What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-03-19 21:16:06 | Opération Phantomblu: la méthode nouvelle et évasive fournit un rat Netsupport Operation PhantomBlu: New and Evasive Method Delivers NetSupport RAT (lien direct) |
#### Description
Les chercheurs de la sécurité de Perception Point ont découvert la campagne Phantomblu ciblant les organisations américaines, déploiement du rat Netsupport grâce à des techniques d'évasion sophistiquées et des tactiques d'ingénierie sociale.Les attaquants ont utilisé des caractéristiques légitimes des outils d'administration à distance, tels que Netsupport Manager, pour des activités malveillantes telles que la surveillance, le keylogging, le transfert de fichiers et le contrôle du système.La campagne a exploité la manipulation du modèle OLE dans des documents Microsoft Office pour masquer et exécuter un code malveillant, en échappant aux systèmes de sécurité traditionnels.Grâce à l'analyse des e-mails et des charges utiles de phishing, les chercheurs ont identifié la préférence des attaquants pour utiliser des plateformes de livraison de messagerie réputées et leurs techniques complexes de compte-gouttes PowerShell.L'opération Phantomblu représente une évolution des stratégies de livraison de logiciels malveillants, mélangeant des méthodes d'évasion avancées avec l'ingénierie sociale pour compromettre efficacement les organisations ciblées.
#### URL de référence (s)
1. https://perception-point.io/blog/operation-phantomblu-new-and-evasive-method-delivers-netsupport-rat/
#### Date de publication
18 mars 2024
#### Auteurs)
Ariel Davidpur
#### Description Perception Point\'s security researchers uncovered the PhantomBlu campaign targeting US-based organizations, deploying the NetSupport RAT through sophisticated evasion techniques and social engineering tactics. The attackers used legitimate features of remote administration tools, such as NetSupport Manager, for malicious activities like surveillance, keylogging, file transfer, and system control. The campaign leveraged OLE template manipulation in Microsoft Office documents to hide and execute malicious code, evading traditional security systems. Through analysis of phishing emails and payloads, the researchers identified the attackers\' preference for using reputable email delivery platforms and their intricate PowerShell dropper techniques. The PhantomBlu operation represents an evolution in malware delivery strategies, blending advanced evasion methods with social engineering to compromise targeted organizations effectively. #### Reference URL(s) 1. https://perception-point.io/blog/operation-phantomblu-new-and-evasive-method-delivers-netsupport-rat/ #### Publication Date March 18, 2024 #### Author(s) Ariel Davidpur |
Malware Tool | ★★ | |
 |
2024-03-19 19:25:00 | De Deepfakes aux logiciels malveillants: le rôle croissant d'Ai \\ dans les cyberattaques From Deepfakes to Malware: AI\\'s Expanding Role in Cyber Attacks (lien direct) |
Les modèles de grande langue (LLMS) alimentaient aujourd'hui les outils d'intelligence artificielle (IA) pourraient être exploités pour développer des logiciels malveillants auto-auprès capables de contourner les règles YARA.
"L'IA générative peut être utilisée pour échapper aux règles YARA basées sur des chaînes en augmentant le code source des petites variantes de logiciels malveillants, en réduisant efficacement les taux de détection", a enregistré Future & NBSP; Said & NBSP; dans un nouveau rapport partagé avec les hacker News.
Large language models (LLMs) powering artificial intelligence (AI) tools today could be exploited to develop self-augmenting malware capable of bypassing YARA rules. "Generative AI can be used to evade string-based YARA rules by augmenting the source code of small malware variants, effectively lowering detection rates," Recorded Future said in a new report shared with The Hacker News. |
Malware Tool | ★★ | |
 |
2024-03-19 15:33:07 | Les Russes ne pourront plus accéder à Microsoft Cloud Services, Business Intelligence Tools Russians will no longer be able to access Microsoft cloud services, business intelligence tools (lien direct) |
Microsoft aurait suspendu l'accès à ses services cloud pour les utilisateurs russes ce mois-ci en raison des sanctions européennes imposées à la Russie après son invasion de l'Ukraine.La société de technologie russe Softline, l'un des plus grands distributeurs de produits Microsoft du pays, a déclaré dans un communiqué la semaine dernière que les utilisateurs locaux
Microsoft will reportedly suspend access to its cloud services for Russian users this month as a result of European sanctions imposed on Russia after its invasion of Ukraine. The Russian tech firm Softline, one of the largest distributors of Microsoft products in the country, said in a statement last week that local users will |
Tool Cloud | ★★★ | |
 |
2024-03-19 14:21:36 | Cato dévoile la détection et la réponse aux réseaux et à des incidents de sécurité dirigés par l'IA Cato Unveils Industry First AI-driven Networking and Security Incident Detection and Response (lien direct) |
Cato Networks, le leader de Sase, a annoncé l'ajout d'outils de détection d'incidences et de réponse au réseau à la plate-forme cloud Cato Sase.Avec les histoires de réseau pour Cato XDR, les algorithmes AI avancés identifient instantanément les pannes dans les réseaux clients et effectuent une analyse des causes profondes.Les équipes du Centre des opérations réseau (NOC) et du Centre des opérations de sécurité (SOC) ont désormais un [& # 8230;]
Le message Cato dévoile l'industrie de la détection et de la réponse des incidents et des incidents de sécurité dirigés par l'IA / p>
Cato Networks, the leader in SASE, announced the addition of network incident detection and response tools to the Cato SASE Cloud platform. With Network Stories for Cato XDR, advanced AI algorithms instantly identify outages in customer networks and conduct root cause analysis. Network operations centre (NOC) and security operations centre (SOC) teams now have a […] The post Cato Unveils Industry First AI-driven Networking and Security Incident Detection and Response first appeared on IT Security Guru. |
Tool Cloud | ★★★ | |
 |
2024-03-19 13:00:42 | Les acteurs de la menace exercent de nouvelles techniques d'attaque pour contourner les contrôles de sécurité d'apprentissage automatique Threat Actors are Exercising New Attack Techniques to Bypass Machine Learning Security Controls (lien direct) |
> & # 8220; Les attaques de conversation de conversation sont la dernière tentative pour obtenir des e-mails de phishing de la récolte des informations d'identification dans votre boîte de réception, les chercheurs de menace de slashnext ont découvert un nouveau type de cyberattaque dangereux dans la nature qui utilise des e-mails masqués pour inciter les outils d'apprentissage automatique à accepter la charge utile malveillante.La charge utile malveillante dans l'e-mail pénètre ensuite les réseaux d'entreprise pour exécuter [& # 8230;]
Le post Les acteurs de la menace exercent de nouvelles techniques d'attaque pour contourner les contrôles de sécurité d'apprentissage automatique est apparu pour la première fois sur slashnext .
>“Conversation Overflow” attacks are the latest attempt to get credential harvesting phishing emails into your inbox SlashNext threat researchers have uncovered a dangerous new type of cyberattack in the wild that uses cloaked emails to trick machine learning tools into accepting malicious payload. The malicious payload in the email then penetrates enterprise networks to execute […] The post Threat Actors are Exercising New Attack Techniques to Bypass Machine Learning Security Controls first appeared on SlashNext. |
Tool Threat | ★★★ | |
 |
2024-03-19 05:00:28 | Le rapport du paysage de la perte de données 2024 explore la négligence et les autres causes communes de perte de données The 2024 Data Loss Landscape Report Explores Carelessness and Other Common Causes of Data Loss (lien direct) |
La perte de données est un problème de personnes, ou plus précisément, un problème de personnes imprudentes.C'est la conclusion de notre nouveau rapport, le paysage de la perte de données 2024, que Proofpoint lance aujourd'hui. Nous avons utilisé des réponses à l'enquête de 600 professionnels de la sécurité et des données de la protection des informations de Proofpoint pour explorer l'état actuel de la prévention de la perte de données (DLP) et des menaces d'initiés.Dans notre rapport, nous considérons également ce qui est susceptible de venir ensuite dans cet espace à maturation rapide. De nombreuses entreprises considèrent aujourd'hui toujours leur programme DLP actuel comme émergent ou évoluant.Nous voulions donc identifier les défis actuels et découvrir des domaines d'opportunité d'amélioration.Les praticiens de 12 pays et 17 industries ont répondu aux questions allant du comportement des utilisateurs aux conséquences réglementaires et partageaient leurs aspirations à l'état futur de DLP \\. Ce rapport est une première pour Proofpoint.Nous espérons que cela deviendra une lecture essentielle pour toute personne impliquée dans la tenue de sécuriser les données.Voici quelques thèmes clés du rapport du paysage de la perte de données 2024. La perte de données est un problème de personnes Les outils comptent, mais la perte de données est définitivement un problème de personnes.2023 Données de Tessian, une entreprise de point de preuve, montre que 33% des utilisateurs envoient une moyenne d'un peu moins de deux e-mails mal dirigés chaque année.Et les données de la protection de l'information ProofPoint suggèrent que à peu de 1% des utilisateurs sont responsables de 90% des alertes DLP dans de nombreuses entreprises. La perte de données est souvent causée par la négligence Les initiés malveillants et les attaquants externes constituent une menace significative pour les données.Cependant, plus de 70% des répondants ont déclaré que les utilisateurs imprudents étaient une cause de perte de données pour leur entreprise.En revanche, moins de 50% ont cité des systèmes compromis ou mal configurés. La perte de données est répandue La grande majorité des répondants de notre enquête ont signalé au moins un incident de perte de données.Les incidents moyens globaux par organisation sont de 15. L'échelle de ce problème est intimidante, car un travail hybride, l'adoption du cloud et des taux élevés de roulement des employés créent tous un risque élevé de données perdues. La perte de données est dommageable Plus de la moitié des répondants ont déclaré que les incidents de perte de données entraînaient des perturbations commerciales et une perte de revenus.Celles-ci ne sont pas les seules conséquences dommageables.Près de 40% ont également déclaré que leur réputation avait été endommagée, tandis que plus d'un tiers a déclaré que leur position concurrentielle avait été affaiblie.De plus, 36% des répondants ont déclaré avoir été touchés par des pénalités réglementaires ou des amendes. Préoccupation croissante concernant l'IA génératrice De nouvelles alertes déclenchées par l'utilisation d'outils comme Chatgpt, Grammarly et Google Bard ne sont devenus disponibles que dans la protection des informations de Proofpoint cette année.Mais ils figurent déjà dans les cinq règles les plus implémentées parmi nos utilisateurs.Avec peu de transparence sur la façon dont les données soumises aux systèmes d'IA génératives sont stockées et utilisées, ces outils représentent un nouveau canal dangereux pour la perte de données. DLP est bien plus que de la conformité La réglementation et la législation ont inspiré de nombreuses initiatives précoces du DLP.Mais les praticiens de la sécurité disent maintenant qu'ils sont davantage soucieux de protéger la confidentialité des utilisateurs et des données commerciales sensibles. Des outils de DLP ont évolué pour correspondre à cette progression.De nombreux outils | Tool Threat Legislation Cloud | ChatGPT | ★★★ |
 |
2024-03-19 01:50:49 | Andariel Group exploitant les solutions de gestion des actifs coréens (Meshagent) Andariel Group Exploiting Korean Asset Management Solutions (MeshAgent) (lien direct) |
Ahnlab Security Intelligence Center (ASEC) a récemment découvert les attaques continues d'Andariel Group & # 8217;.Il est à noter que des installations de Meshagent ont été trouvées dans certains cas.Les acteurs de la menace exploitent souvent Meshagent ainsi que d'autres outils de gestion à distance similaires car il offre diverses fonctionnalités de télécommande.Le groupe Andariel a exploité les solutions de gestion des actifs coréens pour installer des logiciels malveillants tels que Andarloader et ModelOader, qui sont les logiciels malveillants utilisés dans les cas précédents.En commençant par l'agent Innix dans le passé, le groupe ...
AhnLab SEcurity intelligence Center (ASEC) recently discovered the Andariel group’s continuous attacks on Korean companies. It is notable that installations of MeshAgent were found in some cases. Threat actors often exploit MeshAgent along with other similar remote management tools because it offers diverse remote control features. The Andariel group exploited Korean asset management solutions to install malware such as AndarLoader and ModeLoader, which are the malware used in the previous cases. Starting with Innorix Agent in the past, the group... |
Malware Tool Threat | ★★ | |
|
2024-03-18 18:28:00 | Fortra Patches Critical RCE Vulnérabilité dans l'outil de transfert FileCatalyst Fortra Patches Critical RCE Vulnerability in FileCatalyst Transfer Tool (lien direct) |
Fortra a publié les détails d'un défaut de sécurité critique désormais par paire impactant sa solution de transfert de fichiers & nbsp; FileCatalyst & nbsp; qui pourrait permettre aux attaquants non authentifiés d'obtenir une exécution de code distante sur des serveurs sensibles.
Suivi sous le nom de CVE-2024-25153, la lacune contient un score CVSS de 9,8 sur un maximum de 10.
"Une traversée du répertoire dans le \\ 'ftpServlet \' du flux de travail FileCatalyst
Fortra has released details of a now-patched critical security flaw impacting its FileCatalyst file transfer solution that could allow unauthenticated attackers to gain remote code execution on susceptible servers. Tracked as CVE-2024-25153, the shortcoming carries a CVSS score of 9.8 out of a maximum of 10. "A directory traversal within the \'ftpservlet\' of the FileCatalyst Workflow |
Tool Vulnerability | ★★ | |
 |
2024-03-18 15:14:24 | Le CISC australien améliore les outils et le cadre de la résilience organisationnelle, complète l'outil de vérification de la santé rafraîchie Australian CISC enhances organizational resilience tools and framework, complements refreshed HealthCheck Tool (lien direct) |
> L'Australian Cyber and Infrastructure Security Center (CISC) a dévoilé un outil d'auto-évaluation amélioré, l'outil d'organisation Resilience Healthcheck, ...
>The Australian Cyber and Infrastructure Security Centre (CISC) unveiled an enhanced self-assessment tool, the Organisational Resilience HealthCheck Tool,... |
Tool | ★★ | |
|
2024-03-18 13:23:03 | Faits saillants hebdomadaires OSINT, 18 mars 2024 Weekly OSINT Highlights, 18 March 2024 (lien direct) |
## Weekly OSINT Highlights, 18 March 2024 Last week\'s OSINT reporting revealed a common theme: cyberattacks targeting specific user groups are becoming more sophisticated. Take, for instance, the Notion installer malware, which dupes users by posing as a legitimate software installer, showcasing adept social engineering. Similarly, the BIPClip campaign demonstrates a highly targeted approach towards developers involved in cryptocurrency projects, with the threat actors leveraging multiple open-source packages to steal sensitive mnemonic phrases. Despite distinct attack methods, both instances underscore threat actors\' adaptability in tailoring attacks to their targets. Additionally, the analysis highlights a growing trend where attackers focus on specific sectors or user demographics, indicating a shift towards more targeted and stealthy cyber threats rather than indiscriminate attacks. This trend underscores the importance of user vigilance and the necessity for industry-specific cybersecurity measures to mitigate evolving risks. 1. **[Notion Installer Malware](https://security.microsoft.com/intel-explorer/articles/f21ac4ec?):** A new MSIX malware posing as the Notion installer is distributed through a fake website resembling the official Notion homepage. The malware, signed with a valid certificate, infects Windows PCs when users attempt to install Notion, compromising their systems with malware. 2. **[BIPClip Crypto Wallet Theft Campaign](https://security.microsoft.com/intel-explorer/articles/21aa5484?):** ReversingLabs uncovered the BIPClip campaign, which utilizes seven open-source packages across 19 versions from PyPI to steal mnemonic phrases for crypto wallet recovery. The campaign targets developers involved in cryptocurrency wallet projects, particularly those implementing Bitcoin Improvement Proposal 39 (BIP39), and employs sophisticated methods to avoid detection. The BIPClip campaign underscores how crypto assets are one of the most popular targets of cybercriminal groups and other threat actors, such as North Korean APTs. ## Learn More For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: [https://aka.ms/threatintelblog](https://aka.ms/threatintelblog). Microsoft customers can use the following reports in Microsoft Defender Threat Intelligence to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this summary. The following reports provide the intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments: - Tool Profile: [Information stealers](https://sip.security.microsoft.com/intel-profiles/2296d491ea381b532b24f2575f9418d4b6723c17b8a1f507d20c2140a75d16d6?) - [Financially motivated threat actors misusing App Installer](https://security.microsoft.com/intel-explorer/articles/74368091?) ## Recommendations to protect against Information stealers Microsoft recommends the following mitigations to reduce the impact of Information stealer threats. - Check your Office 365 email filtering settings to ensure you block spoofed emails, spam, and emails with malware. Use [Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/defender-for-office-365?ocid=magicti_ta_learndoc) for enhanced phishing protection and coverage against new threats and polymorphic variants. Configure Microsoft Defender for Office 365 to [recheck links on click](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about?ocid=magicti_ta_learndoc) and [delete sent mail](https://learn.microsoft.com/microsoft-365/security/office-365-security/zero-hour-auto-purge?ocid=magicti_ta_learndoc) in response to newly acquired threat intelligence. Turn on [safe attachments policies](https://learn.microsoft.com/microsoft-365/security/office-365-sec | Ransomware Spam Malware Tool Threat Prediction | ★★★ | |
|
2024-03-18 13:20:09 | Dark Web Tool Arms Ransomware Gangs: Industries du commerce électronique et de l'aviation ciblées Dark Web Tool Arms Ransomware Gangs: E-commerce & Aviation Industries Targeted (lien direct) |
par waqas
Cyber Warfare prend son envol: Géopolitique Attaques de carburant sur les compagnies aériennes - Dark Web Tool vise le commerce électronique!
Ceci est un article de HackRead.com Lire la publication originale: Dark Web Tool Arms Ransomware Gangs: e-commerce et ampli;Industries aéronautiques ciblées
By Waqas Cyber Warfare Takes Flight: Geopolitics Fuel Attacks on Airlines - Dark Web Tool Aims at E-commerce! This is a post from HackRead.com Read the original post: Dark Web Tool Arms Ransomware Gangs: E-commerce & Aviation Industries Targeted |
Ransomware Tool | ★★ | |
 |
2024-03-18 12:59:39 | Analyse agressive dans la prime des insectes (et comment l'éviter) Aggressive scanning in bug bounty (and how to avoid it) (lien direct) |
> Qu'est-ce que la numérisation agressive?Pourquoi devriez-vous l'éviter?Comment pouvez-vous l'éviter?Configuration des outils communs FFUF GOBUSTER SQLMAP Burp Conclusion Soyez doux lors de la réalisation de tests ou scanners automatisés.Certains programmes peuvent interdire les tests automatisés de toute nature ou imposer des limites de taux.Il est de la plus haute importance de suivre ces règles, comme une violation [& # 8230;]
>What is aggressive scanning? Why should you avoid it? How can you avoid it? Configuring Common Tools ffuf gobuster sqlmap burp Conclusion Be gentle when conducting automated tests or scanners. Some programs may disallow automated testing of any kind or impose rate limits. It is of utmost importance to follow these rules, as a violation […] |
Tool | ★★ | |
 |
2024-03-18 12:40:00 | Microsoft: 87% des organisations britanniques vulnérables aux cyberattaques coûteuses Microsoft: 87% of UK Organizations Vulnerable to Costly Cyber-Attacks (lien direct) |
Un rapport de Microsoft a révélé que 87% des organisations britanniques sont soit vulnérables ou à haut risque de cyberattaques et ont exhorté l'investissement dans l'IA comme outil de sécurité
A Microsoft report found that 87% of UK organizations are either vulnerable or at high-risk of cyber-attacks, and urged investment in AI as a security tool |
Tool | ★★★ | |
 |
2024-03-18 10:00:00 | Explorer les risques de la technologie de suivi des yeux dans la sécurité VR Exploring the risks of eye-tracking technology in VR security (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Virtual reality (VR) offers profound benefits across industries, particularly in education and training, thanks to its immersive nature. Through derivatives, such as 3D learning environments, VR enables learners to gain a deeper understanding of theoretical concepts more quickly and efficiently. However, with the benefits come some dangers. One such risk is the integration of eye-tracking technology within virtual reality environments. While eye-tracking promises to make experiences better and improve security through biometric verification, it also raises privacy concerns. This technology, though handy, could be exploited by cybercriminals. For instance, a recent paper by Rutgers University shows that hackers could use common virtual reality (AR/VR) headsets with motion sensors to capture facial movements linked to speech. This could lead to the theft of sensitive data communicated through voice commands, like credit card numbers and passwords. | Tool Cloud | ★★★ | |
 |
2024-03-16 07:00:00 | Top 50 des IA génératives à découvrir absolument en 2024 (lien direct) | Découvrez le top 50 des applications IA génératives les plus innovantes et populaires en 2024, classées selon leur trafic web et mobile. Des assistants généraux aux outils de productivité en passant par les compagnons IA, explorez les tendances clés et les entreprises émergentes dans le domaine de l'IA générative grand public. | Tool Mobile | ★★★ | |
|
2024-03-15 13:45:16 | Exclusif: après le démontage de Lockbit \\, son prétendu leader promet de pirater Exclusive: After LockBit\\'s takedown, its purported leader vows to hack on (lien direct) |
Cette semaine, le podcast Click Here a décroché une entrevue rare avec le prétendu leader du groupe Ransomware Lockbit - il porte le nom LockbitsUpp.Il est sous pression parce que le mois dernier, une opération de police internationale a infiltré le groupe et a saisi non seulement leur plate-forme, mais aussi leurs outils de piratage, les comptes de crypto-monnaie et le code source
This week, the Click Here podcast landed a rare interview with the purported leader of the LockBit ransomware group - he goes by the name LockBitSupp. He\'s under pressure because last month an international police operation infiltrated the group and seized not just their platform, but their hacking tools, cryptocurrency accounts and source code |
Ransomware Hack Tool Legislation | ★★★ | |
|
2024-03-14 15:53:00 | Redcurl Cybercrime Group abuse de l'outil PCA Windows pour l'espionnage d'entreprise RedCurl Cybercrime Group Abuses Windows PCA Tool for Corporate Espionage (lien direct) |
Le groupe de cybercrimes russophone appelé & nbsp; redcurl & nbsp; tire un tir un composant Microsoft Windows légitime appelé l'assistant de compatibilité du programme (PCA) pour exécuter des commandes malveillantes.
«Le service d'assistant de compatibilité du programme (Pcalua.exe) est un service Windows conçu pour identifier et résoudre les problèmes de compatibilité avec les programmes plus anciens», Trend Micro & Nbsp; Said & NBSP; dans une analyse
The Russian-speaking cybercrime group called RedCurl is leveraging a legitimate Microsoft Windows component called the Program Compatibility Assistant (PCA) to execute malicious commands. “The Program Compatibility Assistant Service (pcalua.exe) is a Windows service designed to identify and address compatibility issues with older programs,” Trend Micro said in an analysis |
Tool Prediction | ★★ | |
 |
2024-03-14 13:17:28 | Normcyber annonce un nouveau service d'évaluation de la réaction des incidents NormCyber announces new Incident Response Readiness Assessment Service (lien direct) |
Normcyber annonce un nouveau service d'évaluation de la préparation à la réponse aux incidents
Équipe les entreprises des outils pour renforcer et fortifier les réponses aux cyber-menaces
-
revues de produits
NormCyber announces new Incident Response Readiness Assessment Service Equips enterprises with the tools to bolster and fortify responses to cyber threats - Product Reviews |
Tool | ★★★ | |
|
2024-03-14 10:00:00 | Spyware commercial: la menace furtive Commercial spyware: The stealthy threat (lien direct) |
It can be difficult to over-estimate the benefits that we accrue from the use of technology in our day to day lives. But these benefits have come at a price which has redefined what we expect in terms of privacy. As a member of Generation X, which came of age at the dawn of the Internet era and witnessed the rise of an entire industry built on consumer information analytics, I have on occasion struck my own Faustian bargains, offering up my personal data in exchange for convenience. As have we all. In doing so we are implicitly trusting the organization that runs the website or app in question to safeguard our information effectively. Spyware, as the name suggests, is software designed to covertly gather data about a victim without their consent. Spyware can infect both computers and mobile devices, infiltrating them through malicious or hacked websites, phishing emails, and software downloads. Unlike other forms of malware that may seek to disrupt or damage systems, spyware operates discreetly, often evading detection while silently siphoning off sensitive information. When deployed against individuals this data can range from browsing habits and keystrokes to login credentials and financial information. Spyware can access microphones and cameras for purposes of gathering intelligence or evidence when deployed by government agencies, or capturing content for purposes of sale, blackmail, or other monetization schemes if deployed by threat actors. The effects of which can be devastating. The proliferation of commercial spyware poses significant risks to companies as well. Commercial spyware is a niche industry which develops and markets software for the purpose of data collection. Their products use many of the same methods as other kinds of malware. Often, commercial spyware leverages zero-day exploits that were either developed by the vendor in question or purchased from independent researchers. For example, in a recent report, Google researchers concluded that approximately half of the zero-day vulnerabilities targeting their products over the past decade were the work of “Commercial Surveillance Vendors” (https://www.scmagazine.com/news/spyware-behind-nearly-50-of-zeros-days-targeting-google-products). | Ransomware Malware Tool Vulnerability Threat Legislation Mobile Commercial | ★★ | |
|
2024-03-14 06:00:19 | Comment nous avons déployé Github Copilot pour augmenter la productivité des développeurs How We Rolled Out GitHub Copilot to Increase Developer Productivity (lien direct) |
Engineering Insights is an ongoing blog series that gives a behind-the-scenes look into the technical challenges, lessons and advances that help our customers protect people and defend data every day. Each post is a firsthand account by one of our engineers about the process that led up to a Proofpoint innovation. Inspired by the rapid rise of generative artificial intelligence (GenAI), we recently kicked off several internal initiatives at Proofpoint that focused on using it within our products. One of our leadership team\'s goals was to find a tool to help increase developer productivity and satisfaction. The timing was perfect to explore options, as the market had become flush with AI-assisted coding tools. Our project was to analyze the available tools on the market in-depth. We wanted to choose an AI assistant that would provide the best productivity results while also conforming to data governance policies. We set an aggressive timeline to analyze the tools, collaborate with key stakeholders from legal, procurement, finance and the business side, and then deploy the tool across our teams. In the end, we selected GitHub Copilot, a code completion tool developed by GitHub and OpenAI, as our AI coding assistant. In this post, we walk through how we arrived at this decision. We also share the qualitative and quantitative results that we\'ve seen since we\'ve introduced it. Our analysis: approach and criteria When you want to buy a race car-or any car for that matter-it is unlikely that you\'ll look at just one car before making a final decision. As engineers, we are wired to conduct analyses that dive deeply into all the possible best options as well as list all the pros and cons of each. And that\'s what we did here, which led us to a final four list that included GitHub Copilot. These are the criteria that we considered: Languages supported IDEs supported Code ownership Stability AI models used Protection for intellectual property (IP) Licensing terms Security Service-level agreements Chat interface Innovation Special powers Pricing Data governance Support for a broad set of code repositories We took each of the four products on our shortlist for a test drive using a specific set of standard use cases. These use cases were solicited from several engineering teams. They covered a wide range of tasks that we anticipated would be exercised with an AI assistant. For example, we needed the tool to assist not just developers, but also document writers and automation engineers. We had multiple conversations and in-depth demos from the vendors. And when possible, we did customer reference checks as well. Execution: a global rollout Once we selected a vendor, we rolled out the tool to all Proofpoint developers across the globe. We use different code repos, programming languages and IDEs-so, we\'re talking about a lot of permutations and combinations. Our initial rollout covered approximately 50% of our team from various business units and roles for about 30 days. We offered training sessions internally to share best practices and address challenges. We also built an internal community of experts to answer questions. Many issues that came up were ironed out during this pilot phase so that when we went live, it was a smooth process. We only had a few issues. All stakeholders were aware of the progress, from our operations/IT team to our procurement and finance teams. Our journey from start to finish was about 100 days. This might seem like a long time, but we wanted to be sure of our choice. After all, it is difficult to hit “rewind” on an important initiative of this magnitude. Monitoring and measuring results We have been using GitHub Copilot for more than 150 days and during that period we\'ve been collecting telemetry data from the tool and correlating it with several productivity and quality metrics. Our results have been impressive. When it comes to quantitative results, we have seen a general increase in | Tool Cloud Technical | ★★★ | |
 |
2024-03-13 21:59:23 | Chatgpt déverse les secrets dans une nouvelle attaque POC ChatGPT Spills Secrets in Novel PoC Attack (lien direct) |
La recherche est plus récente dans un ensemble croissant de travaux pour mettre en évidence les faiblesses troublantes des outils génératifs largement utilisés.
Research is latest in a growing body of work to highlight troubling weaknesses in widely used generative AI tools. |
Tool | ChatGPT | ★★ |
|
2024-03-13 21:09:00 | Démystifier un mythe commun de cybersécurité Demystifying a Common Cybersecurity Myth (lien direct) |
L'une des idées fausses les plus courantes dans la cybersécurité de téléchargement de fichiers est que certains outils sont «suffisants» à leur propre chef - ce n'est tout simplement pas le cas.Dans notre dernier & NBSP; WhitePaper & NBSP; PDG et fondateur d'Opswat, Benny Czarny, jette un aperçu global de ce qu'il faut pour empêcher les menaces de logiciels malveillants dans le dossier de sécurité en constante évolution en constante évolution, et une grande partie de cela est de comprendre où la
One of the most common misconceptions in file upload cybersecurity is that certain tools are “enough” on their own-this is simply not the case. In our latest whitepaper OPSWAT CEO and Founder, Benny Czarny, takes a comprehensive look at what it takes to prevent malware threats in today\'s ever-evolving file upload security landscape, and a big part of that is understanding where the |
Malware Tool | ★★★ | |
 |
2024-03-13 17:28:14 | Gestionnaires de mot de passe open source: aperçu, avant et inconvénients Open Source Password Managers: Overview, Pros & Cons (lien direct) |
Découvrez les gestionnaires de mots de passe open-source, les avantages et les inconvénients potentiels de l'utilisation de ces outils pour gérer vos mots de passe en toute sécurité.
Learn about open-source password managers, the benefits, and the potential drawbacks of using these tools for managing your passwords securely. |
Tool | ★★ | |
 |
2024-03-13 13:36:33 | La boîte à outils du Cigref pour anticiper les cyberattaques (lien direct) | Le Cigref consacre un rapport à l'anticipation des cyberattaques. Il l'émaille de retex... et mentionne un certain nombre de fournisseurs. | Tool Studies | ★★★ | |
|
2024-03-13 10:00:00 | 25 conseils essentiels de cybersécurité et meilleures pratiques pour votre entreprise 25 Essential Cybersecurity tips and best practices for your business (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Cybercrime is quickly becoming one of the biggest threats worldwide, impacting businesses across all sectors. To avoid the risk of a damaging security breach, it\'s crucial to stay updated on the latest cybersecurity tips and practices. Protecting yourself or your business from cyberattacks can be tough. But there are several cybersecurity tips that can help defend against attacks. We\'ve gathered a list of 25 most effective tips for you to adopt and share with others. Top 25 cybersecurity tips for your business 1. Keep your software up to date To stay safe from cyber threats like ransomware, it\'s essential to regularly update your software, including your operating system and applications. Updates often contain crucial security patches that fix vulnerabilities exploited by hackers. Enable automatic updates for your device and web browser, and ensure plugins like Flash and Java are also kept up to date. | Ransomware Malware Tool Vulnerability Mobile Cloud | LastPass | ★★ |
|
2024-03-13 09:28:51 | Étude Mimecast : les cybercriminels misent sur le talon d\'Achille des entreprises, le risque humain (lien direct) | L'étude annuelle étudie l'état de la sécurité des emails et des outils de collaboration. L'édition 2024 conclut que 74 % de l'ensemble des violations cyber sont dues à des facteurs humains. - Investigations | Tool | ★★ | |
|
2024-03-13 08:35:54 | Sysdig, nommé 1er pour son CSPM dans le Gartner "Voice of the Customer" (lien direct) | Sysdig, nommé 1er pour son CSPM dans le Gartner "Voice of the Customer" Sysdig se voit attribuer la note la plus élevée dans le rapport Gartner Peer Insights "Voice of the Customer" pour les outils de Cloud Security Posture Management (CSPM). - Magic Quadrant | Tool Cloud | ★★★ | |
 |
2024-03-12 16:25:45 | Vigilant : une solution pour détecter le changement de propriétaire des extensions chrome (lien direct) | Dans l'univers numérique en constante évolution, les extensions de navigateur offrent un large éventail de fonctionnalités qui enrichissent notre expérience en ligne. Cependant, ce que beaucoup d'utilisateurs ignorent, c'est le risque potentiel lié à l'utilisation de ces outils pratiques.... | Tool | ★★ | |
|
2024-03-12 10:00:00 | Le rôle des proxies dans le commerce électronique: stimuler le succès en ligne de la vente au détail The role of proxies in e-commerce: Boosting online retail success (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Just as the heart keeps the body going, unseen and often not thought about unless something goes wrong, so do proxies serve as the hidden engines that power the bustling world of online retail. They are the invisible assistants that work hard to ensure the storefront—that shiny website filled with enticing products—remains the focus of our shopping experience. In embracing tools like rotating proxies, services like GoProxies have become indispensable allies in the quest to boost e-commerce success. What exactly are proxies? Imagine you want to send a gift without revealing your identity. You might ask a friend to deliver it for you. That\'s what a proxy does — it\'s your discreet friend in the world of the internet, passing along requests and responses so your online presence remains anonymous and secure. A cloak of invisibility for market research | Tool Prediction | ★★★ | |
|
2024-03-12 10:00:00 | Gemini AI de Google \\ vulnérable à la manipulation du contenu Google\\'s Gemini AI Vulnerable to Content Manipulation (lien direct) |
Comme Chatgpt et d'autres outils Genai, Gemini est sensible aux attaques qui peuvent le faire divulguer les invites du système, révéler des informations sensibles et exécuter des actions potentiellement malveillantes.
Like ChatGPT and other GenAI tools, Gemini is susceptible to attacks that can cause it to divulge system prompts, reveal sensitive information, and execute potentially malicious actions. |
Tool | ChatGPT | ★★ |
|
2024-03-12 07:03:40 | Si vous utilisez l'archivage de Veritas, quelle est votre prochaine étape? If You\\'re Using Veritas Archiving, What\\'s Your Next Step? (lien direct) |
By now, much of the industry has seen the big news about Cohesity acquiring the enterprise data protection business of Veritas Technologies. The transaction will see the company\'s NetBackup technology-software, appliances and cloud (Alta Data Protection)-integrated into the Cohesity ecosystem. But what about other Veritas products? As stated in the Cohesity and Veritas press releases, the “remaining assets of Veritas\' businesses will form a separate company, \'DataCo.\' \'DataCo\' will comprise Veritas\' InfoScale, Data Compliance, and Backup Exec businesses.” Data Compliance includes Veritas Enterprise Vault (EV), which might raise concerns for EV customers. As a new, standalone entity, \'DataCo\' has no innovation track record. In this blog, I provide my opinion on the questionable future of Veritas archiving products, why EV customers should start looking at alternative archiving tools, and why you should trust Proofpoint as your next enterprise archiving solution. EV architecture isn\'t future-proof EV gained a following because it came onto the market just when it was needed. With its big, robust on-premises architecture, EV was ideal to solve the challenges of bloated file and email servers. Companies had on-premises file and email servers that were getting bogged down with too much data. They needed a tool to offload legacy data to keep working and so they could be backed up in a reasonable amount of time. However, with key applications having moved to the cloud over the last decade-plus, storage optimization is no longer a primary use case for archiving customers. While EV has adapted to e-discovery and compliance use cases, its underlying on-premises architecture has struggled to keep up. EV customers still have headaches with infrastructure (hardware and software) planning, budgeting and maintenance, and archive administration. What\'s more, upgrades often require assistance from professional services and support costs are rising. And the list goes on. Today, most cloud-native archives remove virtually all of these headaches. And just like you moved on from DVDs and Blu-ray discs to streaming video, it\'s time to migrate from legacy on-premises archiving architectures, like EV, to cloud-native solutions. Future investments are uncertain When you look back over EV\'s last 5-6 years, you might question what significant innovations Veritas has delivered for EV. Yes, Veritas finally released supervision in the cloud. But that was a direct response to the EOL of AdvisorMail for EV.cloud many years ago. Yes, Veritas added dozens of new data sources for EV. But that was achieved through the acquisition of Globanet-and their product Merge1-in 2020. (They still list Merge1 as an independent product on their website.) Yes, they highlight how EV can store to “Azure, AWS, Google Cloud Storage, and other public cloud repositories” via storage tiering. But that just means that EV extends the physical storage layer of a legacy on-prem archiving architecture to the cloud-it doesn\'t mean it runs a cloud-native archiving solution. Yes, Veritas has cloud-based Alta Archiving. But that\'s just a rebranding and repackaging of EV.cloud, which they retired more than two years ago. Plus, Alta Archiving and Enterprise Vault are separate products. With the Cohesity data protection acquisition, EV customers have a right to question future investments in their product. Will EV revenue alone be able to sustain meaningful, future innovation in the absence of the NetBackup revenue “cash cow”? Will you cling to hope, only to be issued an EOL notice like Dell EMC SourceOne customers? Now is the time to migrate from EV to a modern cloud-native archiving solution. How Proofpoint can help Here\'s why you should trust Proofpoint for your enterprise archiving. Commitment to product innovation and support Year after year, Proofpoint continues to invest a double-digit percentage of revenue into all of our businesses, including Proofpoint Int | Tool Studies Cloud Technical | ★★ | |
|
2024-03-11 13:44:31 | Mindgard présente un nouvel outil pour protéger les entreprises à partir de violations de données Genai Mindgard introduces a new tool to shield businesses from GenAI data breaches (lien direct) |
Mindgard présente un nouvel outil pour protéger les entreprises de Genai Data Breachs
Le module de prévention des pertes de données de Mindgard AI combine une plus grande sécurité et une conformité rationalisée, réduisant le risque de dommages de réputation pour les entreprises intégrant les LLM dans les offres
-
revues de produits
Mindgard introduces a new tool to shield businesses from GenAI data breaches New Mindgard AI data loss prevention module combines greater security and streamlined compliance, reducing risk of reputational damage for businesses integrating LLMs into offerings - Product Reviews |
Tool | ★★ | |
|
2024-03-11 13:43:18 | Faits saillants hebdomadaires OSINT, 11 mars 2024 Weekly OSINT Highlights, 11 March 2024 (lien direct) |
## Weekly OSINT Highlights, 11 March 2024 The OSINT reporting last week underscores several prevalent trends in cyber threats. Firstly, ransomware continues to be a significant threat, with groups like GhostSec conducting double extortion attacks and offering RaaS programs, while threat actors like SocGholish exploit vulnerabilities in web platforms like WordPress. Additionally, phishing remains a persistent tactic, exemplified by the discovery of the CryptoChameleon kit targeting cryptocurrency platforms and governmental agencies. Furthermore, attackers are targeting misconfigured servers and leveraging 1-day vulnerabilities to conduct various malicious activities, from cryptocurrency mining to unauthorized data collection. These trends emphasize the evolving tactics and motivations of cyber threat actors, highlighting the need for robust cybersecurity measures and vigilance across various sectors and platforms. 1. **[SocGholish Malware Targeting WordPress](https://security.microsoft.com/intel-explorer/articles/0218512b?)**: WordPress websites are targeted by SocGholish malware, initiating with a JavaScript malware framework and leading to potential ransomware infections, often through compromised administrator accounts. 2. **[GhostSec Ransomware Activities Surge](https://security.microsoft.com/intel-explorer/articles/ee5a4e56?)**: GhostSec, a financially motivated hacking group, collaborates with Stormous ransomware in double extortion attacks across various business verticals, offering a ransomware-as-a-service (RaaS) program, with a surge in activities observed recently. 3. **[CryptoChameleon Phishing Kit](https://security.microsoft.com/intel-explorer/articles/9227be0c?)**: Lookout uncovers the CryptoChameleon phishing kit, adept at stealing sensitive data from cryptocurrency platforms and the FCC, utilizing custom single sign-on (SSO) pages and SMS lures, primarily targeting victims in the United States. Notably, the kit includes an administrative console to monitor phishing attempts and offers customized redirections based on victims\' responses, with an emphasis on mimicking authentic MFA processes. 4. **[Malware Campaign Targeting Misconfigured Servers](https://security.microsoft.com/intel-explorer/articles/68797fe5?)**: Cado Security Labs discovers a malware campaign targeting misconfigured servers, leveraging unique payloads and exploiting n-day vulnerabilities for Remote Code Execution (RCE) attacks and cryptocurrency mining. 5. **[Earth Kapre Espionage Group](https://security.microsoft.com/intel-explorer/articles/d2d46a48?)**: Trend Micro exposes the Earth Kapre espionage group, conducting phishing campaigns across multiple countries, with malicious attachments leading to unauthorized data collection and transmission to command-and-control (C&C) servers. 6. **[Magnet Goblin Exploiting 1-Day Vulnerabilities](https://security.microsoft.com/intel-explorer/articles/11616c16?)**: Check Point identifies Magnet Goblin\'s financially motivated attacks, rapidly adopting 1-day vulnerabilities, particularly targeting Ivanti Connect Secure VPN, with a diverse arsenal including a Linux version of NerbianRAT and JavaScript credential stealers. ## Learn More For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: [https://aka.ms/threatintelblog](https://aka.ms/threatintelblog) and the following blog posts: - [Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself](https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/?ocid=magicti_ta_blog#defending-against-ransomware) - [Cryptojacking: Understanding and defending against cloud compute resource abuse](https://www.microsoft.com/en-us/security/blog/2023/07/25/cryptojacking-understanding-and-defending-against-cloud-compute-resource-abuse/) Microsoft customers can use the following reports in Mi | Ransomware Malware Tool Vulnerability Threat Prediction Cloud | ★★★ | |
 |
2024-03-11 03:47:17 | Surveillance de l'intégrité des fichiers vs intégrité: ce que vous devez savoir File Integrity Monitoring vs. Integrity: What you need to know (lien direct) |
L'utilisation d'outils de sécurité pour surveiller les activités sur les critères de terminaison basés sur IP et les modifications qui en résultent posent l'un des défis les plus formidables aux efforts de sécurité et de conformité réglementaire, grâce à son potentiel de perturbation des mesures et des protocoles de sécurité établis.Les cadres de conformité, tels que PCI DSS et NIST 800-53 / SI-7, nécessitent des organisations de chaque secteur pour maintenir un environnement cohérent et sécurisé pour répondre aux normes réglementaires.L'intégrité est une pièce fondamentale de ce puzzle.Il ne faut qu'un seul changement de système accidentel, involontaire ou malveillant pour saper complètement le ...
Using security tools to monitor activities on IP based endpoints and the resulting changes that occur pose one of the most formidable challenges to security and regulatory compliance efforts, thanks to its potential to disrupt established security measures and protocols. Compliance frameworks, such as PCI DSS and NIST 800-53/SI-7, require organizations in every sector to maintain a consistent and secure environment to meet regulatory standards. Integrity is a foundational piece of this puzzle. It takes only one accidental, unintentional, or malicious system change to completely undermine the... |
Tool | ★★ | |
|
2024-03-08 20:06:07 | La police sud-coréenne déploie un outil de détection Deepfake lors des élections South Korean Police Deploy Deepfake Detection Tool in Run-up to Elections (lien direct) |
La bataille de la nation avec les profondeurs politiques est peut-être un signe avant-coureur pour ce qui est venu lors des élections du monde cette année.
The nation\'s battle with political deepfakes may be a harbinger for what\'s to come in elections around the world this year. |
Tool Legislation | ★★★ | |
|
2024-03-08 17:30:16 | Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities (lien direct) | #### Description
Check Point rapporte que Magnet Goblin est un acteur de menace à motivation financière qui adopte rapidement et exploite les vulnérabilités d'un jour dans les services accessibles au public en tant que vecteur d'infection initial.Au moins dans un cas d'Ivanti Connect Secure VPN (CVE-2024-21887), l'exploit est entré dans l'arsenal du groupe \\ aussi vite que dans un jour suivant un POC pour sa publication.Le groupe a ciblé Ivanti, Magento, Qlink Sense et éventuellement Apache ActiveMQ.L'analyse de la récente campagne VPN de la récente Ivanti Secure VPN de l'acteur a révélé une nouvelle version Linux d'un logiciel malveillant appelé Nerbianrat, en plus de Warpwire, un voleur d'identification JavaScript.L'arsenal de l'acteur \\ comprend également Mininerbian, une petite porte dérobée Linux et des outils de surveillance et de gestion à distance (RMM) pour les fenêtres comme Screenconnect et AnyDesk.
#### URL de référence (s)
1. https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1d-day-vulnerabilities/
#### Date de publication
8 mars 2024
#### Auteurs)
Point de contrôle
#### Description Check Point reports Magnet Goblin is a financially motivated threat actor that quickly adopts and leverages 1-day vulnerabilities in public-facing services as an initial infection vector. At least in one case of Ivanti Connect Secure VPN (CVE-2024-21887), the exploit entered the group\'s arsenal as fast as within 1 day after a POC for it was published. The group has targeted Ivanti, Magento, Qlink Sense, and possibly Apache ActiveMQ. Analysis of the actor\'s recent Ivanti Connect Secure VPN campaign revealed a novel Linux version of a malware called NerbianRAT, in addition to WARPWIRE, a JavaScript credential stealer. The actor\'s arsenal also includes MiniNerbian, a small Linux backdoor, and remote monitoring and management (RMM) tools for Windows like ScreenConnect and AnyDesk. #### Reference URL(s) 1. https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/ #### Publication Date March 8, 2024 #### Author(s) Check Point |
Malware Tool Vulnerability Threat | ★★ | |
|
2024-03-08 15:02:05 | Hasta la Vista, bébé.L'outil Terminator et ses variantes ont loin d'être utilisé Hasta La Vista, Baby. Das Terminator-Tool und seine Varianten haben noch lange nicht ausgedient (lien direct) |
Rapport des spécialistes de la sécurité Sophos Andreas Klopsch et Matt Wixey décrit comment les cybercriminels utilisent l'outil de terminateur bien connu pour interférer avec & Auml;
byovd (apportez le vôtreLe conducteur vulnérable), en tant que tueur d'Edr, est toujours très populaire auprès des joueurs de la menace.L'une des raisons est qu'il s'agit d'une perspective d'une attaque au niveau du noyau, qui comprend les cybercriminels un large éventail d'action en action & ouml;De cacher les logiciels malveillants & uuml; à propos de l'extrait des données de connexion pour tenter de désactiver l'EDR-L & OUML;Les spécialistes de la sécurité de Sophos Andreas Klopsch et Matt Wixey ont examiné de près cela avec les outils Terminator, en plus des six derniers mois et dans le rapport exécutif "il sera de retour: les attaquants abusent toujours de l'outil et des variantes de terminateur" résumé.
-
rapports spéciaux
/ /
affiche
Report der Sophos Security-Spezialisten Andreas Klopsch und Matt Wixey beschreibt, wie Cyberkriminelle mithilfe des altbekannten Terminator-Tools anfällige Treiber einschleusen. BYOVD (Bring Your Own Vulnerable Driver) stehen als EDR-Killer bei Bedrohungsakteuren nach wie vor hoch im Kurs. Ein Grund ist, dass hiermit ein Angriff auf Kernel-Ebene in Aussicht steht, was den Cyberkriminellen ein breites Spektrum an Handlungsmöglichkeiten einräumt – vom Verstecken von Malware über das Ausspähen von Anmeldedaten bis hin zum Versuch, die EDR-Lösungen zu deaktivieren. Die Sophos Security-Spezialisten Andreas Klopsch und Matt Wixey haben das Geschehen mit den Terminator-Tools während der letzten sechs Monate genau unter die Lupe genommen und im ausführlichen Report „It\'ll be back: Attackers still abusing Terminator tool and variants„ zusammengefasst. - Sonderberichte / affiche |
Malware Tool | ★★ | |
 |
2024-03-08 14:00:19 | Vérifier les alertes de recherche: le groupe de gobelin à aimant à motivation financière exploite des vulnérabilités à 1 jour pour cibler les serveurs auxquels sont confrontés le public Check Point Research Alerts: Financially Motivated Magnet Goblin Group Exploits 1-Day Vulnerabilities to target Publicly Facing Servers (lien direct) |
> Faits saillants de la clé: & # 8211;Exploitation rapide des vulnérabilités d'un jour: Menk Actor Group Magnet Gobblin & # 8217; S Gallmark est sa capacité à tirer rapidement parti des vulnérabilités nouvellement divulguées, en particulier ciblant les serveurs et les appareils Edge.Dans certains cas, le déploiement des exploits est dans un délai d'un jour après la publication d'un POC, augmentant considérablement le niveau de menace posé par cet acteur.& # 8211;Cyber Arsenal diversifié: le groupe utilise un ensemble sophistiqué d'outils, notamment Nerbianrat, un rat multiplateforme pour Windows et Linux, et Warpwire, un voleur d'identification JavaScript.Cette suite de logiciels malveillants diverse permet une large gamme de cyberattaques, du vol de données à un accès soutenu [& # 8230;]
>Key Highlights: – Rapid Exploitation of 1-Day Vulnerabilities: Threat actor group Magnet Goblin’s hallmark is its ability to swiftly leverage newly disclosed vulnerabilities, particularly targeting public-facing servers and edge devices. In some cases, the deployment of the exploits is within 1 day after a POC is published, significantly increasing the threat level posed by this actor. – Diverse Cyber Arsenal: The group employs a sophisticated set of tools including NerbianRAT, a cross-platform RAT for Windows and Linux, and WARPWIRE, a JavaScript credential stealer. This diverse malware suite enables a wide range of cyber attacks, from data theft to sustained access […] |
Malware Tool Vulnerability Threat | ★★★ | |
|
2024-03-08 13:18:00 | L'émulateur Qemu exploité comme outil de tunneling pour violer le réseau QEMU Emulator Exploited as Tunneling Tool to Breach Company Network (lien direct) |
Des acteurs de menace ont été observés en tirant parti de l'émulateur de matériel open-source en tant que logiciel de tunnelisation lors d'une cyberattaque ciblant une "grande entreprise" sans nom pour se connecter à leur infrastructure.
Alors qu'un certain nombre d'outils de tunneling légitime comme Chisel, FRP, Ligolo, Ngrok et Plink ont été utilisés par les adversaires à leur avantage, le développement marque le premier Qemu qui a été
Threat actors have been observed leveraging the QEMU open-source hardware emulator as tunneling software during a cyber attack targeting an unnamed "large company" to connect to their infrastructure. While a number of legitimate tunneling tools like Chisel, FRP, ligolo, ngrok, and Plink have been used by adversaries to their advantage, the development marks the first QEMU that has been |
Tool Threat | ★★★ | |
|
2024-03-07 16:25:13 | La Lituanie avertit la Chine a augmenté les campagnes d'espionnage Lithuania warns China has ramped up espionage campaigns (lien direct) |
La Chine a augmenté ses renseignementsavecMpaignes contre la Lituanie, recruter des espions locaux et utiliser des cyber-outils pour recueillir des informations sur les affaires internes du pays et la politique étrangère du pays, selon Un nouveau rapport publié par les services de sécurité lituaniens.Leur activité dans le cyberespace du pays \\ a particulièrement augmenté depuis 2021 lorsque la Lituanie a annoncé l'ouverture des Taïwanais
China has escalated its intelligence сampaigns against Lithuania, recruiting local spies and using cyber tools to gather information on the country\'s internal affairs and foreign policy, according to a new report released by Lithuanian security services. Their activity in the country\'s cyberspace has especially increased since 2021 when Lithuania announced the opening of the Taiwanese |
Tool | ★★★ | |
|
2024-03-07 14:30:00 | Exigences de divulgation oculaire des gouvernements pour les laboratoires de développement de l'IA Governments Eye Disclosure Requirements for AI Development Labs (lien direct) |
Le scientifique de l'AI Inma Martinez prédit que les gouvernements commencent à exiger la divulgation complète de \\ 'frontier \' AI à l'objectif des outils qu'ils développent
AI scientist Inma Martinez predicts governments will start requiring \'frontier\' AI labs full disclosure on the purpose of the tools they are developing |
Tool | ★★ | |
 |
2024-03-07 11:00:00 | Nouveau faux logiciel malveillant cible les banques latino-américaines New Fakext malware targets Latin American banks (lien direct) |
> Cet article a été rendu possible grâce aux contributions d'Itzhak Chimino, Michael Gal et Liran Tiebloom.Les extensions du navigateur sont devenues intégrales à notre expérience en ligne.Des outils de productivité aux modules complémentaires de divertissement, ces petits modules logiciels offrent des fonctionnalités personnalisées en fonction des préférences individuelles.Malheureusement, les extensions peuvent également s'avérer utiles aux acteurs malveillants.Capitaliser sur le [& # 8230;]
>This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the […] |
Malware Tool | ★★★ | |
|
2024-03-07 11:00:00 | Sécuriser l'IA Securing AI (lien direct) |
With the proliferation of AI/ML enabled technologies to deliver business value, the need to protect data privacy and secure AI/ML applications from security risks is paramount. An AI governance framework model like the NIST AI RMF to enable business innovation and manage risk is just as important as adopting guidelines to secure AI. Responsible AI starts with securing AI by design and securing AI with Zero Trust architecture principles. Vulnerabilities in ChatGPT A recent discovered vulnerability found in version gpt-3.5-turbo exposed identifiable information. The vulnerability was reported in the news late November 2023. By repeating a particular word continuously to the chatbot it triggered the vulnerability. A group of security researchers with Google DeepMind, Cornell University, CMU, UC Berkeley, ETH Zurich, and the University of Washington studied the “extractable memorization” of training data that an adversary can extract by querying a ML model without prior knowledge of the training dataset. The researchers’ report show an adversary can extract gigabytes of training data from open-source language models. In the vulnerability testing, a new developed divergence attack on the aligned ChatGPT caused the model to emit training data 150 times higher. Findings show larger and more capable LLMs are more vulnerable to data extraction attacks, emitting more memorized training data as the volume gets larger. While similar attacks have been documented with unaligned models, the new ChatGPT vulnerability exposed a successful attack on LLM models typically built with strict guardrails found in aligned models. This raises questions about best practices and methods in how AI systems could better secure LLM models, build training data that is reliable and trustworthy, and protect privacy. U.S. and UK’s Bilateral cybersecurity effort on securing AI The US Cybersecurity Infrastructure and Security Agency (CISA) and UK’s National Cyber Security Center (NCSC) in cooperation with 21 agencies and ministries from 18 other countries are supporting the first global guidelines for AI security. The new UK-led guidelines for securing AI as part of the U.S. and UK’s bilateral cybersecurity effort was announced at the end of November 2023. The pledge is an acknowledgement of AI risk by nation leaders and government agencies worldwide and is the beginning of international collaboration to ensure the safety and security of AI by design. The Department of Homeland Security (DHS) CISA and UK NCSC joint guidelines for Secure AI system Development aims to ensure cybersecurity decisions are embedded at every stage of the AI development lifecycle from the start and throughout, and not as an afterthought. Securing AI by design Securing AI by design is a key approach to mitigate cybersecurity risks and other vulnerabilities in AI systems. Ensuring the entire AI system development lifecycle process is secure from design to development, deployment, and operations and maintenance is critical to an organization realizing its full benefits. The guidelines documented in the Guidelines for Secure AI System Development aligns closely to software development life cycle practices defined in the NSCS’s Secure development and deployment guidance and the National Institute of Standards and Technology (NIST) Secure Software Development Framework (SSDF). The 4 pillars that embody the Guidelines for Secure AI System Development offers guidance for AI providers of any systems whether newly created from the ground up or built on top of tools and services provided from | Tool Vulnerability Threat Mobile Medical Cloud Technical | ChatGPT | ★★ |
|
2024-03-07 07:11:54 | Arrêt de cybersécurité du mois: détection d'une attaque de code QR malveillante multicouche Cybersecurity Stop of the Month: Detecting a Multilayered Malicious QR Code Attack (lien direct) |
This blog post is part of a monthly series, Cybersecurity Stop of the Month, which explores the ever-evolving tactics of today\'s cybercriminals. It focuses on the critical first three steps in the attack chain in the context of email threats. The goal of this series is to help you understand how to fortify your defenses to protect people and defend data against emerging threats in today\'s dynamic threat landscape. The critical first three steps of the attack chain: reconnaissance, initial compromise and persistence. So far in this series, we have examined these types of attacks: Business email compromise (BEC) EvilProxy SocGholish eSignature phishing QR code phishing Telephone-oriented attack delivery (TOAD) Payroll diversion MFA manipulation Supply chain compromise In this post, we delve into a new and sophisticated QR code attack that we recently detected and stopped. It shows how attackers constantly innovate-and how Proofpoint stays ahead of the curve. The scenario Typically, in a QR code attack a malicious QR code is directly embedded in an email. But recently, attackers have come up with a new and sophisticated variation. In these multilayered attacks, the malicious QR code is hidden in what seems like a harmless PDF attachment. To slow down automated detection and confuse traditional email security tools, attackers use anti-evasion tactics like adding a Cloudflare CAPTCHA. This means that tools using traditional URL reputation detection face an uphill battle in trying to identify them. Proofpoint recently found one of these threats as it conducted a threat assessment at a U.S.-based automotive company with 11,000 employees. The company\'s incumbent security tools-an API-based email security tool and its native security-both boasted QR scanning capabilities. Yet both classified the email as clean and delivered it to the end user. The threat: How did the attack happen? Here\'s a closer look at how the attack unfolded. 1. A deceptive lure. The email was designed to appear legitimate, and it played on the urgency of tax season. This prompted the recipient to open an attached PDF. The initial email to the end user. 2. Malicious QR code embedded in the PDF. Unlike previous QR code attacks, the malicious URL in this attack was not directly visible in the email. Instead, it was hidden in the attached PDF. Given the ubiquity of QR codes, this might not have seemed suspicious to the recipient. The attached PDF with the embedded QR code (obscured). 3. Cloudflare CAPTCHA hurdle. The attacker added another layer of deception. They used a Cloudflare CAPTCHA on the landing page from the QR code URL to further hide the underlying threat. This step aimed to bypass security detection tools that rely solely on analyzing a URL\'s reputation. Cloudflare CAPTCHA on the QR code URL landing page. 4. Credential phishing endgame. Once the CAPTCHA was solved, the malicious QR code led to a phishing landing page set up to steal user credentials. The theft of user credentials can give a malicious actor access to a user\'s account to spread attacks internally for lateral movement. Or they might use them externally to deceive partners or suppliers as with supplier email compromise attacks. Detection: How did Proofpoint prevent this attack? The use of optical character recognition (OCR) or other QR code scanning techniques plays a vital role in defending against QR code threats. But QR code scanning is only the mechanism used to extract the hidden URL. It does not act as a detection mechanism to decipher between legitimate or malicious QR codes. Many tools, including the incumbent email security tools used by the automotive company, claim to parse QR codes and extract the URL for analysis. However, they lack the ability to scan URLs within an embedded image in an attachment. Few tools have engineered the ability to use in-depth URL analysis on a scale like Proofpoint. Proofpo | Tool Threat | ★★★ | |
|
2024-03-06 22:28:00 | Les pirates exploitent le fil mal conçu, le docker, la confluence, les serveurs redis pour l'exploitation de cryptographie Hackers Exploit Misconfigured YARN, Docker, Confluence, Redis Servers for Crypto Mining (lien direct) |
Les acteurs de la menace ciblent les serveurs erronés et vulnérables exécutant les services Apache Hadoop, Docker, Atlassian Confluence et Redis dans le cadre d'une campagne de logiciels malveillants émergente conçue pour fournir un mineur de crypto-monnaie et engendrer un coquille inverse pour un accès à distance persistant.
«Les attaquants tirent parti de ces outils pour émettre du code d'exploitation, en profitant des erreurs de configuration courantes et
Threat actors are targeting misconfigured and vulnerable servers running Apache Hadoop YARN, Docker, Atlassian Confluence, and Redis services as part of an emerging malware campaign designed to deliver a cryptocurrency miner and spawn a reverse shell for persistent remote access. “The attackers leverage these tools to issue exploit code, taking advantage of common misconfigurations and |
Malware Tool Threat | ★★ | |
|
2024-03-06 21:12:22 | Fil de spinning - Une nouvelle campagne de logiciels malveillants Linux cible Docker, Apache Hadoop, Redis et Confluence Spinning YARN - A New Linux Malware Campaign Targets Docker, Apache Hadoop, Redis and Confluence (lien direct) |
#### Description
Les chercheurs de CADO Security Labs ont récemment rencontré une campagne de logiciels malveillants émergente ciblant des serveurs mal configurés exécutant des services orientés Web.
La campagne utilise un certain nombre de charges utiles uniques et non déclarées, dont quatre binaires Golang, qui servent d'outils pour automatiser la découverte et l'infection des hôtes exécutant les services ci-dessus.Les attaquants tirent parti de ces outils pour émettre du code d'exploitation, en profitant des erreurs de configuration courantes et en exploitant une vulnérabilité du jour, pour effectuer des attaques d'exécution de code distant (RCE) et infecter de nouveaux hôtes.
Une fois l'accès initial atteint, une série de scripts de coquille et de techniques d'attaque General Linux sont utilisées pour livrer un mineur de crypto-monnaie, engendrer une coquille inversée et permettre un accès persistant aux hôtes compromis.
#### URL de référence (s)
1. https://www.cadosecurity.com/spinning-yarn-a-new-Linux-Malware-Campaign-Targets-Docker-Apache-Hadoop-Redis-and-Confluence /
#### Date de publication
6 mars 2024
#### Auteurs)
Matt Muir
#### Description Cado Security Labs researchers have recently encountered an emerging malware campaign targeting misconfigured servers running web-facing services. The campaign utilises a number of unique and unreported payloads, including four Golang binaries, that serve as tools to automate the discovery and infection of hosts running the above services. The attackers leverage these tools to issue exploit code, taking advantage of common misconfigurations and exploiting an n-day vulnerability, to conduct Remote Code Execution (RCE) attacks and infect new hosts. Once initial access is achieved, a series of shell scripts and general Linux attack techniques are used to deliver a cryptocurrency miner, spawn a reverse shell and enable persistent access to the compromised hosts. #### Reference URL(s) 1. https://www.cadosecurity.com/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence/ #### Publication Date March 6, 2024 #### Author(s) Matt Muir |
Malware Tool Vulnerability Threat | ★★★ | |
 |
2024-03-06 17:30:00 | Placer dans Dalvik: un aperçu des fichiers dex Delving into Dalvik: A Look Into DEX Files (lien direct) |
Lors de l'analyse d'un échantillon de Troie bancaire ciblant les smartphones Android, Mandiant a identifié l'utilisation répétée d'un mécanisme d'obscurcation de chaîne tout au long du code d'application.Pour analyser et comprendre pleinement la fonctionnalité de l'application \\, une possibilité est de décoder manuellement les chaînes dans chaque méthode obscurcie rencontrée, qui peut être un processus long et répétitif. & Nbsp; Une autre possibilité consiste à utiliser des outils payants tels que & nbsp; jeb décompulier qui permettent une identification et un correctif rapides du code dans les applications Android, mais nous avons constaté que la possibilité de faire de même avec la statique gratuite
During the analysis of a banking trojan sample targeting Android smartphones, Mandiant identified the repeated use of a string obfuscation mechanism throughout the application code. To fully analyze and understand the application\'s functionality, one possibility is to manually decode the strings in each obfuscated method encountered, which can be a time-consuming and repetitive process. Another possibility is to use paid tools such as JEB decompiler that allow quick identification and patching of code in Android applications, but we found that the ability to do the same with free static |
Tool Patching Mobile | ★★ | |
|
2024-03-06 13:55:16 | TA4903: acteur usurpation du gouvernement américain, petites entreprises en phishing, BEC BIDS TA4903: Actor Spoofs U.S. Government, Small Businesses in Phishing, BEC Bids (lien direct) |
Key takeaways TA4903 is a unique threat actor that demonstrates at least two distinct objectives: (1) credential phishing and (2) business email compromise (BEC). TA4903 routinely conducts campaigns spoofing various U.S. government entities to steal corporate credentials. The actor also spoofs organizations in various sectors including construction, finance, healthcare, food and beverage, and others. The campaign volumes range from hundreds of messages to tens of thousands of messages per campaign. The messages typically target entities in the U.S., although additional global targeting has been observed. TA4903 has been observed using the EvilProxy MFA bypass tool. In late 2023, TA4903 began adopting QR codes in credential phishing campaigns. Overview TA4903 is a financially motivated cybercriminal threat actor that spoofs both U.S. government entities and private businesses across many industries. The actor mostly targets organizations located in the United States, but occasionally those located globally, with high-volume email campaigns. Proofpoint assesses with high confidence the objectives of the campaigns are to steal corporate credentials, infiltrate mailboxes, and conduct follow-on business email compromise (BEC) activity. Proofpoint began observing a series of campaigns spoofing federal U.S. government entities in December 2021. The campaigns, which were subsequently attributed to TA4903, first masqueraded as the U.S. Department of Labor. In 2022 campaigns, the threat actors purported to be the U.S. Departments of Housing and Urban Development, Transportation, and Commerce. During 2023, the actor began to spoof the U.S. Department of Agriculture. In mid-2023 through 2024, Proofpoint observed an increase in credential phishing and fraud campaigns using different themes from TA4903. The actor began spoofing various small and medium-sized businesses (SMBs) across various industries including construction, manufacturing, energy, finance, food and beverage, and others. Proofpoint observed an increase in the tempo of BEC themes as well, including using themes such as “cyberattacks” to prompt victims to provide payment and banking details. Most credential phishing messages associated with this actor contain URLs or attachments leading to credential phishing websites. In some cases, including the government-themed campaigns, messages contain PDF attachments that contain embedded links or QR codes leading to websites that appear to be direct clones of the spoofed government agency. Based on Proofpoint\'s research and tactics, techniques, and procedures (TTPs) observed in open-source intelligence, activity related to TA4903\'s impersonation of U.S. government entities goes back to at least mid-2021. TTPs associated with the actor\'s broader credential phishing and BEC activities are observable as long ago as 2019. Campaign details Government bid spoofing Historically, Proofpoint mostly observed TA4903 conducting credential theft campaigns using PDF attachments leading to portals spoofing U.S. government entities, typically using bid proposal lures. In late 2023, TA4903 began spoofing the USDA and began incorporating QR codes into their PDFs, a technique previously unobserved by this actor. Messages may purport to be, for example: From: U.S. Department of Agriculture Subject: Invitation To Bid Attachment: usda2784748973bid.pdf Example of one page of a multi-page PDF spoofing the USDA. The “Bid Now” button is hyperlinked to the same URL as the QR code. In these campaigns, the PDF attachments are typically multiple pages long and have both embedded URLs and QR codes that lead to government-branded phishing websites. Example credential phishing website operated by TA4903, designed to capture O365 and other email account credentials. In 2023, Proofpoint observed TA4903 spoof the U.S. Department of Transportation, the U.S. Small Business Administration (SBA), and the USDA us | Tool Threat Medical | ★★★ | |
|
2024-03-06 01:05:06 | Faits saillants hebdomadaires d'osint, 4 mars 2024 Weekly OSINT Highlights, 4 March 2024 (lien direct) |
## Weekly OSINT Highlights, 4 March 2024 Ransomware loomed large in cyber security research news this week, with our curated OSINT featuring research on Abyss Locker, BlackCat, and Phobos. Phishing attacks, information stealers, and spyware are also in the mix, highlighting the notable diversity in the cyber threat landscape. The OSINT reporting this week showcases the evolving tactics of threat actors, with operators increasingly employing multifaceted strategies across different operating systems. Further, the targets of these attacks span a wide range, from civil society figures targeted by spyware in the Middle East and North Africa to state and local governments victimized by ransomware. The prevalence of attacks on sectors like healthcare underscores the significant impact on critical infrastructure and the potential for substantial financial gain through ransom payments. 1. [**Abyss Locker Ransomware Evolution and Tactics**](https://ti.defender.microsoft.com/articles/fc80abff): Abyss Locker ransomware, derived from HelloKitty, exfiltrates victim data before encryption and targets Windows systems, with a subsequent Linux variant observed. Its capabilities include deleting backups and employing different tactics for virtual machines, indicating a growing sophistication in ransomware attacks. 2. [**ALPHV Blackcat Ransomware-as-a-Service (RaaS)**:](https://ti.defender.microsoft.com/articles/b85e83eb) The FBI and CISA warn of ALPHV Blackcat RaaS, which targets multiple sectors, particularly healthcare. Recent updates to ALPHV Blackcat include improved defense evasion, encryption capabilities for Windows and Linux, reflecting the increasing sophistication in ransomware operations. 3. [**Phobos RaaS Model**](https://ti.defender.microsoft.com/articles/ad1bfcb4): Phobos ransomware, operating as a RaaS model, frequently targets state and local governments. Its use of accessible open-source tools enhances its popularity among threat actors, emphasizing the ease of deployment and customization for various environments. 4. [**TimbreStealer Phishing Campaign**](https://ti.defender.microsoft.com/articles/b61544ba): Talos identifies a phishing campaign distributing TimbreStealer, an information stealer disguised as Mexican tax-related themes. The threat actor was previously associated with banking trojans, underscoring the adaptability and persistence of malicious actors. 5. [**Nood RAT Malware Features and Stealth**](https://ti.defender.microsoft.com/articles/cc509147): ASEC uncovers Nood RAT, a Linux-based variant of Gh0st RAT, equipped with encryption and disguised as legitimate software. The malware\'s flexibility in binary creation and process naming underscores the threat actor\'s intent to evade detection and carry out malicious activities with sophistication. 6. [**Predator Spyware Infrastructure and Targeting**](https://ti.defender.microsoft.com/articles/7287eb1b): The Insikt Group\'s discovery highlights the widespread use of Predator spyware, primarily targeting journalists, politicians, and activists in various countries. Despite its purported use for counterterrorism and law enforcement, Predator is employed by threat actors outside these contexts, posing significant privacy and safety risks. ## Learn More For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: [https://aka.ms/threatintelblog](https://aka.ms/threatintelblog) and the following blog posts: - [Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself](https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/?ocid=magicti_ta_blog#defending-against-ransomware) Microsoft customers can use the following reports in Microsoft Defender Threat Intelligence to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this summary. The following | Ransomware Spam Malware Tool Threat Legislation Medical | ★★★★ | |
|
2024-03-05 20:46:20 | Le fonctionnement conjoint des ransomwares et l'évolution de leur arsenal GhostSec\\'s Joint Ransomware Operation and Evolution of their Arsenal (lien direct) |
#### Description
Cisco Talos a observé une augmentation de GhostSec, des activités malveillantes d'un groupe de piratage depuis l'année dernière.
GhostSec, un groupe de piratage à motivation financière, a été observé menant des attaques de ransomwares à double extorsion contre diverses verticales commerciales dans plusieurs pays.Le groupe a évolué avec un nouveau Ransomware Ghostlocker 2.0, une variante Golang du Ransomware Ghostlocker.Les groupes GhostSec et Stormous Ransomware mènent conjointement ces attaques et ont lancé un nouveau programme Ransomware-as-a-Service (RAAS) STMX_GHOSTLOCKER, offrant diverses options pour leurs affiliés.Les groupes GhostSec et Stormous Ransomware ont conjointement mené des attaques de ransomware à double extorsion ciblant les victimes dans divers secteurs d'activité dans plusieurs pays.
Talos a également découvert deux nouveaux outils dans l'arsenal de GhostSec \\, le "GhostSec Deep Scan Tool" et "Ghostpresser", tous deux utilisés dans les attaques contre les sites Web GhostSec sont restés actifs depuis l'année dernière et ont mené plusieurs déni de-Service (DOS) attaque et aLes sites Web des victimes ont été retirées.
#### URL de référence (s)
1. https://blog.talosintelligence.com/ghostec-ghostlocker2-ransomware/
#### Date de publication
5 mars 2024
#### Auteurs)
Chetan Raghuprasad
#### Description Cisco Talos observed a surge in GhostSec, a hacking group\'s malicious activities since this past year. GhostSec, a financially motivated hacking group, has been observed conducting double extortion ransomware attacks on various business verticals in multiple countries. The group has evolved with a new GhostLocker 2.0 ransomware, a Golang variant of the GhostLocker ransomware. GhostSec and Stormous ransomware groups are jointly conducting these attacks and have started a new ransomware-as-a-service (RaaS) program STMX_GhostLocker, providing various options for their affiliates. GhostSec and Stormous ransomware groups have jointly conducted double extortion ransomware attacks targeting victims across various business verticals in multiple countries. Talos also discovered two new tools in GhostSec\'s arsenal, the "GhostSec Deep Scan tool" and "GhostPresser," both likely being used in the attacks against websites GhostSec has remained active since last year and has conducted several denial-of-service (DoS) attacks and has taken down victims\' websites. #### Reference URL(s) 1. https://blog.talosintelligence.com/ghostsec-ghostlocker2-ransomware/ #### Publication Date March 5, 2024 #### Author(s) Chetan Raghuprasad |
Ransomware Tool | ★★★ |
To see everything:
Our RSS (filtrered)
