ransomware de récupérer leurs données de manière rapide et efficace, soulignant l’importance des efforts de collaboration en […] The post Les outils de décryptage gratuits de Kaspersky ont été téléchargés 360 000 fois, aidant les victimes de ransomware à récupérer leurs données first appeared on UnderNews. | Ransomware Tool | ★★★ | |
|
2024-01-16 08:32:19 | Défense post-livraison à propulsion du cloud: la dernière innovation de Proofpoint \\ dans la protection des e-mails Cloud-Powered Post-Delivery Defense: Proofpoint\\'s Latest Innovation in Email Protection (lien direct) |
Cybercriminals are constantly innovating so that they can infiltrate your systems and steal your valuable data. They do this through a complex multi-stage method commonly known as the attack chain. During the initial compromise, attackers use advanced email threats like phishing scams, malware attachments, business email compromise (BEC) and QR code threats to get a foothold in your systems. That\'s why email security tools typically focus on stopping these threats. Steps in the attack chain. But no technology is foolproof. Inevitably, some emails will get through. To keep your company safe, you need an email security solution that can detect, analyze and remediate email threats post-delivery. That\'s where Proofpoint can help. Proofpoint Cloud Threat Response is the cloud-based alternative to TRAP (Threat Response Auto-Pull), known for its effective post-delivery remediation capabilities. Not only is this solution easy to use, but it also automates post-detection incident response and remediation tasks that slow down security teams. In this blog post, we\'ll highlight some of its capabilities and benefits. Overview of Cloud Threat Response capabilities Proofpoint Cloud Threat Response keeps you safer by remediating threats post-delivery. Plus, it helps security teams prioritize and execute response actions three different ways: Automatically by Proofpoint. Cloud Threat Response automatically analyzes emails post-delivery. It identifies and quarantines malicious emails within user inboxes. Doing so reduces the risk that users will interact with them, helping to prevent your business from being compromised. Manually by the SOC team. Your security team gains instant access to detailed email analysis, historical data and risk scoring through an integration with Proofpoint Smart Search. This integration makes it easier for you to delve into specific emails and swiftly identify and remove any lurking threats. With the assistance of end users. Users can report messages that look suspicious thanks to a simple button directly integrated into their mailboxes. Reported emails are automatically investigated and are neutralized if determined to be a threat. Proofpoint Cloud Threat Response benefits At many companies, security incident response is a slow and labor-intensive process. Responding to security incidents may take days or weeks depending on the size of your security team. Time-intensive tasks can turn into painful bottlenecks. Compare that to Proofpoint Cloud Threat Response, which automates and simplifies threat response tasks. Here\'s what you can expect: Enjoy a simplified management interface. Our centralized, modern interface simplifies how you manage email security. From this dashboard, you can manage a range of tasks, including threat reporting, threat analysis and user administration. The simplified, modern interface of Proofpoint Cloud Threat Response. Respond to incidents faster. Proofpoint Cloud Threat Response acts on intelligence from our Supernova detection engine, which improves threat detection and reduces the mean time to respond (MTTR). Spend less time on deployment and maintenance. Because it\'s cloud native, our platform is not only easy to deploy but it eliminates the need for on-premises infrastructure. Plus, your investment is future-proof, and it comes with automated maintenance and security updates. Streamline security operations. Use Single Sign-On (SSO) to seamlessly navigate between Cloud Threat Response and other Proofpoint apps such as Targeted Attack Protection, Email Fraud Defense and Email Protection. This helps to boost analyst efficiency and response times. See more threats. It automatically shares a threat\'s remediation status across your other Proofpoint platforms. This increases threat visibility and helps you to identify and neutralize threats faster. Proofpoint Cloud Threat Response is integrated with Proofpoint threat intelligence and abuse mailbox sources. Contain threats quickly. Malici | Malware Tool Threat Cloud | ★★ | |
 |
2024-01-15 23:35:41 | Ivanti Connect Secure VPN Exploitation devient global Ivanti Connect Secure VPN Exploitation Goes Global (lien direct) |
> Important: si votre organisation utilise Ivanti Connect Secure VPN et que vous n'avez pas appliqué l'atténuation, alors faites-le immédiatement!Les organisations doivent immédiatement examiner les résultats de l'outil de vérification d'intégrité intégré pour les entrées de journal indiquant des fichiers incompatibles ou nouveaux.À partir de la version 9.12, Ivanti a commencé à fournir un outil de vérificateur d'intégrité intégré qui peut être exécuté en tant que numérisation périodique ou planifiée.La volexité a observé qu'il a réussi à détecter les compromis décrits dans ce poste dans les organisations touchées.La semaine dernière, Ivanti a également publié une version mise à jour de l'outil de damier d'intégrité externe qui peut être utilisé pour vérifier et vérifier les systèmes.Le 10 janvier 2024, la volexité a partagé publiquement les détails des attaques ciblées par UTA00178 exploitant deux vulnérabilités de deux jours zéro (CVE-2024-21887 et CVE-2023-46805) dans les appareils VPN Ivanti Secure (ICS).Le même jour, Ivanti a publié une atténuation qui pourrait être appliquée aux appareils VPN ICS pour empêcher l'exploitation de ces [& # 8230;]
>Important: If your organization uses Ivanti Connect Secure VPN and you have not applied the mitigation, then please do that immediately! Organizations should immediately review the results of the built-in Integrity Check Tool for log entries indicating mismatched or new files. As of version 9.1R12, Ivanti started providing a built-in Integrity Checker Tool that can be run as a periodic or scheduled scan. Volexity has observed it successfully detecting the compromises described in this post across impacted organizations. Last week, Ivanti also released an updated version of the external Integrity Checker Tool that can be further used to check and verify systems. On January 10, 2024, Volexity publicly shared details of targeted attacks by UTA00178 exploiting two zero-day vulnerabilities (CVE-2024-21887 and CVE-2023-46805) in Ivanti Connect Secure (ICS) VPN appliances. On the same day, Ivanti published a mitigation that could be applied to ICS VPN appliances to prevent exploitation of these […] |
Tool Vulnerability Threat Industrial | ★★★ | |
|
2024-01-15 16:30:00 | L'outil basé sur Python FBOT perturbe la sécurité du cloud Python-Based Tool FBot Disrupts Cloud Security (lien direct) |
Découvert par l'équipe Sentinelabs, FBOT cible les serveurs Web, les services cloud et les plateformes SaaS
Discovered by the SentinelLabs team, FBot targets web servers, cloud services and SaaS platforms |
Tool Cloud | ★★ | |
 |
2024-01-15 13:59:00 | Watchdog de la vie privée du Royaume-Uni pour examiner la pratique du grattage Web pour obtenir des données de formation pour l'IA UK privacy watchdog to examine practice of web scraping to get training data for AI (lien direct) |
Le régulateur de protection des données de la Grande-Bretagne, le bureau du commissaire à l'information (ICO), examine la légalité du grattage Web pour collecter des données pour former des modèles d'IA génératifs.Il a annoncé lundi le Première consultation Dans une série se concentrant sur les modèles d'IA génératifs - les outils qui créent du texte ou des images basées sur une invite après avoir été formé sur
Britain\'s data protection regulator, the Information Commissioner\'s Office (ICO), is scrutinizing the legality of web scraping to collect data to train generative AI models. It announced on Monday the first consultation in a series focusing on generative AI models - the tools that create text or images based on a prompt after being trained on |
Tool | ★★★ | |
 |
2024-01-12 19:55:57 | Explorer FBOT |Des logiciels malveillants basés sur Python ciblant les services de cloud et de paiement Exploring FBot | Python-Based Malware Targeting Cloud and Payment Services (lien direct) |
#### Description
FBOT est un outil de piratage basé sur Python distinct des autres familles de logiciels malveillants cloud, ciblant les serveurs Web, les services cloud et les plateformes SaaS comme AWS, Office365, PayPal, SendGrid et Twilio.Les caractéristiques clés incluent la récolte des informations d'identification pour les attaques de spam, les outils de détournement de compte AWS et les fonctions pour permettre des attaques contre PayPal et divers comptes SaaS.
FBOT possède plusieurs fonctionnalités qui ciblent les services de paiement ainsi que les configurations SaaS.La fonction Validator PayPal valide l'état du compte PayPal en contactant une URL codée en dur avec une adresse e-mail lue à partir d'une liste de saisies.L'e-mail est ajouté à la demande de la section Détails du client pour valider si une adresse e-mail est associée à un compte PayPal.
#### URL de référence (s)
1. https://www.sentinelone.com/labs/exploring-fbot-python-basked-malware-targeting-cloud-and-payment-services/
#### Date de publication
11 janvier 2024
#### Auteurs)
Alex Delamotte
#### Description FBot is a Python-based hacking tool distinct from other cloud malware families, targeting web servers, cloud services, and SaaS platforms like AWS, Office365, PayPal, Sendgrid, and Twilio. Key features include credential harvesting for spamming attacks, AWS account hijacking tools, and functions to enable attacks against PayPal and various SaaS accounts. FBot has several features that target payment services as well as SaaS configurations. The PayPal Validator feature validates PayPal account status by contacting a hardcoded URL with an email address read from an input list. The email is added to the request in the customer details section to validate whether an email address is associated with a PayPal account. #### Reference URL(s) 1. https://www.sentinelone.com/labs/exploring-fbot-python-based-malware-targeting-cloud-and-payment-services/ #### Publication Date January 11, 2024 #### Author(s) Alex Delamotte |
Malware Tool Cloud | ★★ | |
 |
2024-01-12 13:16:14 | Sentinellabs: Exploration de FBOT & # 8211;Des logiciels malveillants basés sur Python ciblant les services de cloud et de paiement SentinelLabs: Exploring FBot – Python-Based Malware Targeting Cloud and Payment Services (lien direct) |
Explorer FBOT & # 8211;Des logiciels malveillants basés sur Python ciblant les services de cloud et de paiement
La scène des outils de piratage cloud est très liée, avec de nombreux outils qui se fondent sur le code de l'autre.Cela est particulièrement vrai pour les familles de logiciels malveillants comme Alienfox, Greenbot, Legion et Predator, qui partagent le code à partir d'un module de crampons des informations d'identification appelée AndroxGH0st.
-
mise à jour malveillant
Exploring FBot – Python-Based Malware Targeting Cloud and Payment Services The cloud hack tool scene is highly intertwined, with many tools relying on one another\'s code. This is particularly true for malware families like AlienFox, Greenbot, Legion, and Predator, which share code from a credential-scraping module called Androxgh0st. - Malware Update |
Malware Hack Tool Cloud | ★★★ | |
|
2024-01-12 06:00:17 | Déterministe vs détection de menace probabiliste: quelle est la différence? Deterministic vs. Probabilistic Threat Detection: What\\'s the Difference? (lien direct) |
When you understand the difference between deterministic and probabilistic threat detection, you can better choose the right mix of processes and tools that will keep your data, systems and users most secure. Here is a spoiler, though: As you compare probabilistic and deterministic methods, you will likely conclude that both approaches are needed to some degree. That means you\'re on the right track. When you employ both, you can use the strengths of each approach while mitigating their respective weaknesses. In other words, these methods are different but complementary. To help you figure out when to use each method, we put together this overview. In each section, we start by defining terms, and then we delve into the pros and cons of using the approach to detect threats. What is probabilistic threat detection? Probabilistic threat detection involves the use of probability-based analytic methods to identify potential security threats or malicious activities within a system. This approach doesn\'t rely on fixed (deterministic) rules or signatures alone. Instead, it relies on the likelihood-or probability-that certain behaviors or patterns may indicate the presence of a security threat. Tools for probabilistic threat detection analyze various factors and assign weights to different indicators. That helps cybersecurity systems-and security teams-to prioritize and respond to potential threats based on their perceived risk. This approach to threat detection presents advantages as well as challenges. Here\'s a look at some of the pros and cons of using probabilistic and deterministic detections. Pros Let\'s start with the pros of probabilistic threat detection. Adaptability to new threats. Probabilistic threat detection can help you identify new and evolving threats that may not have definitive signatures. Machine learning and behavioral analysis can adapt to changing attack tactics. Slight pivots in attacker tools and techniques won\'t necessarily fake out these detection techniques. Reduced false positives to unknown threats. Probabilistic methods may result in fewer false negatives for threats that have not been seen before. That\'s because these methods don\'t require a perfect match to a known signature to send an alert. Probabilistic methods are inherently non-binary. Behavioral analysis. This is often part of probabilistic threat detection. It typically uses a baseline of normal system behavior. That, in turn, makes it easier to detect deviations that may indicate a security threat. Continuous learning. Machine learning models for probabilistic threat detection can continuously learn, incorporate feedback from security analysts, and adapt to changes in the threat landscape. That means their accuracy is not static and can improve over time. Cons Now, here is a rundown of some cons. False positives. Probabilistic methods will produce false positives. They rely on statistical models that might interpret unusual but benign behavior as a potential threat. That can lead to alerts on activities that aren\'t malicious. Taken to extremes this can waste security analysts\' time. But making the models less sensitive can lead to false negatives. That\'s why tuning is part of ongoing maintenance. Complexity and resource intensiveness. Implementing and maintaining probabilistic threat detection systems can be complex and demand a lot of resources. That is especially true when it comes to systems that use machine learning because they require a great deal of computing power and expertise to operate. Cost issues. Probabilistic methods and tools deal with uncertainty, which is a key design principle. So they may not be as cost effective as deterministic approaches for detecting well-known threats. Difficulty in interpreting results. It can be a challenge to understand the output of probabilistic models. You may have difficulty discerning why a particular activity is flagged as a potential threat, as the rationale is deep within the model. To interpret the results, you | Malware Tool Vulnerability Threat | ★★ | |
|
2024-01-11 20:30:00 | La FCC presse les constructeurs automobiles, les fournisseurs sans fil pour protéger les survivants de la violence domestique contre les outils de traque FCC presses carmakers, wireless providers to protect domestic abuse survivors from stalking tools (lien direct) |
La Federal Communications Commission (FCC) exhorte les constructeurs automobiles et les prestataires sans fil à faire plus pour protéger les survivants de la violence domestique contre les outils de traque rendus les voitures connectées et la demande des détails de leurs pratiques de partage de données de localisation.Les voitures connectées sont maintenant chargées de capteurs et d'autres outils qui permettent le suivi de la géolocalisation en temps réel.A Rapport récent de Reuters révélé
The Federal Communications Commission (FCC) is urging automakers and wireless providers to do more to protect domestic abuse survivors from stalking tools enabled by connected cars and requesting the details of their location data-sharing practices. Connected cars are now loaded with sensors and other tools which allow real-time geolocation tracking. A recent Reuters report revealed |
Tool | ★★★ | |
 |
2024-01-11 19:30:00 | La nouvelle boîte à outils FBOT de piratage FBOT basée sur Python vise les plates-formes Cloud et SaaS New Python-based FBot Hacking Toolkit Aims at Cloud and SaaS Platforms (lien direct) |
Un nouvel outil de piratage basé sur Python appelé & nbsp; fbot & nbsp; a été découvert de ciblage des serveurs Web, des services cloud, des systèmes de gestion de contenu (CMS) et des plateformes SaaS telles que Amazon Web Services (AWS), Microsoft 365, PayPal, SendGrid et Twilio.
«Les caractéristiques clés incluent la récolte des informations d'identification pour les attaques de spam, les outils de détournement de compte AWS et les fonctions pour permettre des attaques contre PayPal et divers
A new Python-based hacking tool called FBot has been uncovered targeting web servers, cloud services, content management systems (CMS), and SaaS platforms such as Amazon Web Services (AWS), Microsoft 365, PayPal, Sendgrid, and Twilio. “Key features include credential harvesting for spamming attacks, AWS account hijacking tools, and functions to enable attacks against PayPal and various |
Tool Cloud | ★★★ | |
 |
2024-01-11 14:18:14 | MiraclePtr: protéger les utilisateurs contre les vulnérabilités sans utilisation sans plateformes MiraclePtr: protecting users from use-after-free vulnerabilities on more platforms (lien direct) |
Posted by Keishi Hattori, Sergei Glazunov, Bartek Nowierski on behalf of the MiraclePtr team
Welcome back to our latest update on MiraclePtr, our project to protect against use-after-free vulnerabilities in Google Chrome. If you need a refresher, you can read our previous blog post detailing MiraclePtr and its objectives.
More platforms
We are thrilled to announce that since our last update, we have successfully enabled MiraclePtr for more platforms and processes:
In June 2022, we enabled MiraclePtr for the browser process on Windows and Android.
In September 2022, we expanded its coverage to include all processes except renderer processes.
In June 2023, we enabled MiraclePtr for ChromeOS, macOS, and Linux.
Furthermore, we have changed security guidelines to downgrade MiraclePtr-protected issues by one severity level!
Evaluating Security Impact
First let\'s focus on its security impact. Our analysis is based on two primary information sources: incoming vulnerability reports and crash reports from user devices. Let\'s take a closer look at each of these sources and how they inform our understanding of MiraclePtr\'s effectiveness.
Bug reports
Chrome vulnerability reports come from various sources, such as:
Chrome Vulnerability Reward Program participants,
our fuzzing infrastructure,
internal and external teams investigating security incidents.
For the purposes of this analysis, we focus on vulnerabilities that affect platforms where MiraclePtr was enabled at the time the issues were reported. We also exclude bugs that occur inside a sandboxed renderer process. Since the initial launch of MiraclePtr in 2022, we have received 168 use-after-free reports matching our criteria.
What does the data tell us? MiraclePtr effectively mitigated 57% of these use-after-free vulnerabilities in privileged processes, exceeding our initial estimate of 50%. Reaching this level of effectiveness, however, required additional work. For instance, we not only rewrote class fields to use MiraclePtr, as discussed in the previous post, but also added MiraclePtr support for bound function arguments, such as Unretained pointers. These pointers have been a significant source of use-after-frees in Chrome, and the additional protection allowed us to mitigate 39 more issues.
Moreover, these vulnerability reports enable us to pinpoint areas needing improvement. We\'re actively working on adding support for select third-party libraries that have been a source of use-after-free bugs, as well as developing a more advanced rewriter tool that can handle transformations like converting std::vector into std::vector. We\'ve also made sever |
Tool Vulnerability Threat Mobile | ★★★ | |
 |
2024-01-11 13:55:59 | Explorer FBOT |Des logiciels malveillants basés sur Python ciblant les services de cloud et de paiement Exploring FBot | Python-Based Malware Targeting Cloud and Payment Services (lien direct) |
Les acteurs de la menace des armes FBOT avec un outil d'attaque multifonction conçu pour détourner le cloud, le SaaS et les services Web.
FBot arms threat actors with a multi-function attack tool designed to hijack cloud, Saas and web services. |
Malware Tool Threat Cloud | ★★ | |
|
2024-01-11 11:00:00 | Histoires du Soc: Blackcat sur le prouvoir Stories from the SOC: BlackCat on the prowl (lien direct) |
This blog was co-authored with Josue Gomez and Ofer Caspi.
Executive summary
BlackCat is and has been one of the more prolific malware strains in recent years. Believed to be the successor of REvil, which has links to operators in Russia, it first was observed in the wild back in 2021, according to researchers. BlackCat is written in the Rust language, which offers better performance and efficiencies than other languages previously used. BlackCat is indiscriminate in how it targets its victims, which range from healthcare to entertainment industries. This blog will cover a recent incident impacting one of the AT&T Managed Detection and Response (MDR) Security Operations Center SOC’s customers and discuss how in partnering with AT&T Alien Labs, the MDR SOC was able to detect and remediate the incident.
Building the investigation
On September 14th, 2023, the AT&T MDR SOC received multiple alarms indicating that lateral movement was occurring for one of our clients. The alarm detections were generated after activity in SentinelOne for multiple users attempting to perform network traversing through the clients’ environment.
Figure 1. Alarm Detection
The AT&T SOC immediately generated an investigation that included a call to the client to notify them of the activity as well as escalate the detection to the AT&T MDR Incident Response (IR) Team and the client\'s dedicated Threat Hunter. The IR team and Threat Hunter began the engagement by creating a timeline and searching through SentinelOne Deep Visibility tool. Within its events, they found a user was successfully logged into the client’s internal network on multiple endpoints using lsass.exe.. Additionally, multiple files were logged as being encrypted, which resulted in the team designating the incident a ransomware attack.
Figure 2. Lsass Activity in SentinelOne
During the review of the lsass.exe activity, a specific file was located with a suspicious process tree. A command line was recorded with the file execution that included an internal IP address and the user ADMIN$. The activity from the suspicious file prompted an immediate blocklist for the SHA 1 file hash to ensure that the file was unable to be executed within the client’s environment. Following the block of the file hash, multiple detections from SentinelOne populated, indicating that the file was successfully killed and quarantined and that the client’s devices were protected.
Figure 3. File execution command line
After initiating the blocklist, the Threat Hunter utilized the SentinelOne “file fetch” feature, which enabled them to download the malicious file and save a copy locally. The AT&T SOC then worked with the AT&T Alien Labs team to perform a deeper analysis of the file in order to more understand the true nature of the ransomware attack.
Technical analyses
As previously mentioned, BlackCat ransomware is developed in the Rust programming language, providing the attacker with the versatility to compile and run it on both Windows and Linux operating systems.The ransomware e |
Ransomware Malware Tool Threat | ★★★ | |
 |
2024-01-10 23:15:50 | La Chine prétend avoir fissuré la fonction aérienne d'Apple \\ China Claims To Have Cracked Apple\\'s AirDrop Feature (lien direct) |
Une institution chinoise soutenue par l'État aurait élaboré un moyen d'identifier le numéro de téléphone, l'adresse e-mail et le nom des expéditeurs qui partagent du contenu via la fonction de lagramme aérien d'Apple. . Cette décision fait partie des efforts plus larges du gouvernement de Pékin \\ pour éliminer & # 8220; contenu indésirable & # 8221;. Pour ceux qui ne le savent pas, AirDrop est un outil crypté de bout en bout qui permet aux utilisateurs d'envoyer sans fil des photos, des vidéos, des documents, et plus encore aux autres appareils iOS et ordinateurs Mac, ce qui signifie que même Apple ne peut pas décrypter le contenu de laMatériaux que vous transférez. Pendant les transferts, la fonctionnalité ne partage que le nom de l'appareil (qui peut être défini sur n'importe quoi) et ne divulgue pas le numéro de téléphone et l'adresse e-mail associés au téléphone. selon un nouveau bloomberg report , Le Pékin Wangshendongjian, le Pékin de Chine, l'institut d'évaluation judiciaire de Wangshendongjian a développé une méthode pour faire un journal des appareils cryptés d'un iPhone \\ pour identifier les chiffres et les e-mails des expéditeurs qui partagent le contenu Airdrop. «Le cas des informations incorrectes diffusées via« Airdrop »sur les téléphones mobiles a permis les difficultés techniques de la traçabilité anonyme par Airdrop, a amélioré l'efficacité et la précision de la détection de cas, et a empêché la propagation des remarques inappropriées et une mauvaise influence potentielle,"Le Bureau municipal de la justice de Pékin a déclaré dans un | Tool Mobile Technical | ★★★★ | |
|
2024-01-10 21:30:08 | 7 meilleurs calculatrices d'étranglement pour PC en 2024 7 Best Bottleneck Calculators for PC in 2024 (lien direct) |
Looking for the best bottleneck calculator for PC? This article provides concise discussions on them, along with essential information for calculating bottlenecks on your computer. Getting optimal performance on PCs involves considering various factors. One crucial factor to consider is preventing any hardware component from bottlenecking another. For instance, a CPU bottleneck on the GPU can significantly affect the overall performance of the PC especially when you are running a program that requires a lot of GPU power. To identify potential bottleneck hardware on a PC and address issues like freezing, lag, and crashes caused by bottlenecks, it’s common to examine resource usage during program execution. This analysis can be carried out using utilities like Task Manager or specialized resource monitoring software such as MSI Afterburner. However, using a specialized bottleneck calculator often complements the aforementioned method by employing algorithmic analysis to calculate PC bottlenecks. That’s why we’ve created this article to review the best PC bottleneck calculators for PC including all the methods above, helping you in pinpointing any hardware limitations in your system. Understanding the concept of a bottleneck in a PC Bottleneck is a generic term but when it comes to computing, it refers to a PC component - be it CPU, GPU, RAM or disk driver - that limits or slows down the overall functioning of the computer. This occurs when a particular hardware component struggles to process data requests at a pace comparable to the data reception capacity of the hardware awaiting the information. An instance of CPU bottleneck affecting the GPU arises when the CPU impedes the smooth flow of requests to the GPU, probably when gaming. In such a scenario, the CPU experiences high utilization, while the GPU operates with a utilization below the norm. This bottleneck restricts how the GPU should handle requests for the optimal running of processes, leading to issues like lags, crashes, stuttering, and low FPS. While bottleneck may be a simple term, it is most times the cause of issues faced on PCs. Hence, it is very important to take note of it. And the bottleneck calculator below can be of help in getting bottlenecks on your computer. Best Bottleneck Calculators for PC As previously noted, there are tools available to help in identifying hardware bottlenecks on PCs. This helps pinpoint which components may require overclocking or replacement to enhance data/request processing on your computer. Below are the top options derived from our extensive testing. However, the first four recommendations are best to be used if you are just planning to build a PC and the last three can only be used post PC build. 1. PC Built Bottleneck Calculator PC Built Bottleneck Calculator is one of the top platforms to calculate PC bottleneck before building a PC. | Tool Prediction | ★★★ | |
 |
2024-01-10 21:00:00 | Nouveaux outils de développeur nécessaires pour stimuler l'adoption de la clé passante New Developer Tools Necessary to Boost Passkey Adoption (lien direct) |
Il y a beaucoup d'intérêt pour la technologie sans mot de passe pour simplifier l'accès et l'identité en ligne, mais ils doivent d'abord être construits.Les outils des développeurs pour aider à créer des clés de passage dans les applications Web ouvrent la voie.
There is a lot of interest for password-less technology to simplify online access and identity, but they need to be built first. Developer tools to help build passkeys into web applications pave the way. |
Tool | ★★★ | |
|
2024-01-10 21:00:00 | Les clients d'Ivanti ont demandé à corriger les vulnérabilités qui auraient été exploitées par des pirates d'État chinois Ivanti customers urged to patch vulnerabilities allegedly exploited by Chinese state hackers (lien direct) |
Mercredi, l'Agence de sécurité de la cybersécurité et de l'infrastructure (CISA) a exhorté les clients de la société informatique Ivanti pour corriger deux vulnérabilités qui sont activement exploitées.Cisa \\ 's Avis suit un Avertissement De Ivanti qu'au moins 10 de ses clients ont été touchés par les vulnérabilités.Les problèmes concernent Ivanti Connect Secure - un outil VPN largement utilisé.
The Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday urged customers of IT company Ivanti to patch two vulnerabilities that are being actively exploited. CISA\'s notice follows a warning from Ivanti that at least 10 of its customers were impacted by the vulnerabilities. The issues relate to Ivanti Connect Secure - a widely-used VPN tool. |
Tool Vulnerability | ★★ | |
|
2024-01-10 14:23:04 | Comment Pinterest a monté son PaaS Kubernetes (lien direct) | Pinterest a entrepris de moderniser son infrastructure de calcul avec Kubernetes. Des API à la sémantique, il y a greffé ses outils et processus. | Tool Cloud | ★★★ | |
 |
2024-01-09 16:30:13 | L'IA aide les espions nous pour attraper des opérations de piratage chinois furtives, dit le responsable de la NSA AI is helping US spies catch stealthy Chinese hacking ops, NSA official says (lien direct) |
> Les outils d'apprentissage automatique aident les agences de sécurité américaines pour attraper les opérations qui s'appuient sur des techniques dites de «vivre du terrain».
>Machine learning tools are aiding U.S. security agencies to catch operations relying on so-called "living off the land" techniques. |
Tool | ★★ | |
 |
2024-01-09 15:20:24 | Comment Sekoia.io habilite la cybersécurité avec plus de 170 intégrations How Sekoia.io empowers cybersecurity with 170+ integrations (lien direct) |
> Sekoia.io reconnaît l'investissement et les efforts importants que les organisations ont consacrés à leurs infrastructures de sécurité existantes.Nous réalisons également la flexibilité nécessaire pour choisir les meilleurs nouveaux outils pour protéger les actifs et les données critiques.Pour permettre cette flexibilité et rationaliser les opérations de sécurité, Sekoia.io adhère à une approche technologique et offre des intégrations avec plus de 170 outils et [& # 8230;]
la publication Suivante comment sekoia.io rend la cybersécurité avec plus de 170 intégrations est un article de blog Sekoia.io .
>Sekoia.io recognizes the significant investment and effort that organizations have put into their existing security infrastructures. We also realize the flexibility needed to choose the best new tools for safeguarding critical assets and data. To enable this flexibility and streamline security operations, Sekoia.io adheres to a technology-agnostic approach and offers integrations with 170+ tools and […] La publication suivante How Sekoia.io empowers cybersecurity with 170+ integrations est un article de Sekoia.io Blog. |
Tool | ★★★ | |
|
2024-01-09 13:45:52 | L'outil AI Mockingbird de McAfee \\ détecte DeepFake Audio avec une précision de 90% McAfee\\'s Mockingbird AI Tool Detects Deepfake Audio with 90% accuracy (lien direct) |
par deeba ahmed
pouvez-vous faire confiance à vos oreilles?Deepfakes se lancent, mais McAfee dit se détendre, nous avons des oiseau moqueur.
Ceci est un article de HackRead.com Lire la publication originale: L'outil AI Mockingbird de McAfee détecte de DeepFake Audio avec une précision de 90%
By Deeba Ahmed Can You Trust Your Ears? Deepfakes Run Amok, but McAfee Says Relax, We\'ve Got Mockingbird. This is a post from HackRead.com Read the original post: McAfee’s Mockingbird AI Tool Detects Deepfake Audio with 90% accuracy |
Tool | ★★★ | |
|
2024-01-09 11:57:12 | L'augmentation préoccupante des attaques centrées sur l'identité: tendances et faits The Concerning Rise in Identity-Centric Attacks: Trends and Facts (lien direct) |
Identity threats are by no means a new type of crime. But in today\'s increasingly digitized world, there are more opportunities for bad actors to steal identities and engage in identity-centric attacks than ever before. Unfortunately, user identities are tough for businesses to protect. The fact that these types of attacks are skyrocketing is evidence of that-in the past year alone the Identity Defined Security Alliance reports that a whopping 84% of companies experienced an identity-related security breach. In this post, we\'ll take a look at identity attack statistics and trends and provide some recent case studies to illustrate how some attacks work. We\'ll also highlight one of the most important identity threat facts-that the human element plays a crucial role in the success of these attacks. Understanding identity-centric attacks There are many types of identity attacks. When most people think of these types of crimes, they often imagine traditional identity theft scenarios: Financial identity theft, where a criminal gains access to a victim\'s financial data, like their credit card details, bank account numbers or Social Security number, to make unauthorized purchases, withdraw funds or open new accounts. Tax identity theft, where a bad actor uses a victim\'s personal information to file false tax returns and claim refunds, diverting the money to their own accounts. Employment identity theft, where a fraudster uses a victim\'s identity to get a job, potentially causing issues for that person when discrepancies arise in their employment and tax records. But identity-based attacks also target enterprises and their online users. The cybercriminals behind these attacks might aim to steal sensitive data, siphon off funds, damage or disrupt systems, deploy ransomware or worse. Those are the types of identity attacks we\'re covering here. Identity threat trends and tactics In short, identity-centric attacks are a practical calculation by bad actors: Why would they invest their time and resources to build exploits to help them get in through a virtual back door when they can just walk through the front door? But before they reap the rewards, they still have some legwork to do. Here are a few techniques that cybercriminals use to progress identity-based attacks against businesses and their users: MFA bypass attacks. Many businesses today use multifactor authentication (MFA) to protect the account of their users. It\'s more secure than using passwords alone. But of course, bad actors have found new ways to bypass commonly used MFA methods. MFA fatigue attacks are one example. People-activated malware. People often give life to malware when they fall for a phishing scam or other social engineering tactics. Malware can appear in the form of a .zip file, QR code, .html link, MS Office file and more-there are at least 60 known techniques to plant people-activated malware on corporate networks. Active Directory (AD) attacks. Most enterprises today use AD as a primary method for directory services like user authentication and authorization. Cybercriminals are keen to target AD, which touches almost every place, person and device on a network. This approach works very well, too-more than half of identity-related breaches can be traced back to AD. Cached credentials harvesting. Cached credentials are commonly stored on endpoints, in memory, in the registry, in a browser or on disk. Attackers use various tools and techniques to collect these credentials and gain access to more privileged identities. Once they have harvested these credentials, they can use them to move laterally and log into different applications. Adversaries are likely to find a good “crop” when they are harvesting cached credentials. Recent research from Proofpoint found that more than one in 10 endpoints have exposed privileged account passwords, making it one of the most common identity risks. Keep in mind that cybercriminals are always innovating, and they are quick to build or adopt tools that | Ransomware Malware Tool Threat Studies | Uber | ★★ |
|
2024-01-09 11:00:00 | Histoires du SOC: quelque chose sent Phishy Stories from the SOC: Something smells phishy (lien direct) |
Executive summary
In the current cyber landscape, adversaries commonly employ phishing as the leading technique to compromise enterprise security. The susceptibility of human behavior makes individuals the weakest link in the security chain. Consequently, there is an urgent need for robust cybersecurity measures. Phishing, which capitalizes on exploiting human behavior and vulnerabilities, remains the adversary\'s top choice. To counter this threat effectively, ongoing education and awareness initiatives are essential. Organizations must recognize and address the pivotal role of human vulnerability in cybersecurity.
During regular business hours, an alarm was generated due to a customer’s user that had interacted with a potentially malicious phishing link. This prompted a thorough investigation conducted by analysts that involved leveraging multiple Open-Source Intelligence (OSINT) tools such as VirusTotal and URLscan.io. Through a meticulous examination, analysts were able to unveil suspicious scripts within the phishing webpage’s Document Object Model (DOM) that pinpointed an attempt to exfiltrate user credentials. This detailed analysis emphasizes the importance of proactive cybersecurity measures and showcases the effectiveness of analysts leveraging OSINT tools along with their expertise to accurately assess threats within customer’s environments.
Investigation
The alarm
The Managed Detection and Response (MDR) Security Operations Center (SOC) initially received an alarm triggered by a potentially malicious URL that a user received in their inbox. Office 365\'s threat intelligence feed flagged this URL as potentially malicious. The initial steps in addressing this alarm involve two key actions.
First, it is crucial to determine the scope of impact on the customer\'s environment by assessing how many other users received the same URL. Second, a thorough validation process is essential to confirm whether the URL is indeed malicious. These initial steps lay the foundation for a comprehensive response to safeguard the security of the environment.
To determine how many users received the same URL, a comprehensive search within the customer\'s environment revealed that no other users received the same URL. As a result, only one user is affected, suggesting that this is an isolated incident and does not appear to be part of a targeted attack on the customer\'s environment. With this understanding, the focus can now shift to the second step: Validating the reputation of the URL.
By employing the OSINT tool VirusTotal and inputting the URL received by the user, we aim to assess its potential threat level. VirusTotal aggregates results from various security vendors to provide a comprehensive analysis. In the current evaluation, 13 out of 90 security vendors classify this URL as malicious. It\'s important to note that while the number of vendors flagging the URL is a key factor, a conclusive determination of malicious intent typically considers a consensus among a significant portion of these vendors. A higher number of detections by diverse security platforms strengthens the confidence in labeling the URL as malicious.
With a potentially malicious URL identified, it is imperative to delve deeper to ascertain the underlying reasons for its malicious reputation. Analysts will utilize a tool such as URLscan.io for this purpose. URLscan.io serves as a sandbox, providing a risk-free environment for visiting websites. This tool is instrumental in conducting a thorough examination to uncover the nuances contributing to the URL\'s malicious classification.
After entering our identified malicious URL into URLscan.io, |
Data Breach Tool Vulnerability Threat | ★★ | |
|
2024-01-08 23:00:00 | Outil de surveillance des cactus enrichi par une vulnérabilité critique d'injection SQL Cacti Monitoring Tool Spiked by Critical SQL Injection Vulnerability (lien direct) |
Les attaquants peuvent exploiter le problème pour accéder à toutes les données dans la base de données CACTI;Et, il permet RCE lorsqu'il est enchaîné avec une vulnérabilité précédente.
Attackers can exploit the issue to access all data in Cacti database; and, it enables RCE when chained with a previous vulnerability. |
Tool Vulnerability Threat | ★★★ | |
 |
2024-01-08 15:52:58 | Kingdom Market : le château pirate pris d\'assaut (lien direct) | Le blackmarket Kingdom Market stoppé par les autorités. Ce marché hacker vendait de la drogue, des outils de piratage et de faux documents.... | Tool Legislation | ★★★ | |
|
2024-01-08 14:31:00 | Webinaire & # 8211;Tirez parti de la sécurité zéro fiducie pour minimiser votre surface d'attaque Webinar – Leverage Zero Trust Security to Minimize Your Attack Surface (lien direct) |
L'expansion numérique augmente inévitablement la surface d'attaque externe, ce qui vous rend sensible aux cyber-états.Les acteurs de la menace exploitent de plus en plus les vulnérabilités résultant des logiciels et des infrastructures exposés à Internet;Cela comprend ironiquement les outils de sécurité, en particulier les pare-feu et les VPN, qui donnent aux attaquants un accès direct au réseau pour exécuter leurs attaques.En fait, & nbsp; Gartner &
Digital expansion inevitably increases the external attack surface, making you susceptible to cyberthreats. Threat actors increasingly exploit the vulnerabilities stemming from software and infrastructure exposed to the internet; this ironically includes security tools, particularly firewalls and VPNs, which give attackers direct network access to execute their attacks. In fact, Gartner& |
Tool Vulnerability Threat | ★★ | |
|
2024-01-08 10:54:45 | Présentation de l'analyse dynamique MFA: prise en charge automatisée pour les configurations MFA Introducing Dynamic Analysis MFA: Automated Support for MFA Setups (lien direct) |
Veracode a récemment introduit une nouvelle fonctionnalité appelée Dynamic Analysis MFA, qui fournit une prise en charge automatisée des configurations d'authentification multi-facteurs (MFA) lors des analyses d'analyse dynamique.Cela élimine la nécessité de désactiver ou de prendre en charge manuellement vos configurations MFA lors de la réalisation de tests de sécurité.
Comprendre l'analyse dynamique MFA
Lorsque nous nous connectons aux applications, nous utilisons généralement un nom d'utilisateur et un mot de passe, qui est considéré comme une authentification à un facteur.Cependant, pour améliorer la sécurité et réduire le risque que les mots de passe sont perdus ou volés, l'authentification multi-facteurs (MFA) a été introduite.MFA ajoute une couche de sécurité supplémentaire en nécessitant une étape supplémentaire, comme l'utilisation d'une clé matérielle, la réception d'un SMS ou la saisie d'un code à partir d'une application Authenticator.
Le MFA est devenu plus courant pour les applications Web car la sécurité Web devient une priorité plus élevée, mais certains outils de test de sécurité obligent les utilisateurs à désactiver ou à prendre en charge manuellement leurs configurations de MFA lors des tests de sécurité des applications.Cela peut être…
Veracode has recently introduced a new feature called Dynamic Analysis MFA, which provides automated support for multi-factor authentication (MFA) setups during dynamic analysis scans. This eliminates the need for you to disable or manually support your MFA configurations when conducting security testing. Understanding Dynamic Analysis MFA When we log into applications, we usually use a username and password, which is considered one-factor authentication. However, to enhance security and reduce the risk of passwords being lost or stolen, multi-factor authentication (MFA) was introduced. MFA adds an extra layer of security by requiring an additional step, such as using a hardware key, receiving a text message, or entering a code from an authenticator app. MFA has become more common for web applications as web security becomes a higher priority, but some security testing tools require users to disable or manually support their MFA setups during application security testing. This can be… |
Tool | ★★ | |
|
2024-01-08 09:39:09 | Sécuriser JavaScript: meilleures pratiques et vulnérabilités communes Securing JavaScript: Best Practices and Common Vulnerabilities (lien direct) |
JavaScript est le langage de programmation le plus utilisé, selon la plus récente enquête sur les développeurs Stackoverflow.Bien que JavaScript offre une grande flexibilité et une grande facilité d'utilisation, il présente également des risques de sécurité qui peuvent être exploités par les attaquants.Dans ce blog, nous explorerons les vulnérabilités en JavaScript, les meilleures pratiques pour sécuriser votre code et les outils pour empêcher les attaques.
Comprendre les vulnérabilités JavaScript
Cet article explore les vulnérabilités communes liées à la sécurité JavaScript et fournit les meilleures pratiques pour sécuriser votre code.
Si vous manquez de temps, vous pouvez commencer par utiliser Veracode Dast Essentials, un scanner de sécurité JavaScript, pour identifier les vulnérabilités potentielles.L'exécution de cet outil générera rapidement des rapports, mettra en évidence vos vulnérabilités spécifiques et fournira des instructions claires sur la façon de les résoudre.
Vulnérabilités de code source javascript
Les développeurs JavaScript s'appuient généralement sur l'intégration de nombreux packages et bibliothèques publiques ou open source contenant…
JavaScript is the most commonly-used programing language, according to the most recent StackOverflow developer survey. While JavaScript offers great flexibility and ease of use, it also introduces security risks that can be exploited by attackers. In this blog, we will explore vulnerabilities in JavaScript, best practices to secure your code, and tools to prevent attacks. Understanding JavaScript Vulnerabilities This article explores the common vulnerabilities related to JavaScript security and provides best practices to secure your code. If you\'re short on time, you can begin by using Veracode DAST Essentials, a JavaScript security scanner, to identify potential vulnerabilities. Running this tool will quickly generate reports, highlight your specific vulnerabilities, and provide clear instructions on how to remediate them. JavaScript Source Code Vulnerabilities JavaScript developers typically rely on integrating numerous public or open-source packages and libraries containing… |
Tool Vulnerability | ★★ | |
|
2024-01-08 08:22:56 | McAfee dévoile le " Projet Mockingbird " (lien direct) | McAfee dévoile une technologie avancée de détection des Deepfakes audio pour renforcer la protection contre les escroqueries et la désinformation générées par l'IA Connue sous le nom de " Projet Mockingbird ", McAfee présente une solution de détection avancée par intelligence artificielle, offrant aux consommateurs la capacité de discerner le vrai du faux dans un contexte où la prolifération de contenus malveillants générés par l'IA est en constante augmentation • L'innovation de McAfee, boostée par l'IA, est précise à plus de 90 % dans la détection d'un son modifié à des fins malveillantes dans les vidéos • Le " Projet Mockingbird " offrira aux internautes un outil puissant leur permettant de mieux naviguer dans un monde numérique en constante évolution • La combinaison de modèles de détection contextuels, comportementaux et catégoriels alimentés par l'IA établit les bases de la préservation de l'intégrité en ligne, notamment face à l'émergence croissante de pratiques telles que la cyberintimidation, la manipulation de la réputation et les escroqueries à l'investissement basées sur les deepfakes - Produits | Tool | ★★★ | |
|
2024-01-08 06:00:19 | ProofPoint reconnu en 2023 Gartner & Reg;Guide du marché pour les solutions de gestion des risques d'initiés Proofpoint Recognized in 2023 Gartner® Market Guide for Insider Risk Management Solutions (lien direct) |
It\'s easy to understand why insider threats are one of the top cybersecurity challenges for security leaders. The shift to remote and hybrid work combined with data growth and cloud adoption has meant it\'s easier than ever for insiders to lose or steal data. Legacy systems simply don\'t provide the visibility into user behavior that\'s needed to detect and prevent insider threats. With so much potential for brand and financial damage, insider threats are now an issue for the C-suite. As a result, businesses are on the lookout for tools that can help them to better manage these threats. To help businesses understand what to look for, Gartner has recently released Market Guide for Insider Risk Management Solutions. In this report, Gartner explores what security and risk leaders should look for in an insider risk management (IRM) solution. It also provides guidance on how to implement a formal IRM program. Let\'s dive into some of its highlights. Must-have capabilities for IRM tools Gartner states that IRM “refers to the use of technical solutions to solve a fundamentally human problem.” And it defines IRM as “a methodology that includes the tools and capabilities to measure, detect and contain undesirable behavior of trusted accounts in the organization.” Gartner identifies three distinct types of users-careless, malicious and compromised. That, we feel, is in line with our view at Proofpoint. And the 2022 Cost of Insider Threats Global Report from Ponemon Institute notes that most insider risks can be attributed to errors and carelessness, followed by malicious and compromised users. In its Market Guide, Gartner identifies the mandatory capabilities of enterprise IRM platforms: Orchestration with other cybersecurity tooling Monitoring of employee activity and assimilating into a behavior-based risk model Dashboarding and alerting of high-risk activity Orchestration and initiation of intervention workflows This is the third consecutive year that Proofpoint is a Representative Vendor in the Market Guide. Proofpoint was an early and established leader in the market for IRM solutions. Our platform: Integrates with a broad ecosystem of cybersecurity tools. Our API-driven architecture means it\'s easy for you to feed alerts into your security tools. That includes security information and event management (SIEM) as well as SOAR and service management platforms, such as Splunk and ServiceNow. That, in turn, helps you gain a complete picture of potential threats. Provides a single lightweight agent with a dual purpose. With Proofpoint, you get the benefit of data loss prevention (DLP) and ITM in a single solution. This helps you protect against data loss and get deep visibility into user activities. With one agent, you can monitor everyday users. That includes low-risk and regular business users, risky users, such as departing employees, privileged users and targeted users. Offers one centralized dashboard. This saves you time and effort by allowing you to monitor users, correlate alerts and triage investigations from one place. You no longer need to waste your time switching between tools. You can quickly see your riskiest users, top alerts and file exfiltration activity in customizable dashboards. Includes tools to organize and streamline tasks. Proofpoint ITM lets you change the status of events with ease, streamline workflows and better collaborate with team members. Plus, you can add tags to help group and organize your alerts and work with more efficiency. DLP and IRM are converging In its latest Market Guide, Gartner says: “Data loss prevention (DLP) and insider risk strategies are increasingly converging into a unified solution. The convergence is driven by the recognition that preventing data loss and managing insider risks are interconnected goals.” A legacy approach relies on tracking data activity. But that approach is no longer sufficient because the modern way of working is more complex. Employees and third parties have access to more data than ever before. And ex | Tool Threat Cloud Technical | ★★★ | |
|
2024-01-05 20:00:00 | La Corée du Nord fait ses débuts \\ 'spectralblur \\' malware au milieu de l'assaut macOS North Korea Debuts \\'SpectralBlur\\' Malware Amid macOS Onslaught (lien direct) |
La porte dérobée post-exploitation est la dernière d'une série d'outils personnalisés visant à espionner les utilisateurs d'Apple.
The post-exploitation backdoor is the latest in a string of custom tools aimed at spying on Apple users. |
Malware Tool | ★★★ | |
|
2024-01-05 19:19:00 | Le groupe de menaces syriennes colporte un argent destructeur Syrian Threat Group Peddles Destructive SilverRAT (lien direct) |
Les développeurs du Moyen-Orient prétendent construire une nouvelle version de l'outil d'attaque à télécommande antivirus.
The Middle Eastern developers claim to be building a new version of the antivirus-bypassing remote access Trojan (RAT) attack tool. |
Tool Threat | ★★ | |
|
2024-01-05 15:33:00 | Les secrets exposés sont partout.Ici \\ est comment les aborder Exposed Secrets are Everywhere. Here\\'s How to Tackle Them (lien direct) |
Imaginez ceci: vous tombez sur un secret dissimulé dans le code source de votre entreprise.Instantanément, une vague de panique frappe lorsque vous saisissez les conséquences possibles.Ce secret caché a le pouvoir de ouvrir la voie à une entrée non autorisée, à des violations de données et à une réputation endommagée.Comprendre le secret n'est que le début;L'action rapide et résolue devient impérative.Cependant, sans le
Picture this: you stumble upon a concealed secret within your company\'s source code. Instantly, a wave of panic hits as you grasp the possible consequences. This one hidden secret has the power to pave the way for unauthorized entry, data breaches, and a damaged reputation. Understanding the secret is just the beginning; swift and resolute action becomes imperative. However, lacking the |
Tool | ★★★★ | |
|
2024-01-05 11:59:23 | Gestion des secrets : maturité ne rime pas seulement avec outil (lien direct) | Gestion des secrets : maturité ne rime pas seulement avec outils. Par Dwayne McDaniel, Security Advocate chez GitGuardian - Points de Vue | Tool | ★★ | |
|
2024-01-05 11:00:00 | Chardeur asyncrat: obscurcissement, DGA, leurres et Govno AsyncRAT loader: Obfuscation, DGAs, decoys and Govno (lien direct) |
Executive summary
AT&T Alien Labs has identified a campaign to deliver AsyncRAT onto unsuspecting victim systems. During at least 11 months, this threat actor has been working on delivering the RAT through an initial JavaScript file, embedded in a phishing page. After more than 300 samples and over 100 domains later, the threat actor is persistent in their intentions.
Key takeaways:
The victims and their companies are carefully selected to broaden the impact of the campaign. Some of the identified targets manage key infrastructure in the US.
The loader uses a fair amount of obfuscation and anti-sandboxing techniques to elude automatic detections.
As part of the obfuscation, the attacker also uses a lot of variable’s names and values, which are randomly generated to harden pivot/detection by strings.
DGA domains are recycled every week and decoy redirections when a VM is identified to avoid analysis by researchers.
The ongoing registration of new and active domains indicates this campaign is still active.
There is an OTX pulse with more information.
Analysis
AsyncRAT is an open-source remote access tool released in 2019 and is still available in Github. As with any remote access tool, it can be leveraged as a Remote Access Trojan (RAT), especially in this case where it is free to access and use. For that reason, it is one of the most commonly used RATs; its characteristic elements include: Keylogging, exfiltration techniques, and/or initial access staging for final payload delivery.
Since it was initially released, this RAT has shown up in several campaigns with numerous alterations due to its open-sourced nature, even used by the APT Earth Berberoka as reported by TrendMicro.
In early September, AT&T Alien Labs observed a spike in phishing emails, targeting specific individuals in certain companies. The gif attachment led to a svg file, which also led to a download of a highly obfuscated JavaScript file, followed by other obfuscated PowerShell scripts and a final execution of an AsyncRAT client. This peculiarity was also reported by some users in X (formerly Twitter), like reecDeep and Igal Lytzki. Certain patterns in the code allowed us to pivot and look for more samples in this campaign, resulting in samples going back to February 2023. The registration of domains and subsequent AsyncRAT samples is still being observed at the time of writing this blog.
Figure1: Number of samples observed by Alien Labs in this campaign.
The modus operandi of the loader involves several stages which are further obfuscated by a Command and Control (C&C) server checking if the victim could be a sandbox prior to deploying the main AsyncRAT payload. In particular, when the C&C server doesn’t rely on the parameters sent, usually after stage 2, or when it is not expecting requests on a particular domain at that time, the C&C redirects to a benign page.
Figure 2. Execution flow.
During the whole campaign, JavaScript files have been delivered to targete |
Malware Tool Threat Technical | ★★ | |
|
2024-01-05 06:00:31 | 2023 Année en revue: versions de contenu axées sur les menaces pour la sensibilisation à la sécurité 2023 Year in Review: Threat-Driven Content Releases for Security Awareness (lien direct) |
As a new year approaches, it is natural to reflect on recent accomplishments. At Proofpoint, we are reflecting on our work to deliver security awareness content and updated features in line with our ongoing goal to drive behavior change. Proofpoint Security Awareness integrates our rich threat intelligence, which means it taps into current and emerging attacks. Our threat analysts surface threat trends, such as artificial intelligence (AI)-enhanced vishing, malicious QR codes and remote IT support scams. And then we work quickly to release new training features and awareness material to ensure inform security administrators and educate employees about ever-evolving attacks. In 2023, our content releases focused on three areas: Delivering a threat-driven program Improving how security awareness administrators work Enhancing how people learn Let\'s review the past year and explore how Proofpoint used content releases to respond to the changing threat landscape. Image from AI Chatbot Threats training (play video). Quick turnaround for threat trends Proofpoint Security Awareness alerts customers to threats in two powerful ways-Threat Alerts and Attack Spotlights. It also continuously trains employees with threat-driven training modules. Threat Alerts These weekly releases focus on a specific and current ongoing attack. They explain what the threat is and who it might target. And they describe a specific lure, if applicable. Each alert is linked to activity that our threat analysts see happening in the wild. We recommend applicable training like simulated phishing and awareness material and include suggested email messaging. In 2023, we released Threat Alerts on: IRS-themed phishing lures for tax season (February, March, April) AI-enhanced vishing calls that impersonate loved ones (March) Malicious QR codes for credential phishing (May, August) Telephone-oriented attack delivery (TOAD) using a Geek Squad PDF lure (July, October) Charity donation scams around the Israel-Palestine crisis (October) Christmas party lures for credential phishing (November) Attack Spotlights These monthly releases cast a wider lens on attack types. They focus on a time-based or reoccurring threat that is expected to trend, typically related to holidays, travel seasons or shopping events. Each spotlight is released a month in advance with a campaign plan, awareness material and training modules, and is available in 12 core languages. In 2023, Proofpoint published these Attack Spotlight campaigns: Smishing with package delivery lures (February) Business email compromise (BEC) phishing with requests for quotations (RFQs) (April) LinkedIn phishing lures (May) Amazon phishing lures (June) Remote IT support scams (September) Gift card scams (December) Image from Attack Spotlight video (play video). Threat modules These training videos are relevant to the changing threat landscape. They are inspired by our threat intelligence and our team\'s threat landscape research. These micro-learning modules are grounded in learning science principles that are designed to drive behavior change. Each module has a concise and specific learning objective. The delivery of content is tailored to individual factors such as a person\'s role, learning style, vulnerability level and preferred language. In 2023, we covered these topics in our new threat training modules: Data loss protection AI chatbot threats Amazon phishing scams Cryptocurrency investment scams QR code dangers Multifactor authentication (MFA) Image from Threat Module video (play video). Staying ahead of generative AI attacks AI-powered systems are promoted as tools to help us work faster, and they are transforming businesses and industries. This wide-reaching access can create security risks from potential data breaches to concerns over user privacy. Your employees need to be aware of the limitations and risks of using AI-powered tools, especiall | Ransomware Tool Vulnerability Threat Studies Prediction Cloud | ★★★★ | |
|
2024-01-04 23:59:56 | Meilleur EDR du marché (Beotm) & # 8211;Outil de détection de point de terminaison et de réponse à la réponse Best EDR Of The Market (BEOTM) – Endpoint Detection and Response Testing Tool (lien direct) |
BestDroftheMarket est un outil EDR (détection et réponse de point de terminaison) conçu pour servir de terrain de test
BestEDROfTheMarket is a naive user-mode EDR (Endpoint Detection and Response) tool designed to serve as a testing ground |
Tool | ★★★ | |
|
2024-01-04 18:15:00 | Les pirates utilisant des logiciels malveillants Remcos pour espionner l'Ukraine sont devenus furtifs, les chercheurs trouvent Hackers using Remcos malware to spy on Ukraine have become stealthier, researchers find (lien direct) |
Un groupe de pirates lié aux opérations de cyber-espionnage contre l'Ukraine améliore ses tactiques pour devenir plus secrètes et efficaces, selon un nouveau rapport.Suivi en tant que UAC-0050, le groupe déploie principalement l'outil de surveillance à distance Remcos pour cibler les agences gouvernementales en Ukraine.Les chercheurs de la société de cybersécurité Uptycs ont découvert une nouvelle méthode que
A hacker group linked to cyber espionage operations against Ukraine is improving its tactics to become more secretive and effective, according to a new report. Tracked as UAC-0050, the group primarily deploys the remote surveillance tool Remcos to target government agencies in Ukraine. Researchers at the cybersecurity firm Uptycs have discovered a new method that |
Malware Tool | ★★ |
To see everything:
