What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-06-03 23:30:00 | 27 juin 11h15 Webinaire Kiwi Backup - présenté par Sébastien Heitzmann : "IA et cybersécurité" (lien direct) | 27 juin 11h15 Webinaire Kiwi Backup : présenté par Sébastien Heitzmann : "IA et cybersécurité" - Événements / evenement_milieu | |||
 |
2024-06-03 19:30:00 | Les chercheurs découvrent un package NPM à suppression de rats ciblant les utilisateurs de Gulp Researchers Uncover RAT-Dropping npm Package Targeting Gulp Users (lien direct) |
Les chercheurs en cybersécurité ont découvert un nouveau package suspect téléchargé dans le registre des packages NPM qui a conçu pour supprimer un chevalier à distance (rat) sur des systèmes compromis.
Le package en question est GLUP-Debugger-log, qui cible les utilisateurs de la boîte à outils Gulp en se faisant passer pour un "enregistreur pour les plugins Gulp et Gulp".Il a été téléchargé 175 fois à ce jour.
Sécurité de la chaîne d'approvisionnement du logiciel
Cybersecurity researchers have uncovered a new suspicious package uploaded to the npm package registry that\'s designed to drop a remote access trojan (RAT) on compromised systems. The package in question is glup-debugger-log, which targets users of the gulp toolkit by masquerading as a "logger for gulp and gulp plugins." It has been downloaded 175 times to date. Software supply chain security |
|||
|
2024-06-03 19:15:00 | Les autorités augmentent les efforts pour capturer le cerveau derrière Emotet Authorities Ramp Up Efforts to Capture the Mastermind Behind Emotet (lien direct) |
Les autorités de l'application des lois derrière l'Opération Endgame recherchent des informations liées à une personne qui porte le nom impair et qui serait le cerveau derrière le malware Emotet. & NBSP;
On dit également que Odd est censé passer par les surnoms Aron, C700, CBD748, Ivanov Odd, Mors, Morse, Veron au cours des dernières années, selon une vidéo publiée par les agences.
"Avec qui travaille-t-il? Quel est le sien
Law enforcement authorities behind Operation Endgame are seeking information related to an individual who goes by the name Odd and is allegedly the mastermind behind the Emotet malware. Odd is also said to go by the nicknames Aron, C700, Cbd748, Ivanov Odd, Mors, Morse, Veron over the past few years, according to a video released by the agencies. "Who is he working with? What is his |
Malware Legislation | ||
 |
2024-06-03 17:33:35 | Les nouveaux directives de la NSA abordent la visibilité et l'analyse du pilier de la mise en œuvre de la confiance zéro pour une atténuation améliorée des risques New NSA guidance addresses visibility and analytics pillar of zero trust implementation for enhanced risk mitigation (lien direct) |
La U.S.National Security Agency (NSA) a publié une fiche d'information sur la cybersécurité (CSI) qui détaille l'infrastructure, les outils, les données, ...
The U.S. National Security Agency (NSA) published a Cybersecurity Information Sheet (CSI) that details the infrastructure, tools, data,... |
Tool | ||
|
2024-06-03 17:28:06 | Les opérations du groupe insikt de Future \\ de Future ont enregistré par Bledelta Malware ciblant les réseaux européens Recorded Future\\'s Insikt Group details operations by BlueDelta malware targeting European networks (lien direct) |
Enregistré Future \'s Insikt Group de surveillance détaillée du développement d'une infrastructure opérationnelle par des logiciels malveillants Bledelta qui ont été utilisés pour ...
Recorded Future\'s Insikt Group detailed monitoring development of operational infrastructure by BlueDelta malware that has been utilized for... |
Malware | ||
 |
2024-06-03 17:24:17 | Le parti au pouvoir de la Hongrie saute la session parlementaire sur la cyberattaque russe contestée Hungary\\'s ruling party skips parliamentary session on disputed Russian cyberattack (lien direct) |
Enregistré Future \'s Insikt Group de surveillance détaillée du développement d'une infrastructure opérationnelle par des logiciels malveillants Bledelta qui ont été utilisés pour ...
Recorded Future\'s Insikt Group detailed monitoring development of operational infrastructure by BlueDelta malware that has been utilized for... |
|||
|
2024-06-03 17:22:54 | Perception du réseau débute à rapporter comme une offre de services pour rationaliser NERC CIP, Documentation TSA Evidence Network Perception debuts Reporting as a Service offering to streamline NERC CIP, TSA evidence documentation (lien direct) |
Perception du réseau introduit lundi une solution de rapports en tant que service (RAAS) qui utilise la plate-forme NP-View pour ...
Network Perception introduced on Monday a Reporting as a Service (RaaS) solution that utilizes the NP-View Platform for... |
|||
 |
2024-06-03 17:20:05 | Ticketmaster confirme la violation du cloud, au milieu des détails troubles Ticketmaster Confirms Cloud Breach, Amid Murky Details (lien direct) |
Ticketmaster Parent Live Nation a déposé une notification volontaire de violation des données de la SEC, tandis que l'un de ses fournisseurs de cloud, Snowflake, a également confirmé la cyberactivité ciblée contre certains de ses clients.
Ticketmaster parent Live Nation has filed a voluntary SEC data breach notification, while one of its cloud providers, Snowflake, also confirmed targeted cyberactivity against some of its customers. |
Data Breach Cloud | ||
 |
2024-06-03 16:46:15 | Les plugins WordPress populaires laissent des millions ouverts aux attaques de porte dérobée Popular WordPress Plugins Leave Millions Open to Backdoor Attacks (lien direct) |
Les chercheurs rapidement découvrent des attaques XSS stockées non authentifiées qui affligeaient les plugins WordPress, y compris WP Meta SEO, et le populaire WP & # 8230;
Fastly researchers discover unauthenticated stored XSS attacks plaguing WordPress Plugins including WP Meta SEO, and the popular WP… |
|||
|
2024-06-03 16:36:25 | Nommez ce bord toon: zonked sorti Name That Edge Toon: Zonked Out (lien direct) |
Vous vous sentez créatif?Soumettez votre légende et notre panel d'experts récompensera le gagnant avec une carte-cadeau Amazon de 25 $.
Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card. |
|||
|
2024-06-03 16:26:00 | Rapport sur la menace SASE: 8 conclusions clés pour la sécurité des entreprises SASE Threat Report: 8 Key Findings for Enterprise Security (lien direct) |
Les acteurs de la menace évoluent, mais l'intelligence cyber-menace (CTI) reste confinée à chaque solution ponctuelle isolée.Les organisations ont besoin d'une analyse holistique à travers les données externes, les menaces entrantes et sortantes et l'activité du réseau.Cela permettra d'évaluer le véritable état de cybersécurité dans l'entreprise.
Le laboratoire de recherche sur le cyber-menace de Cato \\ (Cato Ctrl, voir plus de détails ci-dessous) a récemment publié
Threat actors are evolving, yet Cyber Threat Intelligence (CTI) remains confined to each isolated point solution. Organizations require a holistic analysis across external data, inbound and outbound threats and network activity. This will enable evaluating the true state of cybersecurity in the enterprise. Cato\'s Cyber Threat Research Lab (Cato CTRL, see more details below) has recently released |
Threat | ||
 |
2024-06-03 16:25:00 | Kaspersky a publié un outil de suppression de virus linux libre - mais est-ce nécessaire? Kaspersky released a free Linux virus removal tool - but is it necessary? (lien direct) |
Préoccupé par les virus sur votre ordinateur Linux?J'ai testé le nouvel outil de suppression du virus de Kaspersky \\ pour Linux.Voici ce que vous devez savoir.
Concerned about viruses on your Linux computer? I tested Kaspersky\'s new Virus Removal Tool for Linux. Here\'s what you need to know about it. |
Tool | ||
|
2024-06-03 16:05:46 | Les meilleurs trackers Bluetooth de 2024: expert testé The best Bluetooth trackers of 2024: Expert tested (lien direct) |
Nous avons testé les meilleurs trackers Bluetooth (y compris les aéragères et les trackers de carreaux) pour garder un œil sur vos effets personnels, que vous utilisiez iOS ou Android.
We tested the best Bluetooth trackers (including AirTags and Tile trackers) to keep tabs on your belongings, whether you use iOS or Android. |
Mobile | ||
|
2024-06-03 15:50:00 | Le chercheur découvre les défauts des modems COX, ce qui a un impact sur des millions Researcher Uncovers Flaws in Cox Modems, Potentially Impacting Millions (lien direct) |
Les problèmes de contournement de l'autorisation désormais réglés ont un impact sur les modems COX qui auraient pu être maltraités comme point de départ pour obtenir un accès non autorisé aux appareils et exécuter des commandes malveillantes.
"Cette série de vulnérabilités a démontré un moyen par lequel un attaquant entièrement externe sans aucune condition préalable pouvait \\ 'a exécuté des commandes et modifié les paramètres de millions de modes, accéder à n'importe quel client commercial \' s.
Now-patched authorization bypass issues impacting Cox modems that could have been abused as a starting point to gain unauthorized access to the devices and run malicious commands. "This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could\'ve executed commands and modified the settings of millions of modems, accessed any business customer\'s |
Vulnerability | ||
|
2024-06-03 15:43:55 | Live Nation confirme la violation de Ticketmaster après les pirates Hawk volés des informations de 560 millions Live Nation confirms Ticketmaster breach after hackers hawk stolen info of 560 million (lien direct) |
Les problèmes de contournement de l'autorisation désormais réglés ont un impact sur les modems COX qui auraient pu être maltraités comme point de départ pour obtenir un accès non autorisé aux appareils et exécuter des commandes malveillantes.
"Cette série de vulnérabilités a démontré un moyen par lequel un attaquant entièrement externe sans aucune condition préalable pouvait \\ 'a exécuté des commandes et modifié les paramètres de millions de modes, accéder à n'importe quel client commercial \' s.
Now-patched authorization bypass issues impacting Cox modems that could have been abused as a starting point to gain unauthorized access to the devices and run malicious commands. "This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could\'ve executed commands and modified the settings of millions of modems, accessed any business customer\'s |
|||
 |
2024-06-03 15:30:28 | Forrester nomme Palo Alto Networks un leader de XDR Forrester Names Palo Alto Networks a Leader in XDR (lien direct) |
> Palo Alto Networks a été nommé leader dans les plates-formes de détection et de réponse étendues de Forrester pour Cortex Xdr.
>Palo Alto Networks was named a leader in extended detection and response platforms by Forrester for Cortex XDR. |
Commercial | ||
 |
2024-06-03 15:00:00 | Menace Unleashed: Excel File déploie la grève de Cobalt à l'Ukraine Menace Unleashed: Excel File Deploys Cobalt Strike at Ukraine (lien direct) |
Fortiguard Labs a récemment identifié une cyberattaque sophistiquée impliquant un fichier Excel intégré à une macro VBA conçue pour déployer un fichier DLL.Apprendre encore plus.
FortiGuard Labs has recently identified a sophisticated cyberattack involving an Excel file embedded with a VBA macro designed to deploy a DLL file. Learn more. |
|||
 |
2024-06-03 14:45:00 | Les ransomwares augmentent malgré les démontages des forces de l'ordre Ransomware Rises Despite Law Enforcement Takedowns (lien direct) |
L'activité des ransomwares a augmenté en 2023, en partie alimentée par de nouveaux groupes et des partenariats entre les groupes, Mandiant a observé
Ransomware activity rose in 2023, partly fueled by new groups and partnerships between groups, Mandiant has observed |
Ransomware Legislation | ||
 |
2024-06-03 14:31:39 | Quoi considérer lors de l'évaluation de l'EDR What to consider when evaluating EDR (lien direct) |
Notre nouveau guide d'évaluation éduque les professionnels de la sécurité sur ce qu'ils devraient rechercher dans une plateforme de détection et de réponse (EDR) (EDR)
Our new evaluation guide educates security professionals on what they should look for in an endpoint detection and response (EDR) platform |
|||
 |
2024-06-03 14:24:32 | Migration Cloud : comment Back Market est passé d\'AWS à Google Cloud (lien direct) | Back Market a finalisé le gros de sa migration vers Google Cloud, après quasiment dix ans chez AWS. Retour d'expérience. | Cloud | ||
 |
2024-06-03 14:05:06 | Comment rester en sécurité contre les escroqueries en voyageant How to Stay Safe Against Scams While Traveling (lien direct) |
> 
Après une année de voyage tourbillonnante en 2023, 40% des Américains se préparent pour encore plus d'aventures en 2024 ....
> 
Following a whirlwind year of travel in 2023, 40% of Americans are gearing up for even more adventures in 2024....
|
|||
 |
2024-06-03 14:03:42 | Faits saillants hebdomadaires, 3 juin 2024 Weekly OSINT Highlights, 3 June 2024 (lien direct) |
## Snapshot Last week\'s OSINT reporting reveals a landscape of diverse cyber threats characterized by sophisticated attack tactics and adaptable threat actors. One key trend is the exploitation of popular platforms and applications, such as the Google Play store, fake Arc browser ads, and TXZ file attachments in malspam campaigns. Phishing and social engineering attacks also featured prominently this week, exemplified by piano-themed scams and phishing emails masquerading as PDF viewer login pages. Threat actors range from organized APT groups like LilacSquid and Andariel Group (tracked by Microsoft as Onyx Sleet) to financially motivated cybercriminals conducting advance fee fraud scams and phishing attacks. The targets are equally varied, spanning financial institutions, government departments, educational institutions, and sectors like IT, energy, and pharmaceuticals. These articles underscore the growing use of advanced techniques, such as leveraging AI for influence operations, exploiting software features like BitLocker for encryption attacks, and introducing backdoors through supply chain compromises. This highlights the evolving threat landscape where attackers continuously refine their methods to exploit both technological advancements and human vulnerabilities. ## Description 1. [Over 90 Malicious Apps Identified on Google Play Store](https://security.microsoft.com/intel-explorer/articles/e21eabb7): Zscaler ThreatLabz discovered over 90 malicious apps on Google Play, primarily distributing Anatsa malware targeting banking credentials through overlay and accessibility techniques. The malware, affecting financial institutions in various countries, evades detection and communicates with C2 servers to steal user credentials. 2. [Arc Browser Targeted by Malvertising Campaign](https://security.microsoft.com/intel-explorer/articles/9dd6578a): Cybercriminals launched a malvertising campaign impersonating the Arc browser to distribute malware, tricking users with official-looking ads. The malware is stealthily installed alongside the legitimate browser, making detection difficult as it contacts MEGA cloud services for malicious activities. 3. [VBScript Exploits BitLocker for Unauthorized Encryption](https://security.microsoft.com/intel-explorer/articles/7589c689): Kaspersky researchers identified an advanced VBScript exploiting BitLocker to encrypt unauthorized files, targeting systems in Mexico, Indonesia, and Jordan. The script gathers OS information, manipulates disk partitions, and uses a unique encryption key, effectively locking victims out of their data without recovery options. 4. [Piano-Themed AFF Scams Target North American Universities](https://security.microsoft.com/intel-explorer/articles/0bd219dd): Proofpoint uncovered email campaigns using piano-themed messages to lure victims into advance fee fraud scams, primarily targeting North American educational institutions. Threat actors demand shipping payments for fake pianos and collect personal information, with the scams generating significant financial transactions. 5. [TXZ Extension Used in Regionally Targeted Malspam Campaigns](https://security.microsoft.com/intel-explorer/articles/e9845916): SANS Internet Storm Center researchers found threat actors using TXZ extension files as malspam attachments in campaigns targeting regions like Spain, Slovakia, Croatia, and Czechia. The renamed RAR archives distribute malware like GuLoader and FormBook, leveraging Windows 11\'s native support for these file types. 6. [Phishing Emails Masquerade as PDF Viewer Login Pages](https://sip.security.microsoft.com/intel-explorer/articles/01780949): Forcepoint warns of phishing emails targeting Asia-Pacific government departments, using fake PDF viewer login pages to harvest credentials. The emails contain obfuscated JavaScript, redirecting victims to fake invoice pages and stealing their login information. 7. [LilacSquid APT Targets Diverse Sectors for Data Theft](https://security.microsoft.com/intel-explorer/articles/39e87f2a): Cisco Talos | Malware Tool Vulnerability Threat Industrial Prediction Cloud | ||
|
2024-06-03 14:00:14 | Le principal parti d'opposition de l'Allemagne a été frappé par \\ 'Serious \\' Cyberattack Germany\\'s main opposition party hit by \\'serious\\' cyberattack (lien direct) |
## Snapshot Last week\'s OSINT reporting reveals a landscape of diverse cyber threats characterized by sophisticated attack tactics and adaptable threat actors. One key trend is the exploitation of popular platforms and applications, such as the Google Play store, fake Arc browser ads, and TXZ file attachments in malspam campaigns. Phishing and social engineering attacks also featured prominently this week, exemplified by piano-themed scams and phishing emails masquerading as PDF viewer login pages. Threat actors range from organized APT groups like LilacSquid and Andariel Group (tracked by Microsoft as Onyx Sleet) to financially motivated cybercriminals conducting advance fee fraud scams and phishing attacks. The targets are equally varied, spanning financial institutions, government departments, educational institutions, and sectors like IT, energy, and pharmaceuticals. These articles underscore the growing use of advanced techniques, such as leveraging AI for influence operations, exploiting software features like BitLocker for encryption attacks, and introducing backdoors through supply chain compromises. This highlights the evolving threat landscape where attackers continuously refine their methods to exploit both technological advancements and human vulnerabilities. ## Description 1. [Over 90 Malicious Apps Identified on Google Play Store](https://security.microsoft.com/intel-explorer/articles/e21eabb7): Zscaler ThreatLabz discovered over 90 malicious apps on Google Play, primarily distributing Anatsa malware targeting banking credentials through overlay and accessibility techniques. The malware, affecting financial institutions in various countries, evades detection and communicates with C2 servers to steal user credentials. 2. [Arc Browser Targeted by Malvertising Campaign](https://security.microsoft.com/intel-explorer/articles/9dd6578a): Cybercriminals launched a malvertising campaign impersonating the Arc browser to distribute malware, tricking users with official-looking ads. The malware is stealthily installed alongside the legitimate browser, making detection difficult as it contacts MEGA cloud services for malicious activities. 3. [VBScript Exploits BitLocker for Unauthorized Encryption](https://security.microsoft.com/intel-explorer/articles/7589c689): Kaspersky researchers identified an advanced VBScript exploiting BitLocker to encrypt unauthorized files, targeting systems in Mexico, Indonesia, and Jordan. The script gathers OS information, manipulates disk partitions, and uses a unique encryption key, effectively locking victims out of their data without recovery options. 4. [Piano-Themed AFF Scams Target North American Universities](https://security.microsoft.com/intel-explorer/articles/0bd219dd): Proofpoint uncovered email campaigns using piano-themed messages to lure victims into advance fee fraud scams, primarily targeting North American educational institutions. Threat actors demand shipping payments for fake pianos and collect personal information, with the scams generating significant financial transactions. 5. [TXZ Extension Used in Regionally Targeted Malspam Campaigns](https://security.microsoft.com/intel-explorer/articles/e9845916): SANS Internet Storm Center researchers found threat actors using TXZ extension files as malspam attachments in campaigns targeting regions like Spain, Slovakia, Croatia, and Czechia. The renamed RAR archives distribute malware like GuLoader and FormBook, leveraging Windows 11\'s native support for these file types. 6. [Phishing Emails Masquerade as PDF Viewer Login Pages](https://sip.security.microsoft.com/intel-explorer/articles/01780949): Forcepoint warns of phishing emails targeting Asia-Pacific government departments, using fake PDF viewer login pages to harvest credentials. The emails contain obfuscated JavaScript, redirecting victims to fake invoice pages and stealing their login information. 7. [LilacSquid APT Targets Diverse Sectors for Data Theft](https://security.microsoft.com/intel-explorer/articles/39e87f2a): Cisco Talos | |||
|
2024-06-03 14:00:00 | CISA \\ est Secure by Design Initiative à 1: une carte de rapport CISA\\'s Secure by Design Initiative at 1: A Report Card (lien direct) |
Il y a plus à faire, mais jusqu'à présent, l'initiative est un succès.
There is more that needs to be done, but, so far, the initiative is a success. |
|||
 |
2024-06-03 14:00:00 | Ransomwares rebonds: la menace d'extorsion augmente en 2023, les attaquants s'appuient sur les outils accessibles au public et légitimes Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools (lien direct) |
Written by: Bavi Sadayappan, Zach Riddle, Jordan Nuce, Joshua Shilko, Jeremy Kennelly
A version of this blog post was published to the Mandiant Advantage portal on April 18, 2024. Executive Summary In 2023, Mandiant observed an increase in ransomware activity as compared to 2022, based on a significant rise in posts on data leak sites and a moderate increase in Mandiant-led ransomware investigations. Mandiant observed an increase in the proportion of new ransomware variants compared to new families, with around one third of new families observed in 2023 being variants of previously identified ransomware families. Actors engaged in the post-compromise deployment of ransomware continue to predominately rely on commercially available and legitimate tools to facilitate their intrusion operations. Notably, we continue to observe a decline in the use of Cobalt Strike BEACON, and a corresponding increase in the use of legitimate remote access tools. In almost one third of incidents, ransomware was deployed within 48 hours of initial attacker access. Seventy-six percent (76%) of ransomware deployments took place outside of work hours, with the majority occurring in the early morning. Mandiant\'s recommendations to assist in addressing the threat posed by ransomware are captured in our Ransomware Protection and Containment Strategies: Practical Guidance for Hardening and Protecting Infrastructure, Identities and Endpoints white paper. Introduction Threat actors have remained driven to conduct ransomware operations due to their profitability, particularly in comparison to other types of cyber crime. Mandiant observed an increase in ransomware activity in 2023 compared to 2022, including a 75% increase in posts on data leak sites (DLS), and an over 20% increase in Mandiant-led investigations involving ransomware from 2022 to 2023 (Figure 1). These observations are consistent with other reporting, which shows a record-breaking more than $1 billion USD paid to ransomware attackers in 2023. This illustrates that the slight dip in extortion activity observed in 2022 was an anomaly, potentially due to factors such as the invasion of Ukraine and the leaked CONTI chats. The current resurgence in extortion activity is likely driven by various factors, including the resettling of the cyber criminal ecosystem following a tumultuous year in 2022, new entrants, and new partnerships and ransomware service offerings by actors previously associated with prolific groups that had been disrupted. This blog post provides an overview of the ransomware landscape and common tactics, techniques, and procedures (TTPs) directly observed by Mandiant in 2023 ransomware incidents. Our analysis of TTPs relies primarily on data from Mandiant incident response engagements and therefore represe |
Ransomware Data Breach Spam Malware Tool Vulnerability Threat Legislation Prediction Medical Cloud Commercial | ||
|
2024-06-03 13:59:32 | SpeedCast lance une nouvelle application de cybersécurité avec Cydome Speedcast Launches New Cybersecurity Application with Cydome (lien direct) |
SpeedCast lance une nouvelle application de cybersécurité avec CyDome pour aider les clients maritimes à se conformer aux exigences réglementaires croissantes
Le partenariat avec Cydome offre une protection avancée à l'échelle de la cybersécurité à l'échelle de la flotte pour permettre la conformité aux réglementations IACS, États-Unis et de l'Union européenne en vigueur en 2024
-
revues de produits
Speedcast Launches New Cybersecurity Application with Cydome to Help Maritime Customers Comply with Growing Regulatory Requirements Partnership with Cydome provides advanced, fleet-wide cybersecurity protection to enable compliance with IACS, US and European Union regulations going into force in 2024 - Product Reviews |
|||
|
2024-06-03 13:54:31 | INQUEST et OXIBOX unissent leurs forces (lien direct) | INQUEST et OXIBOX unissent leurs forces pour renforcer la résilience des entreprises face aux cyberattaques - Business | |||
 |
2024-06-03 13:11:06 | Identités des cybercriminels liés aux chargeurs de logiciels malveillants révélés Identities of Cybercriminals Linked to Malware Loaders Revealed (lien direct) |
> Les forces de l'ordre révèlent l'identité de huit cybercriminels liés à des chargeurs de logiciels malveillants récemment perturbés.
>Law enforcement reveals the identities of eight cybercriminals linked to recently disrupted malware loaders. |
Malware Legislation | ||
 |
2024-06-03 13:06:36 | À l'intérieur de la boîte: le nouveau terrain de jeu de Malware \\ Inside the Box: Malware\\'s New Playground (lien direct) |
> Recherche de: & # 160; Jiri Vinopal met en évidence: Introduction Au cours des derniers mois, nous avons surveillé les abus croissants de & # 160; BoxedApp & # 160; Products in the Wild.Les produits BoxEdApp sont des emballeurs commerciaux qui fournissent des fonctionnalités avancées telles que le stockage virtuel (système de fichiers virtuels, le registre virtuel), les processus virtuels et un système d'instrumentation universel (crochement de l'API WIN / NT).Même si BoxedApp a été commercialement [& # 8230;]
>Research by: Jiri Vinopal Highlights: Introduction Over the past few months, we have been monitoring the increasing abuse of BoxedApp products in the wild. BoxedApp products are commercial packers that provide advanced features such as Virtual Storage (Virtual File System, Virtual Registry), Virtual Processes, and a universal instrumentation system (WIN/NT API hooking). Even though BoxedApp has been commercially […] |
Malware Commercial | ||
|
2024-06-03 13:04:00 | Les pirates Andariel ciblent les instituts sud-coréens avec un nouveau logiciel malveillant Dora Rat Andariel Hackers Target South Korean Institutes with New Dora RAT Malware (lien direct) |
L'acteur de menaces en Corée du Nord connue sous le nom d'Andariel a été observé à l'aide d'une nouvelle porte dérobée basée à Golang appelée Dora Rat dans ses attaques ciblant les instituts d'enseignement, les entreprises manufacturières et les entreprises de construction en Corée du Sud.
"Keylogger, infostealer et outils de procuration au-dessus de la porte dérobée ont été utilisés pour les attaques", a déclaré le Rapport Ahnlab Security Intelligence Center (ASEC) dans un rapport
The North Korea-linked threat actor known as Andariel has been observed using a new Golang-based backdoor called Dora RAT in its attacks targeting educational institutes, manufacturing firms, and construction businesses in South Korea. "Keylogger, Infostealer, and proxy tools on top of the backdoor were utilized for the attacks," the AhnLab Security Intelligence Center (ASEC) said in a report |
Malware Tool Threat | ||
|
2024-06-03 12:56:15 | Les efforts d'influence russe convergent les Jeux olympiques de Paris 2024 Russian Influence efforts converge on 2024 Paris Olympics Games (lien direct) |
## Snapshot In the summer of 2023, a curious set of videos crept into social media platforms. Telegram feeds that normally promoted pro-Kremlin narratives suddenly began promoting a film called “Olympics Has Fallen.” Users were encouraged to scan a QR code that directed them to a Telegram channel of the same name. Upon arriving at this channel, viewers encountered a feature-length film with a similar aesthetic and a play on the title of the American political action movie “Olympus Has Fallen,” released more than a decade earlier.(1) AI-generated audio impersonating the voice of film actor Tom Cruise narrated a strange, meandering script disparaging the International Olympic Committee\'s leadership. Nearly a year later and with less than 80 days until the opening of the 2024 Paris Olympic Games, the Microsoft Threat Analysis Center (MTAC) has observed a network of Russia-affiliated actors pursuing a range of malign influence campaigns against France, French President Emmanuel Marcon, the International Olympic Committee (IOC), and the Paris Games. These campaigns may forewarn coming online threats to this summer\'s international competition. ## Activity Overview ### Russia\'s long history of disparaging the Olympic Games Modern Russia, as well as its predecessor the Soviet Union, has a longstanding tradition of seeking to undermine the Olympic Games. If they cannot participate in or win the Games, then they seek to undercut, defame, and degrade the international competition in the minds of participants, spectators, and global audiences. The Soviet Union boycotted the 1984 Summer Games held in Los Angeles and sought to influence other countries to do the same. US State Department officials linked Soviet actors to a campaign that covertly distributed leaflets to Olympic committees in countries including Zimbabwe, Sri Lanka, and South Korea.(2) The leaflets claimed non-white competitors would be targeted by US extremists-a claim that follows a tried-and-true active measures strategy: using divisive social issues to sow discord among a target audience.(3) A recurring aspect of Russian malign influence is its ability to resurface themes at a later time in a different country. Remarkably, four decades later, we are witnessing similar claims of anticipated extremist violence emerging in the context of the Paris Games this summer. Separately, in 2016, Russian hackers penetrated the World Anti-Doping Agency and revealed private medical information about American athletes Serena Williams, Venus Williams, and Simone Biles.(4) Two years later, the “Olympic Destroyer” cyberattack against the 2018 Winter Olympics in Pyeongchang, South Korea, managed to take some of the Winter Games\' internal servers offline. The US Department of Justice charged two Russian GRU officers in connection to the hack in 2020.(5) The slow burn of Russian President Vladimir Putin and the Kremlin\'s displeasure with the IOC and the ability to participate in the Olympics-an event of longstanding pride to the Russian government-has intensified in recent years. In 2017, the IOC concluded extensive investigations into Russia\'s state-sponsored use of performance-enhancing drugs across several Olympic Games in 2017 which resulted in Russia being formally barred from participating in the 2018 Winter Games.(6) Last year, in 2023, the IOC confirmed that Russian citizens would be allowed to compete in Paris but only as neutral athletes prohibited from sporting the flag or colors of the Russian Federation.(7) Shortly after this decision, MTAC began detecting a range of foreign malign influence operations that continue today, and we suspect may intensify as the 2024 Paris Opening Ceremony approaches.(8) ### Old world tactics meet the age of AI Starting in June 2023, prolific Russian influence actors-which Microsoft tracks as Storm-1679 and Storm-1099-pivoted their operations to take aim at the 2024 Olympic Games and French President Emmanuel Macron. These ongoing Russian influence operations have two cent | Hack Tool Threat Legislation Medical | ||
|
2024-06-03 12:41:53 | Aperçus du rapport annuel de référence sur l\'hameçonnage de KnowBe4 - Naviguer dans les cybermenaces en Afrique (lien direct) | Aperçus du rapport annuel de référence sur l'hameçonnage de KnowBe4 - Naviguer dans les cybermenaces en Afrique Le rapport montre un lien clair entre la formation sur la sensibilisation à la sécurité et les tests simulés d'hameçonnage pour une meilleure résilience face aux cybermenaces Accéder au contenu multimédia - Malwares | |||
|
2024-06-03 12:38:05 | Opération " Endgame " - Décrypter les enjeux de la cybersécurité avec les experts AntemetA (lien direct) | Opération " Endgame " - Décrypter les enjeux de la cybersécurité avec les experts AntemetA - Malwares | |||
|
2024-06-03 12:25:01 | Live Nation confirme la violation massive de données Ticketmaster Live Nation Confirms Massive Ticketmaster Data Breach (lien direct) |
> Par waqas
Dans un dossier de la SEC, Live Nation Entertainment a confirmé que sa filiale Ticketmaster a subi une violation de données, affirmant qu'elle va & # 8230;
Ceci est un article de HackRead.com Lire le post original: live nationConfirme la violation de données massive de Ticketmaster
>By Waqas In an SEC filing, Live Nation Entertainment confirmed its subsidiary Ticketmaster suffered a data breach, claiming it will… This is a post from HackRead.com Read the original post: Live Nation Confirms Massive Ticketmaster Data Breach |
Data Breach | ||
|
2024-06-03 12:13:37 | 3 juin & # 8211;Rapport de renseignement sur les menaces 3rd June – Threat Intelligence Report (lien direct) |
> Pour les dernières découvertes de cyber-recherche pour la semaine du 3 juin, veuillez télécharger notre bulletin menace_intelligence.Attaques et violations de Top Attacks et Breach Shinyhunters, un gang notoire de cybercriminalité offerte à la vente sur un forum de cybercriminalité de Ticketmaster, une société de vente de billets et de distribution, et de Santander Bank.Les violations présumées ont entraîné une exposition potentielle [& # 8230;]
>For the latest discoveries in cyber research for the week of 3rd June, please download our Threat_Intelligence Bulletin. TOP ATTACKS AND BREACHES ShinyHunters, a notorious cybercrime gang offered for sale on a cybercrime forum data of Ticketmaster, ticket sales and distribution company, and of Santander bank. The alleged breaches have resulted in the potential exposure […] |
Threat | ||
|
2024-06-03 12:05:25 | Formations au numérique : le Cigref appelle à lever le nez du guidon (lien direct) | Ayant interrogé des collaborateurs d'organisations membres, le Cigref dresse son bilan de l'adéquation des formations aux métiers du numérique. | |||
 |
2024-06-03 12:00:46 | XDR signifie bien plus que certains ne le réalisent XDR means so much more than some may realize (lien direct) |
Découvrez comment Cisco XDR redéfinit la sécurité avec les outils intégrés, la détection des menaces à AI-AI et la réponse rapide pour résoudre les problèmes du monde réel pour le SOC 
Discover how Cisco XDR redefines security with integrated tools, AI-driven threat detection, and rapid response to solve real-world problems for the SOC  |
Tool Threat | ||
|
2024-06-03 11:55:28 | La résilience n'est pas assez, l'OTAN doit être \\ 'proactive \\' pour la cyberdéfense, avertit un fonctionnaire Resilience isn\\'t enough, NATO must be \\'proactive\\' for cyberdefense, warns official (lien direct) |
Découvrez comment Cisco XDR redéfinit la sécurité avec les outils intégrés, la détection des menaces à AI-AI et la réponse rapide pour résoudre les problèmes du monde réel pour le SOC
Discover how Cisco XDR redefines security with integrated tools, AI-driven threat detection, and rapid response to solve real-world problems for the SOC |
|||
 |
2024-06-03 11:37:25 | Les utilisateurs de Verizon signalent des photos floues dans les applications de messagerie Android Verizon users report blurry photos in Android messaging apps (lien direct) |
Les clients de Verizon utilisant des téléphones Android rapportent qu'ils reçoivent des images floues via des messages texte sur différents services et applications, sans réponse de Verizon sur pourquoi.[...]
Verizon customers using Android phones report that they receive blurry images through text messages on different services and apps, with no response from Verizon as to why. [...] |
Mobile | ||
 |
2024-06-03 11:06:54 | Voir comme une structure de données Seeing Like a Data Structure (lien direct) |
La technologie était autrefois un outil & # 8212; et un petit à cela & # 8212; utilisé pour Amplifiez l'intention humaine de l'intention humaineet capacité .C'était l'histoire de la révolution industrielle: nous pouvions contrôler la nature et construire de grandes sociétés humaines complexes, et plus nous employons et maîtrisons la technologie, mieux les choses sont devenues.Nous ne vivons plus dans ce monde.Non seulement la technologie est enchevêtrée avec la structure de la société, mais nous ne pouvons plus voir le monde qui nous entoure sans lui.La séparation a disparu et le contrôle que nous pensions que nous avions autrefois révélé comme un mirage.Nous & # 8217; re dans une période de transition de l'histoire en ce moment ...
Technology was once simply a tool—and a small one at that—used to amplify human intent and capacity. That was the story of the industrial revolution: we could control nature and build large, complex human societies, and the more we employed and mastered technology, the better things got. We don’t live in that world anymore. Not only has technology become entangled with the structure of society, but we also can no longer see the world around us without it. The separation is gone, and the control we thought we once had has revealed itself as a mirage. We’re in a transitional period of history right now... |
Industrial | APT 15 | |
|
2024-06-03 11:04:18 | L'IA augmentera la quantité et la qualité de phishing des escroqueries AI Will Increase the Quantity-and Quality-of Phishing Scams (lien direct) |
Une pièce que j'ai co-auteur avec Fredrik Heiding et Arun Vishwanath dans la Harvard Business Review :
Résumé. Les outils Gen AI rendent rapidement ces e-mails plus avancés, plus difficiles à repérer et beaucoup plus dangereux.Des recherches récentes ont montré que 60% des participants ont été victimes de phishing de l'intelligence artificielle (IA), ce qui est comparable aux taux de réussite des messages non phisvulaires créés par des experts humains.Les entreprises doivent: 1) comprendre les capacités asymétriques du phishing amélioré, 2) Déterminer le niveau de gravité de la menace de phishing de l'entreprise ou de la division, et 3) confirment leurs routines actuelles de sensibilisation au phishing ...
A piece I coauthored with Fredrik Heiding and Arun Vishwanath in the Harvard Business Review: Summary. Gen AI tools are rapidly making these emails more advanced, harder to spot, and significantly more dangerous. Recent research showed that 60% of participants fell victim to artificial intelligence (AI)-automated phishing, which is comparable to the success rates of non-AI-phishing messages created by human experts. Companies need to: 1) understand the asymmetrical capabilities of AI-enhanced phishing, 2) determine the company or division\'s phishing threat severity level, and 3) confirm their current phishing awareness routines... |
Tool Threat | ||
 |
2024-06-03 11:00:00 | Ransomware a vu une résurgence en 2023, rapporte Mandiant Ransomware saw a resurgence in 2023, Mandiant reports (lien direct) |
> La société de cybersécurité a déclaré avoir vu une augmentation de l'activité des gangs de ransomware l'année dernière après une «légère baisse» de l'activité en 2022.
>The cybersecurity firm said it saw an increase in activity from ransomware gangs last year after a “slight dip” in activity in 2022. |
Ransomware | ||
|
2024-06-03 10:52:22 | Snowflake Data Breach a un impact sur Ticketmaster, d'autres organisations Snowflake Data Breach Impacts Ticketmaster, Other Organizations (lien direct) |
> Ticketmaster et d'autres organisations ont été affectées par une violation de données sur la plate-forme de données Cloud AI Snowflake.
>Ticketmaster and other organizations have been affected by a data breach at cloud AI data platform Snowflake. |
Data Breach Cloud | ||
|
2024-06-03 10:30:00 | École britannique obligée de fermer après la cyberattaque UK School Forced to Close Following Cyber-Attack (lien direct) |
L'école Billericay d'Essex a informé les parents qu'il était fermé aux élèves après que ses systèmes informatiques ont été compromis et rendus inaccessibles par une cyber-attaque
The Billericay School in Essex informed parents that it is closed to students after its IT systems were compromised and made inaccessible by a cyber-attack |
|||
|
2024-06-03 10:29:51 | Le nouveau kit de phishing V3B vole les connexions et les OTP des utilisateurs bancaires de l'UE New V3B Phishing Kit Steals Logins and OTPs from EU Banking Users (lien direct) |
> Par deeba ahmed
Le nouveau kit de phishing cible les utilisateurs de la Banque européenne!Protégez-vous des attaques V3B conçues pour voler vos connexions et & # 8230;
Ceci est un article de HackRead.com Lire la publication originale: Nouveau kit de phishing V3B vole les connexions et les OTP des utilisateurs bancaires de l'UE
>By Deeba Ahmed New phishing kit targets European bank users! Protect yourself from V3B attacks designed to steal your logins and… This is a post from HackRead.com Read the original post: New V3B Phishing Kit Steals Logins and OTPs from EU Banking Users |
|||
|
2024-06-03 10:14:48 | Atos : deux scénarios retenus pour la relance (lien direct) | Deux offres pour la reprise d'Atos ont été acceptées par son conseil d'administration : celles portées par le groupe EPEI de Daniel Krétinsky et par l'ESN Onepoint. La réponse est attendue pour le 5 juin. | |||
 |
2024-06-03 10:00:46 | Il est de menace l'évolution au premier trimestre 2024. Statistiques mobiles IT threat evolution in Q1 2024. Mobile statistics (lien direct) |
Statistiques de logiciels malveillants mobiles pour le premier trimestre 2024: menaces les plus courantes pour Android, les chevaux de Troie des banques mobiles et les chevaux de Troie ransomwares.
Mobile malware statistics for Q1 2024: most common threats for Android, mobile banking Trojans, and ransomware Trojans. |
Ransomware Malware Threat Mobile | ||
|
2024-06-03 10:00:27 | It menace évolution Q1 2024 IT threat evolution Q1 2024 (lien direct) |
Dans ce rapport, nous passons en revue les événements les plus importants liés aux logiciels malveillants du T1 2024: la divulgation de la vulnérabilité matérielle utilisée dans la triangulation de l'opération, une méthode légère pour détecter les logiciels malveillants iOS et l'implant Linux Dinodasrat.
In this report, we review the most significant malware-related events of Q1 2024: the disclosure of the hardware vulnerability used in Operation Triangulation, a lightweight method to detect iOS malware and DinodasRAT Linux implant. |
Malware Vulnerability Threat | ||
|
2024-06-03 10:00:08 | Il menace l'évolution au premier trimestre 2024. Statistiques non mobiles IT threat evolution in Q1 2024. Non-mobile statistics (lien direct) |
Dans ce rapport, Kaspersky partage des statistiques de logiciels malveillants non mobiles pour le premier trimestre 2024, y compris les statistiques de ransomware, de mineurs et de malware macOS.
In this report, Kaspersky shares non-mobile malware statistics for Q1 2024, including ransomware, miner and macOS malware statistics. |
Ransomware Malware Threat | ||
 |
2024-06-03 10:00:00 | Test de sécurité dans le développement de logiciels: évaluer les vulnérabilités et les faiblesses Security Testing in Software Development: Assessing Vulnerabilities and Weaknesses (lien direct) |
The content of this post is solely the responsibility of the author. LevelBlue does not adopt or endorse any of the views, positions, or information provided by the author in this article. The critical role of security testing within software development cannot be overstated. From protecting personal information to ensuring that critical infrastructure remains unbreachable, security testing serves as the sentry against a multitude of cyber threats. Vulnerabilities and design weaknesses within software are like hidden fault lines; they may remain unnoticed until they cause significant damage. These flaws can compromise sensitive data, allow unauthorized access, and disrupt service operations. The repercussions extend beyond the digital world. They can lead to tarnished reputations, legal penalties, and, in extreme cases, endangerment of lives. Understanding these potential impacts underscores the crucial role of security testing as a protective measure. Security testing functions like a health check-up for software, identifying vulnerabilities in much the same way a doctor\'s examination would. Being proactive rather than reactive is essential here. It is always better to prevent than to cure. Security testing transcends the mere act of box-ticking; it is a vital, multi-layered process that protects both the integrity of the software and the privacy of its users. And it is not only about finding faults but also about instilling a culture of security within the development lifecycle. Understanding Security Testing Once more, the primary role of security testing is to identify and help fix security flaws within a system before they can be exploited. Consider it a comprehensive evaluation process that simulates real-world attacks, designed to ensure that the software can withstand and counter a variety of cybersecurity threats. By conducting security testing, developers can provide assurance to investors and users that their software is not only functional but also secure against different attacks. There is a diverse arsenal of methodologies available for security testing: 1) Penetration Testing Penetration testing, also known as ethical hacking, entails conducting simulated cyber-attacks on computer systems, networks, or web applications to uncover vulnerabilities that could be exploited. Security experts use pentest platforms and act as attackers and try to breach the system\'s defenses using various techniques. This method helps uncover real-world weaknesses as well as the potential impact of an attack on the system\'s resources and data. 2) Code Review A code review is a systematic examination of the application source code to detect security flaws, bugs, and other errors that might have been overlooked during the initial development phases. It involves manually reading through the code or using automated tools to ensure compliance with coding standards and to check for security vulnerabilities. This process helps in maintaining a high level of security by ensuring that the code is clean, efficient, and robust against cyber threats. 3) Vulnerability Assessment Unlike penetration testing, which attempts to exploit vulnerabilities, vulnerability assessment focuses on listing potential vulnerabilities without simulating attacks. Tools and software are used to | Tool Vulnerability Threat | Equifax |
To see everything:
