What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-06-25 21:14:40 | Resurgence de Strelastealer: suivi d'un voleur d'identification axé sur JavaScript ciblant l'Europe StrelaStealer Resurgence: Tracking a JavaScript-Driven Credential Stealer Targeting Europe (lien direct) |
#### Targeted Geolocations - Poland - Spain - Italy - Germany ## Snapshot The SonicWall Capture Labs threat research team has been monitoring an increase in the spread of StrelaStealer, an information stealer (infostealer) malware that first emerged in 2022. Read Microsoft\'s write-up on information stealers [here](https://security.microsoft.com/intel-profiles/2296d491ea381b532b24f2575f9418d4b6723c17b8a1f507d20c2140a75d16d6). ## Description In mid-June, there was a notable surge in JavaScript spreading StrelaStealer, which targets Outlook and Thunderbird email credentials. StrelaStealer\'s infection chain remains similar to previous versions but now includes checks to avoid infecting Russian systems. Its targets are primarily in Poland, Spain, Italy, and Germany. The initial infection vector is an obfuscated JavaScript file sent via email in archive files. This file drops a copy in the user\'s directory with a random name and then executes a batch file to check the system language, excluding Russian users by detecting the OSLanguage code "1049". If non-Russian, a base64-encoded PE file is dropped, decoded, and a DLL is created and executed using regsvr32.exe. The DLL\'s obfuscated code decrypts the actual PE file and injects it into the current process. The stealer dynamically loads necessary APIs and checks the keyboard layout to determine the system\'s geographic location. It targets languages such as Spanish, Basque, Polish, Catalan, Italian, and German. The malware starts its stealing functionality with Mozilla Thunderbird, looking for specific files and sending data to a designated IP address. It also targets Outlook by retrieving information from specific registry keys and sending this data to the same IP. ## Additional Analysis OSINT reporting about StrelaStealer indicates that its operators tend to initiate large-scale campaigns targeting organizations in specific geographic regions or countries. Initially, the malware primarily targeted Spanish-speaking users, but has since evolved to target users speaking English and other European languages. According to Palo Alto Network\'s 2024 [report](https://unit42.paloaltonetworks.com/strelastealer-campaign/) on StrelaStealer, the malware\'s main goal, to steal email login data from email clients, has not changed. However, the malware\'s infection chain and packer have been modified to evade detection and make analysis more difficult. ## Detections/Hunting Queries Microsoft Defender Antivirus detects threat components as the following malware: - *[Trojan:JS/StrelaStealer](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:JS/StrelaStealer!MSR&threatId=-2147061639)* - *[Trojan:Win64/StrelaStealer](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win64/StrelaStealer.GPAX!MTB&threatId=-2147056969)* - *[Trojan:Win32/StrelaStealer](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/StrelaStealer.ASS!MTB&threatId=-2147054947)* ## Recommendations Microsoft recommends the following mitigations to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations. - Check your Office 365 email filtering settings to ensure you block spoofed emails, spam, and emails with malware. Use [Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/defender-for-office-365?ocid=magicti_ta_learndoc) for enhanced phishing protection and coverage against new threats and polymorphic variants. Configure Microsoft Defender for Office 365 to [recheck links on click](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about?ocid=magicti_ta_learndoc) and [delete sent mail](https://learn.microsoft.com/microsoft-365/security/office-365-security/zero-hour-auto-purge?ocid=magicti_ta_learndoc) in response to newly a | Ransomware Spam Malware Tool Threat | ||
 |
2024-06-25 20:57:31 | Le laboratoire national de la santé de l'Afrique du Sud a frappé des attaques de ransomwares au milieu de l'épidémie MPOX South Africa\\'s national health lab hit with ransomware attack amid mpox outbreak (lien direct) |
Pas de details / No more details | Ransomware | ||
 |
2024-06-25 20:19:54 | L'Indonésie refuse de payer une rançon de 8 millions de dollars après la cyberattaque Indonesia Refuses to Pay $8M Ransom After Cyberattack (lien direct) |
Plus de 200 agences gouvernementales régionales et nationales ont été touchées par l'attaque des ransomwares, et peu d'entre elles sont à nouveau opérationnelles.
More than 200 regional and national government agencies have been impacted by the ransomware attack, and few of them are once again operational. |
Ransomware | ||
 |
2024-06-25 11:52:39 | Le casque de réalité virtuelle de méta \\ est vulnérable aux attaques de ransomwares: chercheur Meta\\'s Virtual Reality Headset Vulnerable to Ransomware Attacks: Researcher (lien direct) |
Le chercheur montre comment les pirates peuvent utiliser l'ingénierie sociale pour fournir des ransomwares et d'autres logiciels malveillants à la quête 3 de Meta \\. .
Researcher shows how hackers could use social engineering to deliver ransomware and other malware to Meta\'s Quest 3 VR headset. |
Ransomware Malware | ||
 |
2024-06-25 11:25:15 | KnowBe4 lance le mois de sensibilisation aux ransomwares avec informatique le kit de ressources KnowBe4 Launches Ransomware Awareness Month With IT Resource Kit at No Cost (lien direct) |
Le mois de juillet étant le mois de sensibilisation aux ransomwares, KnowBe4 a publié une boîte à outils de ressources ransomwares sans frais pour les organisations et les responsables informatiques dans le cadre d'une campagne dédiée et d'un mois en juillet pour accroître la sensibilisation aux attaques de ransomwares.Le ransomware est une cyberattaque malveillante où les cybercriminels cryptent une organisation et exigent un paiement de rançon pour regagner l'accès.[& # 8230;]
Le post KnowBe4 lance le kit de ressources de sensibilisation aux ransomwares avec informatique à note apparu pour la première fois sur gourou de la sécurité informatique .
With July being Ransomware awareness month, KnowBe4 has released a ransomware resource toolkit at no cost for organisations and IT managers as part of a dedicated, month-long campaign in July to increase awareness about ransomware attacks. Ransomware is a malicious cyberattack where cybercriminals encrypt an organisation’s data and demand a ransom payment to regain access. […] The post KnowBe4 Launches Ransomware Awareness Month With IT Resource Kit at No Cost first appeared on IT Security Guru. |
Ransomware | ||
 |
2024-06-25 10:00:00 | Le rôle de la cybersécurité dans la construction et la fabrication modernes The Role of Cybersecurity in Modern Construction and Manufacturing (lien direct) |
The content of this post is solely the responsibility of the author. LevelBlue does not adopt or endorse any of the views, positions, or information provided by the author in this article. Cybersecurity and threat preparedness may be at the forefront of your mind, and you may have protections in place against more common threats. Yet, as these threats continue to evolve, vigilance and adaptation are crucial for construction and manufacturing organizations. Cybercriminals have gotten both more prolific and more creative. 2023 saw a record-breaking spike in cyberattacks, with well over 300 million victims falling prey to data breaches, and the average corporate data breach cost 4.45 million dollars. In an industry where reputation is everything, a single breach could sink your ship in more ways than one. As we proceed, we’ll unpack the many ways that a cyberattack could impact your ability to turn a profit, making you aware of vulnerabilities that exist within your organization’s structure. Then we’ll provide you with practical suggestions to patch these vulnerabilities, insulating you from outside threats and keeping you on track to remain profitable. Computer Vision and Vulnerabilities As you use new technologies to support your existing processes, you must be aware of vulnerabilities that new systems can create. If you’ve looked into leveraging recent tech advancements in your field, you’re probably familiar with computer vision technology. Computer vision technology uses data gathered from physical images, importing them into the digital realm and unlocking a variety of potential benefits. Takeoff software and AI-powered planning systems streamline the project liftoff process by, simplifying cost estimation, identifying and correcting blueprint errors, and even advancing sustainability goals. While these systems can be leveraged to optimize a wide variety of processes, they also shift the balance of project planning from human input to automated computing processes. This in turn puts you more at risk for being a victim of a cyberattack. Malefactors can access automated systems through a wide variety of channels. Whether they break into your network via access to an IoT-connected device that someone misplaced in the workspace, or secret malicious code into the data sources your devices consume to function, increasing your use of technology also increases their windows of opportunity. As these systems increase in scope and importance, leaving windows like these open increases the risk of potentially profitable projects turning belly up. Process Disruption However, cybercriminals don’t need you to use newfangled technology solutions to cause havoc throughout your processes. Cybercriminals already have a tried-and-true playbook that they’ve been using on your competitors for years, and to great effect. Some of the ways cyberthreats can fracture manufacturers’ processes include: ● Ransomware: If a cybercriminal gains access to mission-critical data, they can then lock that data behind a ransomware program. Ransomware holds company d | Ransomware Malware Tool Vulnerability Threat Patching | ||
|
2024-06-25 10:00:00 | \\ 'p2pinfect \\' Le ver pousse les dents avec du mineur, du ransomware &Rootkit \\'P2PInfect\\' Worm Grows Teeth With Miner, Ransomware & Rootkit (lien direct) |
Pendant un certain temps, le botnet s'est répandu mais n'a essentiellement rien fait.Toutes les charges utiles malveillantes sont venues bien après.
For a while, the botnet spread but did essentially nothing. All the malicious payloads came well after. |
Ransomware | ||
 |
2024-06-25 07:46:40 | Le RAT Rafel, un malware Android qui passe de l\'espionnage aux opérations de ransomware (lien direct) | Le RAT Rafel, un malware Android qui passe de l'espionnage aux opérations de ransomware • Les appareils Android compromis dans le cadre des campagnes observées se trouvent principalement aux États-Unis, en Chine, en Indonésie, en Russie, en Inde, en France, en Allemagne et au Royaume-Uni. ● La majorité des appareils compromis sont des téléphones Samsung, Xiaomi, Vivo et Huawei, preuve de la prédominance de ces marques sur le marché. ● La plupart des appareils concernés sont équipés de versions Android non actualisées, d'où l'importance d'effectuer régulièrement des mises à jour et d'appliquer des correctifs de sécurité. ● Dans certains cas, le RAT Rafel a été utilisé pour chiffrer les fichiers d'un dispositif et pour demander une rançon pour qu'ils soient déchiffrés. ● Contournement de 2FA : le malware a également été impliqué dans le vol de messages d'authentification à deux facteurs, lui permettant ainsi de contourner cette mesure de sécurité cruciale. - Malwares | Ransomware Malware Mobile | ||
 |
2024-06-25 06:00:45 | Email mal réalisé: un problème commun et coûteux qui est facile à résoudre Misdirected Email: A Common and Costly Issue That\\'s Easy to Fix (lien direct) |
Sensitive data loss has long been an issue for organizations of all sizes, leaving them exposed to compliance and reputation risks. From phishing and ransomware to advanced threats, there is a long and growing list of ways that sensitive information can find itself outside your defenses. That said, it never really “finds itself” there. It ends up there incidentally, or intentionally-and usually, by employees. So much so that two-thirds of chief information security officers (CISOs) surveyed for our 2024 State of the Phish report said their business has experienced data loss due to an insider. Once again, there are many ways this can happen. Even today\'s most security-oblivious users likely understand that weak passwords and errant clicks or downloads pose a risk. However, another prevalent factor behind data loss does not garner the same level of focus. It may surprise many to learn that misdirected emails-legitimate messages sent to incorrect recipients-are the number one General Data Protection Regulation (GDPR)-related cyber incident reported to the U.K.\'s Information Commissioner\'s Office (ICO). Misdirected email happens all the time-and it\'s difficult to stop with traditional tools. These errors are not usually flagged by standard rule-based data loss prevention (DLP) products. That leaves users solely responsible for ensuring that their emails are always sent to the intended recipients. Unfortunately, this human line of defense is not fully equipped for the task. Why doesn\'t traditional DLP solve misdelivery? Traditional rule based DLP tools do what they do very well. Such tools remain a critical part of any effective cyber defense when it comes to protecting sensitive data. However, they have a major shortcoming in that they only check messaging against predefined risks. Traditional DLP can identify whether: Recipients are on deny lists The content contains Social Security numbers or patient identifiers (RegEx patterns) Attached documents have classification tags; for example, if an admin has tagged a document as “sensitive” Assuming your email passes these checks, it is deemed safe to send. A misdirected email to a legitimate (albeit incorrect) recipient would not raise any red flags. A rule-based system would determine that this type of email is good to go. But based on Verizon\'s Data Breach Investigations Report (DBIR) data, which shows that email misdelivery is prevalent across all industries, we know that it\'s not. An adaptive, artificial intelligence (AI)-powered DLP solution goes much further. It doesn\'t just look for common predefined risks. Rather, it analyzes all aspects of an email for anything that looks anomalous. So, on top of checking for common red flags, it can detect abnormal groupings of recipients and flag sensitive words, phrases or content that are not ordinarily shared with the intended recipients-whether in the body of the message or in any attachments. The solution will then determine whether an email is safe to send. Overview showing how Tessian automatically detects what rule-based DLP misses. Should it detect a potential mistake or sensitive data loss incident, Proofpoint Adaptive Email DLP will intervene to question the accuracy of the recipient, offer a brief explanation of the potential issue and ask whether the sender wishes to proceed or cancel. Error message: Is this the correct recipient message? Put simply, traditional DLP cannot stop incidents like these because they can\'t be predefined. But Adaptive Email DLP can avert potential disasters in real time with simple, on-screen prompts for users so that they can correct any mistakes. With a complete timeline of each incident-what was being sent, who it was being sent to and why it was stopped-security teams get actionable insight into common mistakes and intentional attempts to misdirect company data to personal or | Ransomware Data Breach Tool | ||
 |
2024-06-25 06:00:00 | P2PINFECT BOTNET cible les serveurs Redis avec un nouveau module de ransomware P2PInfect botnet targets REdis servers with new ransomware module (lien direct) |
P2PinFect, à l'origine un botnet malware pair-to-peer dormant avec des motifs peu clairs, est enfin pris vie pour déployer un module de ransomware et un cryptominer dans les attaques sur les serveurs redis.[...]
P2PInfect, originally a dormant peer-to-peer malware botnet with unclear motives, has finally come alive to deploy a ransomware module and a cryptominer in attacks on Redis servers. [...] |
Ransomware Malware | ||
|
2024-06-24 21:57:20 | Attaque de CDK: Pourquoi la planification de la contingence est essentielle pour les clients SaaS CDK Attack: Why Contingency Planning Is Critical for SaaS Customers (lien direct) |
Les opérations quotidiennes chez quelque 15 000 concessionnaires automobiles restent affectées car CDK travaille pour restaurer son système de gestion des concessionnaires, après ce qui semble être une attaque de ransomware la semaine dernière.
Daily operations at some 15,000 automotive dealers remain impacted as CDK works to restore its dealer management system, following what appears to be a ransomware attack last week. |
Ransomware Cloud | ||
 |
2024-06-24 18:47:45 | Les marchands de voitures américains ressentent la douleur de la cyberattaque CDK US car dealers are feeling the pain of CDK cyberattack (lien direct) |
> Une poignée de principaux concessionnaires automobiles américains ont déclaré que leurs opérations commerciales avaient été affectées par un incident de ransomware sur le fournisseur de logiciels clés.
>A handful of major U.S. auto dealers said their business operations have been affected by a ransomware incident on the key software provider. |
Ransomware | ||
 |
2024-06-24 17:31:43 | HC3 publie un profil de menace sur les ransomwares Qilin ciblant les soins de santé mondiaux, d'autres secteurs critiques HC3 releases threat profile on Qilin ransomware targeting global healthcare, other critical sectors (lien direct) |
Le centre de coordination de la cybersécurité du secteur de la santé (HC3) du Département américain de la santé & # 38;Les services humains (HHS) ont ...
The Health Sector Cybersecurity Coordination Center (HC3) of the U.S. Department of Health & Human Services (HHS) has... |
Ransomware Threat Medical | ||
|
2024-06-24 15:39:00 | Le centre de données national de l'Indonésie crypté avec une variante de ransomware de verrouillage Indonesia\\'s national data center encrypted with LockBit ransomware variant (lien direct) |
Pas de details / No more details | Ransomware | ||
|
2024-06-24 14:46:29 | La nouvelle plate-forme PHAAS permet aux attaquants de contourner l'authentification à deux facteurs New PhaaS Platform Lets Attackers Bypass Two-Factor Authentication (lien direct) |
#### Targeted Geolocations - Eastern Europe - Northern Europe - Southern Europe - Western Europe - Middle East - Central America and the Caribbean - North America - South America #### Targeted Industries - Financial Services ## Snapshot EclecticIQ analysts discovered phishing campaigns targeting financial institutions using QR codes embedded in PDF attachments to direct victims to phishing URLs. ## Description The attacks were facilitated by a Phishing-as-a-Service (PhaaS) platform called ONNX Store, which operates through Telegram bots. ONNX Store includes a two-factor authentication (2FA) bypass mechanism that intercepts 2FA requests, increasing the success rate of Business Email Compromise (BEC) attacks. The phishing pages mimic Microsoft 365 login interfaces, tricking targets into entering their authentication details. Analysts believe with high confidence that ONNX Store is likely a rebranded version of the Caffeine phishing kit, discovered by Mandiant in 2022, based on overlapping infrastructure and Telegram advertisements. The Arabic-speaking threat actor MRxC0DER is thought to be the developer and maintainer of Caffeine, and likely provides client support for ONNX Store. ONNX Store offers various services via Telegram bots, including phishing templates, webmail services, and bulletproof hosting. It leverages Cloudflare to delay takedown processes and evade detection, using features like CAPTCHA and IP proxying to protect malicious sites. ONNX Store distributes PDF documents with embedded QR codes that direct victims to phishing pages, often impersonating reputable services like Adobe or Microsoft 365. These QR codes are difficult for organizations to detect, especially on mobile devices. Most phishing campaigns target financial institutions in the EMEA and AMER regions, including banks and credit unions. The phishing kit uses encrypted JavaScript to evade detection and captures 2FA tokens in real-time, relaying them to attackers. ONNX Store also provides bulletproof hosting, allowing cybercriminals to operate without shutdown risks. The broader implications of these phishing toolkits include aiding credential theft and ransomware attacks. ## Microsoft Analysis ## Detections/Hunting Queries EclecticIQ identified two YARA Rules that can be used to identifiy potentially malicious domains or PDF Files from the ONNX Store. HUNT\_CRIME\_ONNX\_PHISHING\_URL is designed to identify specific patterns associated with malicious domains that utilize ONNX Store API such as default error messages and Telegram support links. | rule HUNT\_CRIME\_ONNX\_PHISHING\_URL { meta: description = "Searches for default ONNX Store API error" author = "Arda Buyukkaya" date = "2024-05-23" hash = "77e03c77a2bdbc09d5279fa316a35db0" strings: $contact\_link = "https://t.me/ONNXIT" $support\_message = "Please contact ONNX SUPPORT" $expired\_api = "Your API has been expired" condition: all of them } | | --- | MAL\_CRIME\_ONNX\_Store\_Phishing\_PDF\_QR is designed to detect potenetioally malcioius QR codes with PDF files. | rule MAL\_CRIME\_ONNX\_Store\_Phishing\_PDF\_QR { meta: description = "Detects potentially malicious PDFs based on structural patterns" author = "Arda Buyukkaya" date = "2024-05-17" hash = "0250a5ba26791e7ffddb4b294d486479" strings: $pdf = "%PDF-" $magic\_classic = "%!FontType1-1." $magic\_font = /obj\s\*]\*\/Subtype\s\*\/Type1/ $magic\_font2 = /obj\s\* | Ransomware Tool Threat Mobile | ||
|
2024-06-24 14:16:35 | Sécurité centrée sur l'homme dans l'écosystème de cybersécurité et la stratégie Better Together de Pointpoint \\ Human Centric Security in the Cybersecurity Ecosystem and Proofpoint\\'s Better Together Strategy (lien direct) |
In my previous blog, I detailed how Proofpoint has redefined email security, a central pillar of what Gartner has termed Human-Centric Security, one of their three strategic priorities for CISOs in 2024 and 2025. Now I\'d like to give you an idea of how we think human-centric security fits with the rest of the modern security stack and how the current trend toward more comprehensive security solution architectures is influencing our strategic direction. The Third Era It\'s worthwhile to start with a bit of history. In our view, we\'ve entered the third major evolution of cybersecurity. In the earliest period, the perimeter was established, and basic controls were put in place. The technologies were fewer and less capable, but the consequences of security failures were nowhere near as severe as they are now. In the second era, the perimeter largely dissolved and the rapid adoption of new technologies during the heyday of digital transformation led to a massive proliferation of point security solutions, cropping up nearly as fast as the tools they were meant to secure. Unfortunately, the cost of the security engineering, operational integration, and alert response required for these tools to be effective often outweighed the risk mitigation they provided. Now we\'ve arrived a phase where the security architectures of the future are finally taking shape. They share several key characteristics: they\'re highly integrated, cloud-deployed, and align to what security teams really need to protect: their infrastructure, the apps that run on it, the data that powers those applications, and of course the humans that simultaneously constitute their organization\'s greatest asset and biggest risk. The Pillars of a Modern Security Architecture To protect the spectrum between infrastructure and people, five key control planes have emerged. The first of those components is the network, where controls have moved past the classic confines of the firewall, proxy, VPN, and other network devices to the cloud-based consolidated services that make up the modern Secure Access Services Edge (SASE). Secondly, endpoint and server protection evolved into first Endpoint Detection and Response (EDR) and then XDR as servers were increasingly replaced by cloud workloads. That of course leaves the human element, to which I\'ll return shortly, and the two cross-architecture layers: the operational processes, increasingly automated, that drive the controls and respond to the alerts they generate, and the identity fabric, both human and machine, that ties everything together. These architectures are powerful on their own, and their effectiveness compounds when they\'re well integrated. Attackers have often exploited the gaps between poorly implemented and monitored security controls to pass from a compromise of a person\'s credentials through the network to the administrative privileges that make ransomware so disruptive. Frustrating adversaries becomes much more achievable when well-integrated security controls reinforce each other, providing not just defense in depth but also defense in breadth. For example, an attacker\'s job is much harder when the malicious attachment they use to try and target a person is blocked and analyzed, with the resulting intelligence shared across SASE and XDR. Human-Centric Security and the Ecosystem With the rise of these modern security architectures, our controls for protecting networks, endpoints, and infrastructure have evolved, becoming more comprehensive, adaptive, and effective. With over 90% of breaches involving the human element, Proofpoint\'s human-centric security platform uniquely does the same for people and integrates with the key leaders across the other five components of the modern security stack. In pioneering human-centric security, we\'ve brought together previously disconnected functionality to accomplish two critical goals. The first is helping organizations protect their people from targeted attacks, impersonation, and supplier risk, along with making their people more resilien | Ransomware Tool Threat Prediction Cloud | ||
 |
2024-06-24 13:12:32 | 24 juin & # 8211;Rapport de renseignement sur les menaces 24th June – Threat Intelligence Report (lien direct) |
> Pour les dernières découvertes en cyber recherche pour la semaine du 24 juin, veuillez télécharger notre bulletin de renseignement sur les menaces.Les meilleures attaques et violations Le groupe de ransomware de NoirSuit a perturbé les opérations chez CDK Global, un fournisseur important de solutions de marketing informatique et numérique à l'industrie automobile, ciblant leurs plateformes SaaS aux États-Unis et [& # 8230;]
>For the latest discoveries in cyber research for the week of 24th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The BlackSuit ransomware group has disrupted operations at CDK Global, a significant provider of IT and digital marketing solutions to the automotive industry, targeting their SaaS platforms across the United States and […] |
Ransomware Threat Cloud | ||
|
2024-06-24 12:48:47 | Faits saillants hebdomadaires OSINT, 24 juin 2024 Weekly OSINT Highlights, 24 June 2024 (lien direct) |
## Snapshot Last week\'s OSINT reporting reveals a persistent focus on sophisticated cyber espionage and ransomware campaigns by state-sponsored threat actors and advanced cybercriminal groups. Key trends include the exploitation of known vulnerabilities in network devices and hypervisors by Chinese groups like Velvet Ant and UNC3886, leveraging custom malware for long-term access and data theft. Meanwhile, actors active in the Middle Eastern and South Asian such as Arid Viper and UTA0137 continue to target adversaries with trojanized apps and Linux malware, respectively. Additionally, innovative social engineering techniques, like those used by TA571 and ClearFake, highlight the evolving methods threat actors employ to deliver diverse payloads, including ransomware and information stealers. The consistent targeting of critical infrastructure, government entities, and high-value enterprises underscores the need for robust, multi-layered cybersecurity defenses to mitigate these sophisticated and persistent threats. ## Description 1. **[Arid Viper Espionage Campaigns](https://sip.security.microsoft.com/intel-explorer/articles/19d9cd7d)**: ESET researchers uncovered Arid Viper\'s espionage campaigns targeting Android users in Egypt and Palestine. The campaigns distribute trojanized apps through dedicated websites, focusing on user data espionage with their AridSpy malware, a sophisticated multistage Android spyware. 2. **[Velvet Ant Exploits F5 BIG-IP](https://sip.security.microsoft.com/intel-explorer/articles/e232b93d)**: Sygnia analysts revealed that the Chinese cyberespionage group Velvet Ant exploited vulnerabilities in F5 BIG-IP appliances to deploy malware like PlugX, enabling long-term access and data theft. These incidents emphasize the threat posed by persistent threat groups exploiting network device vulnerabilities. 3. **[UNC3886 Targets Hypervisors](https://sip.security.microsoft.com/intel-explorer/articles/faed9cc0)**: Google Cloud reported that Mandiant investigated UNC3886, a suspected Chinese cyberespionage group, targeting hypervisors with sophisticated malware and exploiting vulnerabilities in FortiOS and VMware technologies. The group utilized rootkits and custom malware for persistence and command and control. 4. **[UTA0137 Cyber-Espionage Campaign](https://sip.security.microsoft.com/intel-explorer/articles/bc2b5c55)**: Volexity identified Pakistan-based UTA0137 targeting Indian government entities with DISGOMOJI malware, which uses Discord for command and control. The campaign targets Linux systems, employing various persistence mechanisms and exploiting vulnerabilities like DirtyPipe for privilege escalation. 5. **[Proofpoint Highlights Copy-Paste Attacks](https://sip.security.microsoft.com/intel-explorer/articles/c75089e9)**: Proofpoint researchers reported that threat actors, including TA571 and ClearFake, are using techniques that prompt users to copy and paste malicious PowerShell scripts. These campaigns deliver various malware, including DarkGate and NetSupport, through clever social engineering tactics that trick users into compromising their systems. 6. **[Shinra and Limpopo Ransomware](https://sip.security.microsoft.com/intel-explorer/articles/b7a96cbd)**: FortiGuard Labs identified the emergence of Shinra and Limpopo ransomware strains in early 2024. Shinra ransomware exfiltrates data before encryption, while Limpopo targets ESXi environments, affecting multiple countries and causing significant disruptions. 7. **[CVE-2024-4577 Vulnerability Exploits](https://sip.security.microsoft.com/intel-explorer/articles/8635c515)**: Cyble Global Sensor Intelligence detected multiple scanning attempts exploiting CVE-2024-4577, a vulnerability in Windows affecting PHP installations. Threat actors are using this flaw to deploy ransomware and malware, emphasizing the urgent need for organizations to upgrade PHP versions to mitigate risks. 8. **[SmallTiger Malware Targets South Korea](https://sip.security.microsoft.com/intel-explorer/articles/3f29a6c8)**: The AhnLab Securi | Ransomware Malware Tool Vulnerability Threat Mobile Cloud | APT-C-23 | |
 |
2024-06-24 12:34:07 | Lockbit Ransomware réclame 33 TB des données de la Réserve fédérale américaine pour Ransom LockBit Ransomware Claims 33 TB of US Federal Reserve Data for Ransom (lien direct) |
Lockbit Ransomware prétend contenir 33 To de données de la Réserve fédérale américaine pour Ransom.Hackread.com enquête, tendant la main à CISA pour des commentaires sur la violation et les négociations en cours.Restez à jour!
LockBit ransomware claims to hold 33 TB of data from the US Federal Reserve for ransom. Hackread.com investigates, reaching out to CISA for comments on the breach and ongoing negotiations. Stay updated! |
Ransomware | ||
 |
2024-06-23 09:43:00 | MEDUSA RANSOMWARE: Regarder les cyber-menaces dans les yeux avec Darktrace Medusa Ransomware: Looking Cyber Threats in the Eye with Darktrace (lien direct) |
Ce blog examine Medusa Ransomware, une variante Ransomware-as-a-Service (RAAS) qui est connue pour utiliser la vie des techniques terrestres pour infecter les réseaux cibles et se déplacer vers ses objectifs ultimes, le cryptage des données et l'exfiltration.
This blog investigates Medusa ransomware, a Ransomware-as-a-Service (RaaS) variant that is known to use living off the land techniques to infect target networks and move towards its ultimate goals, data encryption and exfiltration. |
Ransomware | ||
|
2024-06-22 15:08:43 | CDK Global Putage causée par une attaque de ransomware de combinaison noire CDK Global outage caused by BlackSuit ransomware attack (lien direct) |
Le gang de ransomwares noirs est derrière la panne d'informatique massive de CDK Global \\ et les perturbations des concessionnaires automobiles en Amérique du Nord, selon plusieurs sources familières avec le problème.[...]
The BlackSuit ransomware gang is behind CDK Global\'s massive IT outage and disruption to car dealerships across North America, according to multiple sources familiar with the matter. [...] |
Ransomware | ||
|
2024-06-22 10:19:38 | Rafel Rat cible les téléphones Android obsolètes dans des attaques de ransomwares Rafel RAT targets outdated Android phones in ransomware attacks (lien direct) |
Un logiciel malveillant Android open source nommé \\ 'rafel rat \' est largement déployé par plusieurs cybercriminels pour attaquer les appareils obsolètes, certains visant à les verrouiller avec un module de ransomware qui exige le paiement sur Telegram.[...]
An open-source Android malware named \'Rafel RAT\' is widely deployed by multiple cybercriminals to attack outdated devices, some aiming to lock them down with a ransomware module that demands payment on Telegram. [...] |
Ransomware Malware Mobile | ||
 |
2024-06-21 15:33:07 | Vente du code source du Ransomware INC (lien direct) | Depuis août 2023, le ransomware INC, fonctionnant sous le modèle Ransomware-as-a-Service (RaaS), fait parler de lui. Le code source a été mis en vente sur le darknet. | Ransomware | ||
|
2024-06-21 15:26:59 | Avec une revue presque terminée, UnitedHealth dit \\ 'Aucune preuve \\' Doctors \\ 'graphiques volés en attaque de ransomware With review nearly finished, UnitedHealth says \\'no evidence\\' doctors\\' charts stolen in ransomware attack (lien direct) |
Pas de details / No more details | Ransomware | ||
|
2024-06-21 12:10:25 | Modifier les soins de santé répertorie les données médicales volées dans une attaque de ransomware Change Healthcare lists the medical data stolen in ransomware attack (lien direct) |
UnitedHealth a confirmé pour la première fois quels types de données médicales et des patients ont été volées lors de l'attaque de ransomware de soins de santé massive à changement, indiquant que les notifications de violation de données seront postées en juillet.[...]
UnitedHealth has confirmed for the first time what types of medical and patient data were stolen in the massive Change Healthcare ransomware attack, stating that data breach notifications will be mailed in July. [...] |
Ransomware Data Breach Medical | ||
|
2024-06-21 12:07:13 | Ransomware Qilin fuit 400 Go de NHS et de données sur les patients sur le télégramme Qilin Ransomware Leaks 400GB of NHS and Patient Data on Telegram (lien direct) |
Découvrez l'impact de l'attaque des ransomwares de Qilin contre Synnovis et services de santé.Découvrez les conséquences de ce cyber-incident et ses implications pour les soins aux patients.
Learn about the impact of the Qilin ransomware attack on Synnovis and healthcare services. Discover the consequences of this cyber incident and its implications for patient care. |
Ransomware Medical | ||
|
2024-06-21 11:55:26 | Près de 200 opérations de cancer reportées alors que le groupe de ransomware publie des données de london Almost 200 cancer operations postponed as ransomware group publishes London hospitals data (lien direct) |
Pas de details / No more details | Ransomware | ||
 |
2024-06-21 11:15:07 | Qilin Cyber Scum Données de fuite qu'ils prétendent appartiennent à London Hospitals \\ 'Pathology Provider Qilin cyber scum leak data they claim belongs to London hospitals\\' pathology provider (lien direct) |
Au moins, ils n'ont pas été payés à leur demande de rançon de 50 millions de dollars Le gang de ransomware responsable du chaos dans les hôpitaux de Londres est resté fidèle à sa parole et a publié une mine de données qu'il prétend appartenirau fournisseur de services de pathologie Synnovis.…
At least they didn\'t get paid their $50 million ransom demand The ransomware gang responsible for the chaos at London hospitals kept true to its word and released a trove of data that it claims belongs to pathology services provider Synnovis.… |
Ransomware | ||
 |
2024-06-21 09:50:00 | Les attaquants de Synnovis publient les données des patients NHS en ligne Synnovis Attackers Publish NHS Patient Data Online (lien direct) |
Ransomware Group Qilin aurait publié près de 400 Go de données volées à la suite de l'attaque contre le fournisseur NHS Synnovis début juin
Ransomware group Qilin has reportedly published nearly 400GB of data stolen following the attack on NHS provider Synnovis in early June |
Ransomware | ★★ | |
|
2024-06-20 15:00:36 | RAFEL RAT, Android Malware de l'espionnage aux opérations de ransomware Rafel RAT, Android Malware from Espionage to Ransomware Operations (lien direct) |
> En ce qui concerne les appareils mobiles, Android est le système d'exploitation le plus populaire et le plus utilisé avec plus de 3,9 milliards d'utilisateurs actifs dans plus de 190 pays.Les trois quarts de tous les appareils mobiles fonctionnent sur Android.Cependant, avec son adoption généralisée et son environnement ouvert vient le risque d'activité malveillante.Android Malware, un logiciel malveillant conçu pour cibler les appareils Android, constitue une menace importante pour les utilisateurs & # 8217;confidentialité, sécurité et intégrité des données.Ces programmes malveillants se présentent sous diverses formes, y compris les virus, les chevaux de Troie, les ransomwares, les logiciels espions et les logiciels publicitaires, et ils peuvent infiltrer des appareils via plusieurs vecteurs, tels que les téléchargements d'applications, les sites Web malveillants, les attaques de phishing et même [& # 8230;]
>When it comes to mobile devices, Android is the most popular and used operating system with over 3.9 billion active users in over 190 countries. Three-quarters of all mobile devices run on Android. However, with its widespread adoption and open environment comes the risk of malicious activity. Android malware, a malicious software designed to target Android devices, poses a significant threat to users’ privacy, security, and data integrity. These malicious programs come in various forms, including viruses, Trojans, ransomware, spyware, and adware, and they can infiltrate devices through multiple vectors, such as app downloads, malicious websites, phishing attacks, and even […] |
Ransomware Malware Threat Mobile | ★★ | |
|
2024-06-20 15:00:00 | Rafel RAT, Android Malware from Espionage to Ransomware Operations (lien direct) | > Recherche de: Antonis Terefos, Bohdan Melnykov Introduction Android, le système d'exploitation mobile le plus populaire de Google, alimente des milliards de smartphones et de tablettes à l'échelle mondiale.Connu pour sa nature open source et sa flexibilité, Android offre aux utilisateurs un large éventail de fonctionnalités, d'options de personnalisation et d'accès à un vaste écosystème d'applications via le Google Play Store et d'autres sources.Cependant, [& # 8230;]
>Research by: Antonis Terefos, Bohdan Melnykov Introduction Android, Google\'s most popular mobile operating system, powers billions of smartphones and tablets globally. Known for its open-source nature and flexibility, Android offers users a wide array of features, customization options, and access to a vast ecosystem of applications through the Google Play Store and other sources. However, […] |
Ransomware Malware Mobile | ★★ | |
|
2024-06-20 13:33:38 | Lockbit Ransomware à nouveau le plus actif & # 8211;Une véritable poussée d'attaque ou un écran de fumée? LockBit Ransomware Again Most Active – Real Attack Surge or Smokescreen? (lien direct) |
> Lockbit semble être à nouveau le groupe de ransomware le plus actif, mais les experts pensent que les pirates peuvent simplement gonfler leurs chiffres.
>LockBit appears to once again be the most active ransomware group, but experts believe the hackers may just be inflating their numbers. |
Ransomware | ★★★ | |
|
2024-06-20 13:30:00 | Lockbit le plus éminent acteur de ransomware en mai 2024 LockBit Most Prominent Ransomware Actor in May 2024 (lien direct) |
Le groupe Ransomware Lockbit a renvoyé le pli pour lancer 176 attaques en mai 2024 à la suite d'un démontage des forces de l'ordre, le groupe NCC a trouvé
The LockBit ransomware group returned the fold to launch 176 attacks in May 2024 following a law enforcement takedown, NCC Group found |
Ransomware Legislation | ★★ | |
|
2024-06-20 10:29:06 | Qilin: Nous savions que notre attaque Synnovis entraînerait une crise des soins de santé dans les hôpitaux de Londres Qilin: We knew our Synnovis attack would cause a healthcare crisis at London hospitals (lien direct) |
Les cybercriminels affirment qu'ils ont utilisé un jour zéro pour vioder les systèmes du fournisseur de pathologie \\ interview Le gang de ransomware responsable de la crise actuelle des soins de santé dans les hôpitaux de Londres dit qu'il aAucun regret sur l'attaque, qui était entièrement délibéré, il a dit à le registre dans une interview.…
Cybercriminals claim they used a zero-day to breach pathology provider\'s systems Interview The ransomware gang responsible for the current healthcare crisis at London hospitals says it has no regrets about the attack, which was entirely deliberate, it told The Register in an interview.… |
Ransomware Vulnerability Threat Medical | ★★★ | |
 |
2024-06-20 10:25:56 | Ransomware Qilin: ce que vous devez savoir Qilin Ransomware: What You Need To Know (lien direct) |
Qu'est-ce que Qilin?Qilin (également connu sous le nom d'agenda) est une opération criminelle ransomware en tant que service qui travaille avec des affiliés, cryptant et exfiltrant les données des organisations piratées, puis exigeant qu'une rançon soit payée.Qilin semble être un nom étrange.D'où est ce que ça vient?Le Qilin est une créature de la mythologie chinoise qui combine les caractéristiques d'un dragon et d'une bête à cornes.Parfois, il est comparé à une licorne.Le ransomware de Qilin vient donc de Chine?Euh, non.Désolé.Le groupe derrière l'opération Ransomware de Qilin semble être lié à la Russie.Hmmph.Alors, combien de temps le Qilin ...
What is Qilin? Qilin (also known as Agenda) is a ransomware-as-a-service criminal operation that works with affiliates, encrypting and exfiltrating the data of hacked organisations and then demanding a ransom be paid. Qilin seems like a strange name. Where does it come from? The Qilin is a creature from Chinese mythology that combines the features of a dragon and a horned beast. Sometimes, it is compared to a unicorn. So the Qilin ransomware comes from China? Err, no. Sorry. The group behind the Qilin ransomware operation appears to be linked to Russia. Hmmph. So how long has the Qilin... |
Ransomware | ★★ | |
|
2024-06-20 09:44:00 | Élever la sécurité du réseau: confrontant la confiance, les ransomwares et les attaques nouvelles Elevating Network Security: Confronting Trust, Ransomware, & Novel Attacks (lien direct) |
Assurer la confiance, lutter contre les ransomwares et détecter de nouvelles attaques posent des défis critiques dans la sécurité du réseau.Ce blog explore ces défis et montre comment la mise à profit des solutions de sécurité axées sur l'IA aide les équipes de sécurité à rester informées et à protéger efficacement leur réseau.
Ensuring trust, battling ransomware, and detecting novel attacks pose critical challenges in network security. This blog explores these challenges and shows how leveraging AI-driven security solutions helps security teams stay informed and effectively safeguard their network. |
Ransomware | ||
|
2024-06-18 20:33:27 | From Clipboard to Compromise: A PowerShell Self-Pwn (lien direct) | ## Instantané Les chercheurs de ProofPoint ont identifié une technique qui ordonne aux utilisateurs de copier et de coller des scripts PowerShell malveillants pour infecter leurs ordinateurs par des logiciels malveillants.Des acteurs de menace, dont TA571 et les acteurs derrière le cluster d'activités Clearfake, utilisent cette méthode pour fournir des logiciels malveillants, notamment Darkgate, Matanbuchus, Netsupport et divers voleurs d'informations. ## Description Proofpoint a observé cette technique dans plusieurs campagnes récentes impliquant plusieurs acteurs de menace, y compris ceux qui sont derrière Clearfake et l'acteur de menace TA571, connu pour la distribution des spams menant à des logiciels malveillants et à des infections au ransomware.La chaîne d'attaque nécessite une interaction importante des utilisateurs pour réussir, mais l'ingénierie sociale est suffisamment intelligente pour présenter à quelqu'un ce qui ressemble à un vrai problème et une solution simultanément, ce qui peut inciter un utilisateur à prendre des mesures sans considérer le risque. La campagne Clearfake est un faux cluster d'activités de mise à jour du navigateur qui compromet les sites Web légitimes avec un HTML et un JavaScript malveillants.Le script initial a ensuite chargé un deuxième script à partir d'un domaine qui a utilisé Keitaro TDS pour le filtrage.Si ce deuxième script se chargeait et passait divers chèques, et si la victime continuait de parcourir le site Web, il a été présenté avec une fausse superposition d'avertissement sur le site Web compromis.Cet avertissement leur a demandé d'installer un "certificat racine" pour afficher correctement le site Web. La campagne TA571 comprenait plus de 100 000 messages et ciblé des milliers d'organisations dans le monde.Les e-mails contenaient une pièce jointe HTML qui affichait une page ressemblant à Microsoft Word.La page a également affiché un message d'erreur qui disait l'extension «\\» word en ligne \\ 'n'est pas installée »et a présenté deux options pour continuer:« comment réparer »et« automatique ». Les charges utiles observées comprennent Darkgate, Matanbuchus, Netsupport, Amadey Loader, XMRIG et Lummma Stealer.Les acteurs de la menace expérimentent activement différentes méthodes pour améliorer l'efficacité et trouver plus de voies d'infection pour compromettre un plus grand nombre de systèmes. ## Analyse Microsoft Ces dernières années, Microsoft a suivi le risque croissant que les infostateurs présentent à la sécurité des entreprises.Les infostateurs sont des logiciels malveillants de marchandises utilisés pour voler des informations à un appareil cible et l'envoyer à l'acteur de menace.La popularité de cette classe de logiciels malveillants a conduit à l'émergence d'un écosystème d'infosteller et à une nouvelle classe d'acteurs de menace qui a exploité ces capacités pour mener leurs attaques.Les infostelleurs sont annoncés comme un logiciel malveillant en tant que service (MAAS) offrant & # 8211;Un modèle d'entreprise où les développeurs louent la charge utile de l'infostealer aux distributeurs moyennant des frais. Les voleurs d'informations sont polyvalents et peuvent être distribués sous diverses formes, notamment par le biais de campagnes par e-mail de phishing, de malvertising et de logiciels, de jeux et d'outils maladucs.En règle générale, une fois que l'utilisateur télécharge et lance la charge utile malveillante, il établit des connexions de commande et de contrôle (C2) avec des domaines suspects.Une fois infecté, l'infostaler tente de collecter et finalement exfilter les informations du système, y compris les fichiers, les navigateurs, les appareils et les applications orientés sur Internet aux serveurs C2.En savoir plus [ici sur l'analyse des infostelleurs de Microsoft \\] (https://security.microsoft.com/intel-profileS / 2296D491EA381B532B24F2575F9418D4B6723C17B8A1F507D20C2140A75D16D6). - [darkgate] (https://securit | Ransomware Spam Malware Tool Threat | ★★★★ | |
|
2024-06-18 19:53:36 | Blackbaud a condamné à une amende de 6,75 millions de dollars après 2020 Ransomware Attack Blackbaud Fined $6.75M After 2020 Ransomware Attack (lien direct) |
Les acteurs de la menace ont pu violer les systèmes de Blackbaud et compromettre les données sensibles, en grande partie à cause des mauvaises pratiques de cybersécurité de l'entreprise et du manque de données cryptées, a déclaré l'AG.
Threat actors were able to breach Blackbaud\'s systems and compromise sensitive data, largely because of the company\'s poor cybersecurity practices and lack of encrypted data, the AG said. |
Ransomware Threat | ★★ | |
|
2024-06-18 18:22:59 | Ransomware Roundup _ Shinra et Limpopo Ransomware Ransomware Roundup _ Shinra and Limpopo Ransomware (lien direct) |
#### Géolocations ciblées - Israël - Pologne - Russie - Royaume-Uni - États-Unis ## Instantané Fortiguard Labs Researcha identifié le ransomware Shinra et Limpopo dans leur rapport Ransomware Roundup.Les souches de ransomware de Shinra et Limpopo, émergeant au début de 2024, présentent des techniques avancées et ont ciblé plusieurs pays, provoquant des perturbations importantes en cryptant des fichiers et en exigeant des rançons. ## Description Le ransomware de Shinra, vu pour la première fois en avril 2024, exfiltre les données de la victime avant de chiffrer les fichiers et de supprimer des copies fantômes de volume.Il affecte les victimes en Israël, en Pologne, en Russie, au Royaume-Uni et aux États-Unis, met fin aux processus et aux services, modifie le papier peint de bureau et évite de crypter des fichiers et des répertoires spécifiques. Les ransomwares limpopo, liés aux ransomwares Socotra, ciblent les environnements ESXi et ont été soumis pour scanning en février 2024. Le vecteur d'infection pour les ransomwares limpopo est inconnu, mais il affecte plusieurs pays et crypte des fichiers avec des extensions spécifiques, ajoutant une prolongation ".limpopo" ".aux fichiers de liste blanche.Il laisse tomber une note de rançon exigeant la coopération et fournit un lien pour d'autres instructions. ## Détections / requêtes de chasse Microsoft Defender Antivirus détecte les composants de la menaceComme les logiciels malveillants suivants: - Ransom: Linux / Babuk - Ransom: win64 / akira - rançon: win32 / conti - Trojan: Linux / Filecoder ## ReCommensions Microsoft recommande les atténuations suivantes pour réduire l'impact des menaces de ransomware. - Allumez [Protection en livraison du cloud] (https://learn.microsoft.com/microsoft-365/security/defender-endpoint/configure-lock-at-first-sight-microsoft-defender-asvirus?ocid=magicti_ta_learndoc)Dans Microsoft Defender Antivirus ou l'équivalent pour que votre produit antivirus couvre des outils et techniques d'attaquant en évolution rapide.Les protections d'apprentissage automatique basées sur le cloud bloquent une énorme majorité de variantes nouvelles et inconnues. - Allumez [Protection Tamper] (https://learn.microsoft.com/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?ocid=Magicti_TA_LearnDoc).Empêcher les attaquants d'empêcher les services de sécurité. - Exécutez [Détection et réponse de point de terminaison (EDR) en mode bloc] (https://learn.microsoft.com/microsoft-365/security/defender-endpoint/edr-in-lock-mode?ocid=Magicti_TA_Learndoc), de sorte que celaLe défenseur du point final peut bloquer les artefacts malveillants, même lorsque votre antivirus non microsoft ne détecte pas la menace ou lorsque l'antivirus Microsoft Defender fonctionne en mode passif.EDR en mode bloc fonctionne dans les coulisses pour corriger les artefacts malveillants détectés après la lutte. - Activer [Investigation and Remediation] (https://learn.microsoft.com/microsoft-365/security/defender-endpoint/automated-investigations?ocid=Magicti_TA_Learndoc) en mode automatisé complet pour permettre au défenseur de terminer l'action immédiatement sur l'action immédiate sur l'action immédiate sur l'action immédiate sur l'action immédiate sur l'action immédiate sur l'action immédiate sur l'action immédiate sur l'action immédiate sur l'action immédiate sur l'action immédiate sur l'action immédiate surAlertes pour résoudre les violations, réduisant considérablement le volume d'alerte. - Les clients de Microsoft Defender peuvent activer [Règles de réduction de la surface d'attaque] (https://learn.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction?ocid=Magicti_TA_LearnDoc) pour prévenir les techniques d'attaque communes utilisées utilisées utiliséDans les attaques de ransomwares.Les règles de réduction de la surface d'attaque sont des pa | Ransomware Malware Tool Threat | ★★★ | |
|
2024-06-18 16:41:56 | Le ransomware de la combinaison noire divulgue les données de la police de Kansas City dans un tracé de rançon raté BlackSuit Ransomware Leaks Kansas City Police Data in Failed Ransom Plot (lien direct) |
Le ransomware de la combinaison noire, connu sous le nom de changement de marque du gang de ransomwares continu, a divulgué une mine de données de la police de Kansas City, y compris des dossiers de preuves, des dossiers d'enquête, des téléphones de scène de crime et bien plus encore, après que le ministère a refusé de payer la rançon.
BlackSuit Ransomware, known as the rebrand of the Conti ransomware gang, has leaked a trove of Kansas City Police data, including evidence records, investigation files, crime scene phones, and much more, after the department refused to pay the ransom. |
Ransomware Legislation | ★★★ | |
|
2024-06-18 13:15:15 | Oncle Sam met fin au soutien financier aux organisations blessées par le changement d'attaque de soins de santé Uncle Sam ends financial support to orgs hurt by Change Healthcare attack (lien direct) |
milliards de dollars à la disposition, mais le pire semble être terminé Le gouvernement américain termine son soutien financier aux fournisseurs de soins de santé initialement introduits à la suite de l'attaque de ransomware chez Change Healthcare en février.…
Billions of dollars made available but worst appears to be over The US government is winding down its financial support for healthcare providers originally introduced following the ransomware attack at Change Healthcare in February.… |
Ransomware Medical | ★★★ | |
|
2024-06-18 13:00:02 | Mises à jour du NHS sur les perturbations, violation de données potentielle après l'attaque des ransomwares de laboratoire de Londres NHS updates on disruptions, potential data breach following London lab ransomware attack (lien direct) |
Le National Health Service (NHS) du Royaume-Uni a publié une mise à jour concernant la cyberattaque ransomware le 3 juin contre ...
The U.K. National Health Service (NHS) released an update regarding the ransomware cyber attack on June 3rd against... |
Ransomware Data Breach | ★★ | |
|
2024-06-17 21:08:04 | Cleveland confirme l'attaque des ransomwares alors que l'hôtel de ville reste fermé Cleveland confirms ransomware attack as City Hall remains closed (lien direct) |
Pas de details / No more details | Ransomware | ★★ | |
|
2024-06-17 20:40:46 | CVE-2024-4577: exploitation continue d'une vulnérabilité de PHP critique CVE-2024-4577: Ongoing Exploitation of a Critical PHP Vulnerability (lien direct) |
## Instantané
Cyble Global Sensor Intelligence (CGSI) a détecté plusieurs tentatives de balayage liées à [CVE-2024-4577] (https://security.microsoft.com/intel-explorer/cves/cve-2024-4577/) provenant de divers emplacements.La vulnérabilité découle des erreurs dans les conversions de codage des caractères, affectant en particulier la fonction «la meilleure ajustement» sur les systèmes d'exploitation Windows.L'exploitation de cette faille pourrait potentiellement permettre aux acteurs de menace d'exécuter à distance du code arbitraire, posant des risques de sécurité importants aux installations PHP sur toutes les versions exécutées sur les plates-formes Windows.
## Description
Le 7 juin, PHP a publié un patch officiel pour aborder la vulnérabilité.Le lendemain, Watchtowr Labs a publié un code d'exploitation de preuve de concept (POC) pour le CVE-2024-4577 et les acteurs de la menace ont ensuite utilisé la vulnérabilité au déploiement du ransomware sur les systèmes vulnérables.CGSI rapporte plusieurs campagnes de logiciels malveillants associées à cette nouvelle vulnérabilité, inculant la campagne Ransomware de TellyouthPass et Muhstik malware.
Le CVE-2024-4577 a un impact explicitement sur le mode CGI de PHP \\, où le serveur Web interprète HTTP demande et les transmet à un script PHP pour le traitement.Si un personnage comme un trait d'union doux (0xad) est utilisé dans un paramètre URL, le gestionnaire CGI sur Windows, après sa cartographie de la meilleure ajustement, peut interpréter ce caractère différemment que prévu.Cette mauvaise interprétation permet à un attaquant d'exécuter du code arbitraire sur le serveur PHP vulnérable.
CGSI rapporte que l'exposition des instances de PHP potentiellement vulnérables est alarmante.Les organisations devraient donner la priorité aux mises à niveau vers les dernières versions PHP: 8.3.8, 8.2.20 et 8.1.29.
## Les références
[CVE-2024-4577: Exploitation continue d'une vulnérabilité de PHP critique] (https://cyble.com/blog/cve-2024-4577-ongoing-exploitation-of-a-critical-php-vulnerabilité/).Cyble Global Sensor Intelligence (consulté en 2024-06-17)
## Snapshot Cyble Global Sensor Intelligence (CGSI) has detected multiple scanning attempts related to [CVE-2024-4577](https://security.microsoft.com/intel-explorer/cves/CVE-2024-4577/) originating from various locations. The vulnerability stems from errors in character encoding conversions, particularly affecting the “Best Fit” feature on Windows operating systems. Exploiting this flaw could potentially enable threat actors to remotely execute arbitrary code, posing significant security risks to PHP installations across all versions running on Windows platforms. ## Description On June 7th, PHP released an official patch to address the vulnerability. The following day, WatchTowr Labs published a proof-of-concept (PoC) exploit code for CVE-2024-4577 and threat actors subsequently utilized the vulnerability to deploy ransomware on vulnerable systems. CGSI reports several malware campaigns associated with this new vulnerability, inculding the TellYouThePass ransomware campaign and Muhstik malware. CVE-2024-4577 explicitly impacts PHP\'s CGI mode, where the web server interprets HTTP requests and forwards them to a PHP script for processing. If a character like a soft hyphen (0xAD) is used in a URL parameter, the CGI handler on Windows, following its Best Fit mapping, may interpret this character differently than intended. This misinterpretation allows an attacker to execute arbitrary code on the vulnerable PHP server. CGSI reports that the exposure of potentially vulnerable PHP instances is alarmingly high. Organizations should prioritze upgrades to the latest PHP versions: 8.3.8, 8.2.20, and 8.1.29. ## References [CVE-2024-4577: Ongoing Exploitation of a Critical PHP Vulnerability](https://cyble.com/blog/cve-2024-4577-ongoing-exploitation-of-a-critical-php-vulnerability/). Cyble Glob |
Ransomware Malware Vulnerability Threat | ★★★ | |
|
2024-06-17 17:45:10 | Blackbaud doit cracher quelques millions de dollars de plus à 2020 Ransomware Attack Blackbaud has to cough up a few million dollars more over 2020 ransomware attack (lien direct) |
Quatre ans plus tard et il paie toujours ce que le procureur général de Californie appelle \\ 'inacceptable \' pratique mois après s'être échappé sans une amende de la Federal Trade Commission américaine (FTC), la chance du logiciel Cloud Biz Blackbaud s'est épuisée quand il s'agissait d'atteindre un règlement avec le procureur général de Californie.…
Four years on and it\'s still paying for what California attorney general calls \'unacceptable\' practice Months after escaping without a fine from the US Federal Trade Commission (FTC), the luck of cloud software biz Blackbaud ran out when it came to reaching a settlement with California\'s attorney general.… |
Ransomware Cloud | ★★★ | |
|
2024-06-17 15:55:40 | Panera Bread a probablement payé une rançon lors de l'attaque de ransomware de mars Panera Bread likely paid a ransom in March ransomware attack (lien direct) |
Panera Bread, une chaîne américaine de restaurants de restauration rapide, a probablement payé une rançon après avoir été frappé par une attaque de ransomware, suggère que le langage a utilisé un e-mail interne envoyé aux employés.[...]
Panera Bread, an American chain of fast food restaurants, most likely paid a ransom after being hit by a ransomware attack, suggests language used an internal email sent to employees. [...] |
Ransomware | ★★★ | |
|
2024-06-17 14:10:41 | Smalltiger Maleware utilisés dans les attaques contre les entreprises sud-coréennes (Kimsuky et Andariel) SmallTiger Malware Used in Attacks Against South Korean Businesses (Kimsuky and Andariel) (lien direct) |
#### Targeted Geolocations - Korea ## Snapshot The AhnLab Security Intelligence Center (ASEC) has reported on a series of cyberattacks targeting South Korean businesses utilizing the SmallTiger malware. ## Description While the initial access method remains unidentified, SmallTiger is introduced during the lateral movement phase within the affected companies\' systems. Notably, the targets include South Korean defense contractors, automobile part manufacturers, and semiconductor manufacturers. Initially discovered in November 2023, the attacks showed characteristics of the "Kimsuky" group\'s tactics, but deviated by leveraging software updater programs for internal propagation. Moreover, the presence of DurianBeacon, previously associated with Andariel group attacks, was detected in the compromised systems. Subsequent attacks in February 2024 continued to employ SmallTiger, with variations observed in the malware\'s distribution methods and payloads. ASEC mentions additonal cases which include DurianBeacon attack utalizing MultiRDP Malware and Meterpreter in Novemner 2023, and another SmallTiger attack where the threat actor installed Mimikatz and ProcDump to hijack system credentials. ## Detections/Hunting Queries Microsoft Defender for Endpoint Alerts with the following titles in the security center can indicate threat activity on your network: - Mimikatz credential theft tool The following alerts might also indicate threat activity associated with this threat. These alerts, however, can be triggered by unrelated threat activity and are not monitored in the status cards provided with this report. - Malicious credential theft tool execution detected - Suspicious access to LSASS service ## Recommendations Microsoft recommends the following mitigations to reduce the impact of Information Stealer threats. - Check your Office 365 email filtering settings to ensure you block spoofed emails, spam, and emails with malware. Use [Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/defender-for-office-365?ocid=magicti_ta_learndoc) for enhanced phishing protection and coverage against new threats and polymorphic variants. Configure Microsoft Defender for Office 365 to [recheck links on click](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about?ocid=magicti_ta_learndoc) and [delete sent mail](https://learn.microsoft.com/microsoft-365/security/office-365-security/zero-hour-auto-purge?ocid=magicti_ta_learndoc) in response to newly acquired threat intelligence. Turn on [safe attachments policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-attachments-policies-configure?ocid=magicti_ta_learndoc) to check attachments to inbound email. - Encourage users to use Microsoft Edge and other web browsers that support [SmartScreen](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/web-protection-overview?ocid=magicti_ta_learndoc), which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that host malware. - Turn on [cloud-delivered protection](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus?ocid=magicti_ta_learndoc) in Microsoft Defender Antivirus, or the equivalent for your antivirus product, to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown variants. - Enforce MFA on all accounts, remove users excluded from MFA, and strictly [require MFA](https://learn.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy?ocid=magicti_ta_learndoc) from all devices, in all locations, at all times. - Enable passwordless authentication methods (for example, Windows Hello, FIDO keys, or Microsoft Authenticator) for accounts that support passwordle | Ransomware Spam Malware Tool Threat | ★★★ | |
|
2024-06-17 12:36:31 | KeyTronic dit des informations personnelles volées dans une attaque de ransomware Keytronic Says Personal Information Stolen in Ransomware Attack (lien direct) |
> KeyTronic confirme que les informations personnelles ont été compromises après qu'un groupe de ransomwares a divulgué des données prétendument volées.
>Keytronic confirms that personal information was compromised after a ransomware group leaked allegedly stolen data. |
Ransomware | ★★ | |
|
2024-06-17 11:42:19 | Faits saillants hebdomadaires, 17 juin 2024 Weekly OSINT Highlights, 17 June 2024 (lien direct) |
## Snapshot Last week\'s OSINT reporting reveals a landscape of cyber threats involving diverse and sophisticated attack strategies by state-sponsored actors and cybercrime organizations. The reports showcase various attack vectors, including phishing campaigns, exploitation of cloud services, and use of malware such as RATs, ransomware, and infostealers. Key threat actors like UNC5537, Kimsuky, and Cosmic Leopard are targeting sectors ranging from cloud computing and aviation to military and government entities, often leveraging stolen credentials and exploiting software vulnerabilities. These incidents underscore the critical need for robust security practices, such as multi-factor authentication and regular credential updates, to defend against increasingly complex and targeted cyber threats. ## Description 1. **[Warmcookie Malware Campaign](https://sip.security.microsoft.com/intel-explorer/articles/d5d815ce)**: Elastic Security Labs identified Warmcookie, a Windows malware distributed via fake job offer phishing campaigns. The malware establishes C2 communication to gather victim information, execute commands, and drop files, with the campaign ongoing and targeting users globally. 2. **[Snowflake Data Theft](https://sip.security.microsoft.com/intel-explorer/articles/3cb4b4ee)**: Mandiant uncovered UNC5537 targeting Snowflake customers to steal data and extort victims using stolen credentials from infostealer malware. The campaign highlights poor credential management and the absence of MFA, prompting Snowflake to issue security guidance. 3. **[IcedID, Cobalt Strike, and ALPHV Ransomware](https://sip.security.microsoft.com/intel-explorer/articles/b74a41ff)**: DFIR Report analyzed a cyber intrusion deploying IcedID via malicious emails, followed by Cobalt Strike for remote control and ALPHV ransomware for encryption. Attackers used various tools for persistence, reconnaissance, and data exfiltration, showcasing a complex multi-stage attack. 4. **[ValleyRAT Multi-Stage Campaign](https://sip.security.microsoft.com/intel-explorer/articles/c599ee92)**: Zscaler ThreatLabz identified a campaign deploying an updated ValleyRAT by China-based threat actors, using phishing emails and HTTP File Server for malware delivery. The RAT includes advanced evasion techniques and enhanced data collection capabilities. 5. **[APT Attacks Using Cloud Services](https://sip.security.microsoft.com/intel-explorer/articles/bebf8696)**: AhnLab Security Intelligence Center reported APT attacks leveraging Google Drive, OneDrive, and Dropbox to distribute malware. Attackers use malicious scripts and RAT strains to collect user information and perform various malicious activities. 6. **[CoinMiner vs. Ransomware Conflict](https://sip.security.microsoft.com/intel-explorer/articles/58dd52ff)**: ASEC described an incident where a CoinMiner attacker\'s proxy server was compromised by a ransomware actor\'s RDP scan attack. The CoinMiner botnet infection through MS-SQL server vulnerabilities was disrupted by the ransomware attack, illustrating inter-threat actor conflicts. 7. **[Sticky Werewolf Campaign](https://sip.security.microsoft.com/intel-explorer/articles/e3b51ad8)**: Morphisec Labs discovered Sticky Werewolf targeting the aviation industry with phishing campaigns using LNK files. The group, with suspected geopolitical ties, employs CypherIT Loader/Crypter for payload delivery and anti-analysis measures. 8. **[Kimsuky\'s Espionage Campaign](https://sip.security.microsoft.com/intel-explorer/articles/ab73cf6f)**: BlackBerry identified North Korea\'s Kimsuky group targeting a Western European weapons manufacturer with spear-phishing emails containing malicious JavaScript. The campaign underscores the growing threat of cyber espionage in the military sector. 9. **[Operation Celestial Force](https://sip.security.microsoft.com/intel-explorer/articles/0dccc722)**: Cisco Talos reported Cosmic Leopard\'s espionage campaign using GravityRAT and HeavyLift, targeting Indian defense and government sectors. The campaign em | Ransomware Malware Tool Vulnerability Threat Mobile Cloud | ★★ | |
|
2024-06-17 08:45:00 | L'attaque des ransomwares de Londres a conduit à 1500 rendez-vous et opérations annulées London Ransomware Attack Led to 1500 Cancelled Appointments and Operations (lien direct) |
L'attaque de ransomware contre un fournisseur du NHS a forcé le service de santé à réorganiser plus de 1000 opérations et rendez-vous
Ransomware attack on an NHS supplier forced the health service to rearrange 1000+ operations and appointments |
Ransomware | ★★ |
To see everything:
Our RSS (filtrered)
