■■□□□ CVE-2021-25160: A remote arbitrary file modification vulnerability exists in some Aruba Instant Access Point (IAP) products.

https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-25160

■■■■■ 8.2 TB #DataLeak from India 🇮🇳.

Popular Mobile payments service MobiKwik on Monday came under fire after 8.2 terabytes (TB) of data belonging to millions of its users began circulating on the dark web in the aftermath of a major data breach that came to light earlier this month.

https://thehackernews.com/2021/03/mobikwik-suffers-major-breach-kyc-data.html

Statement by Mobikwik:
https://mobile.twitter.com/MobiKwik/status/1367489330902675463

Comment by Troy Hunt:
https://mobile.twitter.com/troyhunt/status/1376656147218800641

● cKure has acquired the alleged data of MobiKwik leak. However, verification has not been made.

■■■■■ ⚠️ Following is the list of C2 servers of MetaSploit or CobaltStrike likely used by hackers to attack.

The list was provided via security researcher Michael.

https://gist.github.com/MichaelKoczwara/3a0037ad46c373bc71a6e22daf69d70e

■■■□□ CobaltStrike hunting list.

https://docs.google.com/spreadsheets/d/1bYvBh6NkNYGstfQWnT5n7cSxdhjSn1mduX8cziWSGrw/edit#gid=766378683

■■□□□ Proper compilation of defences against Cobalt Strike.

》Hunting & detection tools
》Yara & Sigma rules
》Indicators
》Research articles
https://mobile.twitter.com/certbund/status/1376556022131658767

https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence

■■■■■ Spectre bypass in Linux.

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/spectre-bypass-linux-vulnerabilities

■■■■□ 📢 Ubiquiti had disclosed earlier this year that a breach involving a third-party cloud provider had exposed customer account credentials. Now a source who participated in the response to that breach alleges Ubiquiti massively downplayed a “catastrophic” incident to minimize the hit to its stock price, and that the third-party cloud provider claim was a fabrication.

https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/

■□□□□ IoT security. https://youtu.be/JbHJ4JHlVyA

■■■■□ Vulnx 🕷️ is An Intelligent Bot Auto Shell Injector that detects vulnerabilities in multiple types of CMS'.

https://github.com/anouarbensaad/vulnx

■■■■□ #DataLeak | India 🇮🇳: Payment app MobiKwik has denied its security has been breached, and said it it's true, as has been claimed, that its customers' information has appeared on the dark web, then some other platform was totally responsible for that.

"Some users have reported that their data is visible on the dark web," reads a message from the company, dated March 30.

https://blog.mobikwik.com/message-from-the-company/

■■□□□ #DataLeak / United States: Clop ransomware group leaks data from 6 US 🇺🇸 universites.

■■■■■ Tax scammers in China 🇨🇳 turn photos into vids to crack tax dept facial recognition system.

https://go.theregister.com/feed/www.theregister.com/2021/03/31/tax_scammers_fool_ai_facial_recognition/

■■■■□ A vulnerability in Kaspersky / KAVKIS 2020 products family allows full disabling of protection.

Scope: Application
Product name: Kaspersky Internet Security
Product version:20.0.14.1085
OS name and version (incl SP): Windows 10 RS5
Attack type: Bypass
Maximum user privileges needed to reproduce your issue: no privileges

https://hackerone.com/reports/870615

■■□□□ #DataLeak / India 🇮🇳

The server of Maharashtra Industrial Development Corporation was hacked as of late. The ransomware 'SYNack' affected the applications and database servers facilitated at the MIDC headquarters in Mumbai by encrypting the information put away in these servers. Hackers have demanded Rs 500 crore, they have mailed a demand of Rs 500 crore on MIDC's official mail ID, sources said. 

https://www.ehackingnews.com/2021/03/midcs-server-hacked-threat-to-destroy.html

■■□□□ Japan 🇯🇵: Dubbed "A41APT" by Kaspersky researchers, the findings delve into a new slew of attacks undertaken by APT10 (aka Stone Panda or Cicada) using previously undocumented malware to deliver as many as three payloads such as SodaMaster, P8RAT, and FYAnti.

https://www.ehackingnews.com/2021/03/midcs-server-hacked-threat-to-destroy.html

■□□□□ Using containers to have multiple sessions for single site per browser in Firefox.

https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/