What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-08-05 10:51:17 | Faits saillants hebdomadaires, 5 août 2024 Weekly OSINT Highlights, 5 August 2024 (lien direct) |
## Instantané La semaine dernière, les rapports de \\ de Osint mettent en évidence plusieurs tendances clés du paysage cyber-menace, caractérisées par des tactiques d'attaque sophistiquées et des acteurs de menace adaptables.Les types d'attaques prédominants impliquent le phishing, l'ingénierie sociale et l'exploitation des vulnérabilités des logiciels, avec des vecteurs courants, y compris des pièces jointes malveillantes, des sites Web compromis, l'empoisonnement du DNS et la malvertisation.Les campagnes notables ont ciblé les utilisateurs de l'UKR.NET, les clients de la BBVA Bank et les pages de médias sociaux détournées pour imiter les éditeurs de photos populaires de l'IA.De plus, l'exploitation des erreurs de configuration dans des plates-formes largement utilisées telles que Selenium Grid et TryCloudflare Tunnel indique une focalisation stratégique sur la mise en œuvre d'outils légitimes à des fins malveillantes. Les acteurs de la menace vont de groupes d'État-nation comme les acteurs nord-coréens, l'APT41 et le Sidewinder, aux cybercriminels et à des groupes hacktiviste motivés financièrement tels que Azzasec.Les techniques d'évasion avancées et les stratégies d'ingénierie sociale sont utilisées par des acteurs comme l'UAC-0102, Black Basta et ceux qui exploitent les problèmes de mise à jour de la crowdsstrike.Les objectifs sont diversifiés, couvrant des organisations gouvernementales et militaires, des institutions financières, des réseaux d'entreprise, des petites et moyennes entreprises et des utilisateurs individuels dans diverses régions. ## Description 1. [Campagne révisée de dev # popper] (https://sip.security.microsoft.com/intel-explorer/articles/9f6ee01b): les acteurs de la menace nord-coréenne ciblent les développeurs de logiciels à l'aide de fausses entretiens d'emploi pour distribuer des logiciels malveillants via des packages de fichiers zip.La campagne, affectant plusieurs systèmes d'exploitation et régions, utilise des tactiques avancées d'obscurcissement et d'ingénierie sociale pour le vol de données et la persistance. 2. [Specula Framework exploite Outlook] (https://sip.security.microsoft.com/intel-explorer/articles/4b71ce29): un nouveau cadre post-exploitation appelé "Specula" lever.En dépit d'être corrigé, cette méthode est utilisée par l'APT33 parrainé par l'iranien pour atteindre la persistance et le mouvement latéral dans les systèmes Windows compromis. 3. [Phishing with Sora AI Branding] (https://sip.security.microsoft.com/intel-explorer/articles/b90cc847): les acteurs de menace exploitent l'excitation autour de Sora AI inédite en créant des sites de phishing pour se propager des logiciels malveillants.Ces sites, promus via des comptes de médias sociaux compromis, déploient des voleurs d'informations et des logiciels d'extraction de crypto-monnaie. 4. [vulnérabilité VMware ESXi exploitée] (https: //sip.security.microsoft.com/intel-explorer/articles/63b1cec8): des gangs de ransomware comme Storm-0506 et Octo Tempest Exploiter un VMware ESXi Authentification Typass VULnerabilité pour l'accès administratif.Cette vulnérabilité, ajoutée au catalogue exploité des vulnérabilités exploitées \\ 'connues, est utilisée pour voler des données, se déplacer latéralement et perturber les opérations. 5. [APT41 cible la recherche taïwanaise] (https://sip.security.microsoft.com/intel-explorer/articles/d791dc39): le groupe APT41, suivi comme Typhoon de brass.La campagne consiste à exploiter une vulnérabilité de Microsoft Office et à utiliser la stéganographie pour échapper à la détection. 6. [Trojans bancaire en Amérique latine] (https://sip.security.microsoft.com/intel-explorer/articles/767518e9): Une campagne ciblant les organisations financières utilise des troyens bancaires distribués via des URL géo-frisées.Le malware utilise l'injection de processus et se connecte aux serveurs de commandement et de contrôle pour voler des informations sensibles. 7. [MINT STACER MALWARED] ( | Threat Ransomware Spam Malware Tool Mobile Vulnerability | APT33 APT 41 APT 33 APT-C-17 | |
|
2024-04-08 15:09:15 | Faits saillants hebdomadaires, 8 avril 2024 Weekly OSINT Highlights, 8 April 2024 (lien direct) |
Last week\'s OSINT reporting reveals several key trends emerge in the realm of cybersecurity threats. Firstly, there is a notable diversification and sophistication in attack techniques employed by threat actors, ranging from traditional malware distribution through phishing emails to advanced methods like DLL hijacking and API unhooking for evading detection. Secondly, the threat landscape is characterized by the presence of various actors, including state-sponsored groups like Earth Freybug (a subset of APT41) engaging in cyberespionage and financially motivated attacks, as well as cybercrime actors orchestrating malware campaigns such as Agent Tesla and Rhadamanthys. Thirdly, the targets of these attacks span across different sectors and regions, with organizations in America, Australia, and European countries facing significant threats. Additionally, the emergence of cross-platform malware like DinodasRAT highlights the adaptability of threat actors to target diverse systems, emphasizing the need for robust cybersecurity measures across all platforms. Overall, these trends underscore the dynamic and evolving nature of cyber threats, necessitating continuous vigilance and proactive defense strategies from organizations and cybersecurity professionals. **1. [Latrodectus Loader Malware Overview](https://sip.security.microsoft.com/intel-explorer/articles/b4fe59bf)** Latrodectus is a new downloader malware, distinct from IcedID, designed to download payloads and execute arbitrary commands. It shares characteristics with IcedID, indicating possible common developers. **2. [Earth Freybug Cyberespionage Campaign](https://sip.security.microsoft.com/intel-explorer/articles/327771c8)** Earth Freybug, a subset of APT41, engages in cyberespionage and financially motivated attacks since at least 2012. The attack involved sophisticated techniques like DLL hijacking and API unhooking to deploy UNAPIMON, evading detection and enabling malicious commands execution. **3. [Agent Tesla Malware Campaign](https://sip.security.microsoft.com/intel-explorer/articles/cbdfe243)** Agent Tesla malware targets American and Australian organizations through phishing campaigns aimed at stealing email credentials. Check Point Research identified two connected cybercrime actors behind the operation. **4. [DinodasRAT Linux Version Analysis](https://sip.security.microsoft.com/intel-explorer/articles/57ab8662)** DinodasRAT, associated with the Chinese threat actor LuoYu, is a cross-platform backdoor primarily targeting Linux servers. The latest version introduces advanced evasion capabilities and is installed to gain additional footholds in networks. **5. [Rhadamanthys Information Stealer Malware](https://sip.security.microsoft.com/intel-explorer/articles/bf8b5bc1)** Rhadamanthys utilizes Google Ads tracking to distribute itself, disguising as popular software installers. After installation, it injects into legitimate Windows files for data theft, exploiting users through deceptive ad redirects. **6. [Sophisticated Phishing Email Malware](https://sip.security.microsoft.com/intel-explorer/articles/abfabfa1)** A phishing email campaign employs ZIP file attachments leading to a series of malicious file downloads, culminating in the deployment of PowerShell scripts to gather system information and download further malware. **7. [AceCryptor Cryptors-as-a-Service (CaaS)](https://sip.security.microsoft.com/intel-explorer/articles/e3595388)** AceCryptor is a prevalent cryptor-as-a-service utilized in Rescoms campaigns, particularly in European countries. Threat actors behind these campaigns abuse compromised accounts to send spam emails, aiming to obtain credentials for further attacks. ## Learn More For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: [https://aka.ms/threatintelblog](https://aka.ms/threatintelblog). Microsoft customers can use the following reports in Microsoft Defender Threat Intelligence to ge | Threat Ransomware Spam Malware Cloud Tool | APT 41 | ★★★ |
 |
2021-09-14 15:00:00 | Anomali Cyber Watch: Azurescape Cloud Threat, MSHTML 0-Day in The Wild, Confluence Cloud Hacked to Mine Monero, and More (lien direct) | The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: Android, APT, Confluence, Cloud, MSHTML, Phishing, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Current Anomali ThreatStream users can query these indicators under the “anomali cyber watch” tag.
Trending Cyber News and Threat Intelligence
S.O.V.A. – A New Android Banking Trojan with Fowl Intentions
(published: September 10, 2021)
ThreatFabric researchers have discovered a new Android banking trojan called S.O.V.A. The malware is still in the development and testing phase and the threat actor is publicly-advertising S.O.V.A. for trial runs targeting banks to improve its functionality. The trojan’s primary objective is to steal personally identifiable information (PII). This is conducted through overlay attacks, keylogging, man-in-the-middle attacks, and session cookies theft, among others. The malware author is also working on other features such as distributed denial-of-service (DDoS) and ransomware on S.O.V.A.’s project roadmap.
Analyst Comment: Always keep your mobile phone fully patched with the latest security updates. Only use official locations such as the Google Play Store / Apple App Store to obtain your software, and avoid downloading applications, even if they appear legitimate, from third-party stores. Furthermore, always review the permissions an app will request upon installation.
MITRE ATT&CK: [MITRE ATT&CK] Input Capture - T1056 | [MITRE ATT&CK] Man-in-the-Middle - T1557 | [MITRE ATT&CK] Steal Web Session Cookie - T1539 | [MITRE ATT&CK] Network Denial of Service - T1498 | [MITRE ATT&CK] Data Encrypted for Impact - T1486
Tags: Android, Banking trojan, S.O.V.A., Overlay, Keylogging, Cookies, Man-in-the-Middle
Finding Azurescape – Cross-Account Container Takeover in Azure Container Instances
(published: September 9, 2021)
Unit 42 researchers identified and disclosed critical security issues in Microsoft’s Container-as-a-Service (CaaS) offering that is called Azure Container Instances (ACI). A malicious Azure user could have compromised the multitenant Kubernetes clusters hosting ACI, establishing full control over other users' containers. Researchers gave the vulnerability a specific name, Azurescape, highlighting its significance: it the first cross-account container takeover in the public cloud.
Analyst Comment: Azurescape vulnerabilities could have allowed an attacker to execute code on other users' containers, steal customer secrets and images deployed to the platform, and abuse ACI's infrastructure processing power. Microsoft patched ACI shortly after the discl |
Threat Ransomware Spam Malware Guideline Tool Vulnerability | Uber APT 41 APT 15 |
1
We have: 3 articles.
We have: 3 articles.
To see everything:
