What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-05-13 13:30:14 | Faits saillants hebdomadaires, 13 mai 2024 Weekly OSINT Highlights, 13 May 2024 (lien direct) |
## Instantané La semaine dernière, les rapports de \\ de OSINT mettent en évidence une gamme de cyber-menaces et de tactiques d'attaque en évolution orchestrée par des acteurs de menace sophistiqués.Les articles discutent d'une variété de vecteurs d'attaque, notamment l'exploitation des vulnérabilités logicielles (comme dans les appliances VPN Secure Ivanti Secure et Laravel), le malvertissant via Google Search Ads et les invites de mise à jour de navigateur trompeuses utilisées pour distribuer des logiciels malveillants comme Socgholish.Les acteurs de la menace identifiés dans ces rapports, y compris des groupes APT comme APT42 (Mint Sandstorm) et Kimsuky (Emerald Sleet), démontrent des tactiques d'ingénierie sociale avancées, des portes dérobées et des efforts de reconnaissance persistants ciblant les ONG, les organisations de médias et les entreprises.Les attaquants exploitent les sites Web compromis, les plateformes de médias sociaux et les outils de gestion du système pour établir des anciens et exécuter des commandes distantes, soulignant la nécessité de défenses de cybersécurité robustes et une vigilance accrue pour lutter efficacement ces menaces en évolution. ## Description 1. ** [Nouvelle chaîne d'infection associée à Darkgate Malware] (https://security.microsoft.com/intel-explorer/articles/1db83f2c) **: Les chercheurs de McAfee Labs ont découvert une nouvelle chaîne d'infection liée à Darkgate, une télécommandeAccès à Trojan (rat) commercialisé sur un forum de cybercriminalité en langue russe.Darkgate utilise des fonctionnalités diverses comme l'injection de processus, le keylogging et le vol de données, et il échappe à la détection en utilisant des tactiques d'évasion comme le contournementMicrosoft Defender SmartScreen. 2. ** [Évolution du chargeur de logiciels malveillants Hijackloader] (https://security.microsoft.com/intel-explorer/Articles / 8c997d7c) **: Zscaler rapporte sur l'évolution de Hijackloader, un chargeur de logiciels malveillants modulaire avec de nouvelles techniques d'évasion ciblant l'antivirus Windows Defender et le contrôle des comptes d'utilisateurs (UAC).Hijackloader offre diverses familles de logiciels malveillants comme Amadey, Lumma Stealer et Remcos Rat grâce à des techniques impliquant des images PNG et un décryptage. 3. ** [Kimsuky Group \'s (Emerald Sleet) Sophistiqué Espionage Tactics] (https://security.microsoft.com/intel-explorer/articles/6e7f4a30) **: Kimsuky (suivi sous le nom de Sleet Emerald par Microsoft)Emploie les plateformes de médias sociaux et les outils de gestion des systèmes pour l'espionnage, ciblant les individus des droits de l'homme et des affaires de la sécurité nord-coréennes.Ils utilisent de faux profils Facebook, de faux entretiens d'embauche et des fichiers malveillants de la console de gestion Microsoft (MMC) pour exécuter des commandes distantes et établir des canaux de commande et de contrôle (C2). 4. ** [Distribution des logiciels malveillants via Google Search Ads Exploitation] (https://security.microsoft.com/intel-explorer/articles/1f1ae96f): ** Les acteurs de la menace tirent parti des annonces de recherche Google pour distribuer des logiciels malveillants via des packages MSI, la mascarradagecomme un logiciel légitime comme la notion.Lors de l'interaction, les scripts PowerShell s'exécutent pour injecter des logiciels malveillants Zgrat, démontrant des techniques sophistiquées pour contourner les mesures de sécurité et contrôler les systèmes infectés. 5. **[Exploitation of Ivanti Pulse Secure VPN Vulnerabilities](https://security.microsoft.com/intel-explorer/articles/2d95eb1b):** Attackers exploit vulnerabilities (CVE-2023-46805 and CVE-2024-21887) In Ivanti Pulse Secure VPN Appliances pour livrer le botnet Mirai et d'autres logiciels malveillants.Ces vulnérabilités permettent l'exécution du code distant et le contournement des mécanismes d'authentification, ce qui constitue des menaces importantes à la sécurité du réseau à l'échelle mondia | Spam Malware Tool Vulnerability Threat Cloud | APT 42 | ★★ |
|
2024-04-08 15:09:15 | Faits saillants hebdomadaires, 8 avril 2024 Weekly OSINT Highlights, 8 April 2024 (lien direct) |
Last week\'s OSINT reporting reveals several key trends emerge in the realm of cybersecurity threats. Firstly, there is a notable diversification and sophistication in attack techniques employed by threat actors, ranging from traditional malware distribution through phishing emails to advanced methods like DLL hijacking and API unhooking for evading detection. Secondly, the threat landscape is characterized by the presence of various actors, including state-sponsored groups like Earth Freybug (a subset of APT41) engaging in cyberespionage and financially motivated attacks, as well as cybercrime actors orchestrating malware campaigns such as Agent Tesla and Rhadamanthys. Thirdly, the targets of these attacks span across different sectors and regions, with organizations in America, Australia, and European countries facing significant threats. Additionally, the emergence of cross-platform malware like DinodasRAT highlights the adaptability of threat actors to target diverse systems, emphasizing the need for robust cybersecurity measures across all platforms. Overall, these trends underscore the dynamic and evolving nature of cyber threats, necessitating continuous vigilance and proactive defense strategies from organizations and cybersecurity professionals. **1. [Latrodectus Loader Malware Overview](https://sip.security.microsoft.com/intel-explorer/articles/b4fe59bf)** Latrodectus is a new downloader malware, distinct from IcedID, designed to download payloads and execute arbitrary commands. It shares characteristics with IcedID, indicating possible common developers. **2. [Earth Freybug Cyberespionage Campaign](https://sip.security.microsoft.com/intel-explorer/articles/327771c8)** Earth Freybug, a subset of APT41, engages in cyberespionage and financially motivated attacks since at least 2012. The attack involved sophisticated techniques like DLL hijacking and API unhooking to deploy UNAPIMON, evading detection and enabling malicious commands execution. **3. [Agent Tesla Malware Campaign](https://sip.security.microsoft.com/intel-explorer/articles/cbdfe243)** Agent Tesla malware targets American and Australian organizations through phishing campaigns aimed at stealing email credentials. Check Point Research identified two connected cybercrime actors behind the operation. **4. [DinodasRAT Linux Version Analysis](https://sip.security.microsoft.com/intel-explorer/articles/57ab8662)** DinodasRAT, associated with the Chinese threat actor LuoYu, is a cross-platform backdoor primarily targeting Linux servers. The latest version introduces advanced evasion capabilities and is installed to gain additional footholds in networks. **5. [Rhadamanthys Information Stealer Malware](https://sip.security.microsoft.com/intel-explorer/articles/bf8b5bc1)** Rhadamanthys utilizes Google Ads tracking to distribute itself, disguising as popular software installers. After installation, it injects into legitimate Windows files for data theft, exploiting users through deceptive ad redirects. **6. [Sophisticated Phishing Email Malware](https://sip.security.microsoft.com/intel-explorer/articles/abfabfa1)** A phishing email campaign employs ZIP file attachments leading to a series of malicious file downloads, culminating in the deployment of PowerShell scripts to gather system information and download further malware. **7. [AceCryptor Cryptors-as-a-Service (CaaS)](https://sip.security.microsoft.com/intel-explorer/articles/e3595388)** AceCryptor is a prevalent cryptor-as-a-service utilized in Rescoms campaigns, particularly in European countries. Threat actors behind these campaigns abuse compromised accounts to send spam emails, aiming to obtain credentials for further attacks. ## Learn More For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: [https://aka.ms/threatintelblog](https://aka.ms/threatintelblog). Microsoft customers can use the following reports in Microsoft Defender Threat Intelligence to ge | Ransomware Spam Malware Tool Threat Cloud | APT 41 | ★★★ |
|
2024-04-03 20:46:53 | Earth Freybug Uses UNAPIMON for Unhooking Critical APIs (lien direct) | #### Description
Trend Micro a analysé une attaque de cyberespionnage que la société a attribuée à Earth Freybug, un sous-ensemble d'APT41 (suivi par Microsoft comme [typhon en laiton] (https: // sip.security.microsoft.com/intel-profiles/f0aaa62bfbaf3739bb92106688e6a00fc05afc0d4158b0e389b4078112d37c6?)).Selon Trend Micro, Earth Freybug est actif depuis àAu moins 2012 et le groupe lié au chinois a été actif dans l'espionnage et les attaques financièrement motivées.Earth Freybug utilise divers outils tels que Lolbins et les logiciels malveillants personnalisés, ciblant les organisations à l'échelle mondiale.L'attaque a utilisé des techniques telles que Dynamic Link Library (DLL) détournement et décrocheur API pour éviter la surveillance d'un nouveau malware appelé Unapimon.Unapimon élude la détection en empêchant les processus enfants d'être surveillés.
Le flux d'attaque a consisté à créer des tâches planifiées à distance et à exécuter des commandes de reconnaissance pour recueillir des informations système.Par la suite, une porte dérobée a été lancée à l'aide d'un chargement latéral DLL via un service appelé sessionnv, qui charge une DLL malveillante.Unapimon, la DLL injectée, utilise le crochet de l'API pour échapper à la surveillance et à l'exécution de commandes malveillantes non détectées, présentant les attaquants \\ 'sophistication.
[Consultez la rédaction de Microsoft \\ sur Dynamic-Link Library (DLL) Rijacking ici.] (Https://sip.security.microsoft.com/intel-explorer/articles/91be20e8?)
#### URL de référence (s)
1. https://www.trendmicro.com/en_us/research/24/d/arth-freybug.html
#### Date de publication
2 avril 2024
#### Auteurs)
Christopher So
#### Description Trend Micro analyzed a cyberespionage attack the company has attributed to Earth Freybug, a subset of APT41 (tracked by Microsoft as [Brass Typhoon](https://sip.security.microsoft.com/intel-profiles/f0aaa62bfbaf3739bb92106688e6a00fc05eafc0d4158b0e389b4078112d37c6?)). According to Trend Micro, Earth Freybug has been active since at least 2012 and the Chinese-linked group has been active in espionage and financially motivated attacks. Earth Freybug employs diverse tools like LOLBins and custom malware, targeting organizations globally. The attack used techniques like dynamic link library (DLL) hijacking and API unhooking to avoid monitoring for a new malware called UNAPIMON. UNAPIMON evades detection by preventing child processes from being monitored. The attack flow involved creating remote scheduled tasks and executing reconnaissance commands to gather system information. Subsequently, a backdoor was launched using DLL side-loading via a service called SessionEnv, which loads a malicious DLL. UNAPIMON, the injected DLL, uses API hooking to evade monitoring and execute malicious commands undetected, showcasing the attackers\' sophistication. [Check out Microsoft\'s write-up on dynamic-link library (DLL) hijacking here.](https://sip.security.microsoft.com/intel-explorer/articles/91be20e8?) #### Reference URL(s) 1. https://www.trendmicro.com/en_us/research/24/d/earth-freybug.html #### Publication Date April 2, 2024 #### Author(s) Christopher So |
Malware Tool Prediction | APT 41 | ★★ |
|
2024-03-05 19:03:47 | Rester en avance sur les acteurs de la menace à l'ère de l'IA Staying ahead of threat actors in the age of AI (lien direct) |
## Snapshot Over the last year, the speed, scale, and sophistication of attacks has increased alongside the rapid development and adoption of AI. Defenders are only beginning to recognize and apply the power of generative AI to shift the cybersecurity balance in their favor and keep ahead of adversaries. At the same time, it is also important for us to understand how AI can be potentially misused in the hands of threat actors. In collaboration with OpenAI, today we are publishing research on emerging threats in the age of AI, focusing on identified activity associated with known threat actors, including prompt-injections, attempted misuse of large language models (LLM), and fraud. Our analysis of the current use of LLM technology by threat actors revealed behaviors consistent with attackers using AI as another productivity tool on the offensive landscape. You can read OpenAI\'s blog on the research [here](https://openai.com/blog/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors). Microsoft and OpenAI have not yet observed particularly novel or unique AI-enabled attack or abuse techniques resulting from threat actors\' usage of AI. However, Microsoft and our partners continue to study this landscape closely. The objective of Microsoft\'s partnership with OpenAI, including the release of this research, is to ensure the safe and responsible use of AI technologies like ChatGPT, upholding the highest standards of ethical application to protect the community from potential misuse. As part of this commitment, we have taken measures to disrupt assets and accounts associated with threat actors, improve the protection of OpenAI LLM technology and users from attack or abuse, and shape the guardrails and safety mechanisms around our models. In addition, we are also deeply committed to using generative AI to disrupt threat actors and leverage the power of new tools, including [Microsoft Copilot for Security](https://www.microsoft.com/security/business/ai-machine-learning/microsoft-security-copilot), to elevate defenders everywhere. ## Activity Overview ### **A principled approach to detecting and blocking threat actors** The progress of technology creates a demand for strong cybersecurity and safety measures. For example, the White House\'s Executive Order on AI requires rigorous safety testing and government supervision for AI systems that have major impacts on national and economic security or public health and safety. Our actions enhancing the safeguards of our AI models and partnering with our ecosystem on the safe creation, implementation, and use of these models align with the Executive Order\'s request for comprehensive AI safety and security standards. In line with Microsoft\'s leadership across AI and cybersecurity, today we are announcing principles shaping Microsoft\'s policy and actions mitigating the risks associated with the use of our AI tools and APIs by nation-state advanced persistent threats (APTs), advanced persistent manipulators (APMs), and cybercriminal syndicates we track. These principles include: - **Identification and action against malicious threat actors\' use:** Upon detection of the use of any Microsoft AI application programming interfaces (APIs), services, or systems by an identified malicious threat actor, including nation-state APT or APM, or the cybercrime syndicates we track, Microsoft will take appropriate action to disrupt their activities, such as disabling the accounts used, terminating services, or limiting access to resources. - **Notification to other AI service providers:** When we detect a threat actor\'s use of another service provider\'s AI, AI APIs, services, and/or systems, Microsoft will promptly notify the service provider and share relevant data. This enables the service provider to independently verify our findings and take action in accordance with their own policies. - **Collaboration with other stakeholders:** Microsoft will collaborate with other stakeholders to regularly exchange information a | Ransomware Malware Tool Vulnerability Threat Studies Medical Technical | APT 28 ChatGPT APT 4 | ★★ |
1
We have: 4 articles.
We have: 4 articles.
To see everything:
Our RSS (filtrered)
