GitHub - reemertastic/infosec-spam-list: List of unwarranted sales email domains you can add to your junk mail filter
🗣Reemertastic
I somehow got signed up for a conference and had my email get put on a list a few years back, so I've been adding domains to my Outlook junk mail list for a while. I figured others probably have the same issue, so I might as well share it. I could unsubscribe from the emails, but I don't want to fall victim to any phishing campaigns (especially when I've used that tactic for some of our phishing campaigns).
👤Reemertastic
🎖@malwr
🗣Reemertastic
I somehow got signed up for a conference and had my email get put on a list a few years back, so I've been adding domains to my Outlook junk mail list for a while. I figured others probably have the same issue, so I might as well share it. I could unsubscribe from the emails, but I don't want to fall victim to any phishing campaigns (especially when I've used that tactic for some of our phishing campaigns).
👤Reemertastic
🎖@malwr
GitHub
reemertastic/infosec-spam-list
Contribute to reemertastic/infosec-spam-list development by creating an account on GitHub.
Malicious redirects hit over 2000 WordPress websites; Routed via Simple Fields, CP Contact Form with PayPal
🗣BhaswatiGuha19
🎖@malwr
🗣BhaswatiGuha19
🎖@malwr
International Business Times
Malicious redirects hit over 2000 WordPress websites; Routed via Simple Fields, CP Contact Form with PayPal
Experts at Sucuri have seen over 2000 new infected sites since they started tracking the WordPress infection
The U.S. Cybersecurity and Infrastructure Security Agency on Wednesday warned that it's seen a surge in targeted attacks using a sophisticated strain of malware called Emotet.
🗣Spectrumsploit
Emotet is a well know plague
👤3mt3toss
Timely, emotet has been around for many years now.
👤easy-to-type
🎖@malwr
🗣Spectrumsploit
Emotet is a well know plague
👤3mt3toss
Timely, emotet has been around for many years now.
👤easy-to-type
🎖@malwr
Bankinfosecurity
Emotet Malware Alert Sounded by US Cybersecurity Agency
Emotet malware alert: The U.S. Cybersecurity and Infrastructure Security Agency says it's been "tracking a spike" in targeted Emotet malware attacks. It
Ticket resellers infected with a credit card skimmer
🗣ThisIsLibra
Great write up! Really informative
👤naraaz
🎖@malwr
🗣ThisIsLibra
Great write up! Really informative
👤naraaz
🎖@malwr
Microsoft has released an open source tool to analyze source code for vulnerabilities in almost any modern language:
https://github.com/Microsoft/ApplicationInspector/wiki
🎖@malwr
https://github.com/Microsoft/ApplicationInspector/wiki
🎖@malwr
GitHub
Home
A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a j...
Analyzing Modern Malware
Techniques
Part1: https://0x00sec.org/t/analyzing-modern-malware-techniques-part-1/18663
Part2: https://0x00sec.org/t/analyzing-modern-malware-techniques-part-2/18765
🎖@malwr
Techniques
Part1: https://0x00sec.org/t/analyzing-modern-malware-techniques-part-1/18663
Part2: https://0x00sec.org/t/analyzing-modern-malware-techniques-part-2/18765
🎖@malwr
0x00sec - The Home of the Hacker
Analyzing Modern Malware Techniques - Part 1
Analyzing Modern Malware Techniques Fileless malware - Self Loading Technique Fileless malware is nothing new, but is very much used today. The idea is to load a payload into memory and to leave as much as little evidence as possible on the hard drive of…
Another WordPress site management plugin (wpCentral) is vulnerable to authentication issues.
🗣ded1cated
🎖@malwr
🗣ded1cated
🎖@malwr
WebARX
Multiple Vulnerabilities in WordPress Plugin wpCentral - WebARX
The wpCentral plugin allows you to manage your sites on a single panel to login to any website, install/delete/activate plugins, upload files and more.
Unconfirmed Solarwinds Zero Day
Taken from another group - Thanks to Thomas F.
A security researcher has found a 0-day in N-central. Solarwinds has not replied in the 90 day window and it was released last night on PacketStorm (since removed until a patch is released).
According to the post, this was after the 90 day disclosure window lapsed. Huntressabs has confirmed the vulnerability, which passes default site credentials (domain administrator in most cases) in clear text: https://www.youtube.com/watch?v=YAEqkZSv6XI
There were ready-made tools already posted to Github that allowed anyone to take advantage of the exploit.
Solarwinds says they are working on a fix to be released today.
Immediate mitigation can be achieved by removing the default appliance credentials from each location in N-Central.
🗣RobMSP
It's confirmed - even SW posted on it
https://success.solarwindsmsp.com/forum-post/X0D51T00007EEKLMSA5/
👤madra05
The irony that SW had 90 days to address but didn't. We departed ncentral this summer because they promised improvements to report manager for over two years that never came. Just shows that lack of action in one area is a pretty good sign of a rotted culture.
👤iloveurarse
Ouch
👤SAL10000
🎖@malwr
Taken from another group - Thanks to Thomas F.
A security researcher has found a 0-day in N-central. Solarwinds has not replied in the 90 day window and it was released last night on PacketStorm (since removed until a patch is released).
According to the post, this was after the 90 day disclosure window lapsed. Huntressabs has confirmed the vulnerability, which passes default site credentials (domain administrator in most cases) in clear text: https://www.youtube.com/watch?v=YAEqkZSv6XI
There were ready-made tools already posted to Github that allowed anyone to take advantage of the exploit.
Solarwinds says they are working on a fix to be released today.
Immediate mitigation can be achieved by removing the default appliance credentials from each location in N-Central.
🗣RobMSP
It's confirmed - even SW posted on it
https://success.solarwindsmsp.com/forum-post/X0D51T00007EEKLMSA5/
👤madra05
The irony that SW had 90 days to address but didn't. We departed ncentral this summer because they promised improvements to report manager for over two years that never came. Just shows that lack of action in one area is a pretty good sign of a rotted culture.
👤iloveurarse
Ouch
👤SAL10000
🎖@malwr
The DGA of a Monero Miner Downloader
https://johannesbader.ch/blog/the-dga-of-a-monero-miner-downloader/
🎖@malwr
https://johannesbader.ch/blog/the-dga-of-a-monero-miner-downloader/
🎖@malwr
Johannes Bader's Blog
The DGA of a Monero Miner Downloader
This blog posts deals with a domain generation algorithm (DGA) with exotic top levels like .tickets, .blackfriday or .feedback. Among others, Bert Hubert noticed the DGA domains and posted them on Twitter:
VB2019 paper: Spoofing in the reeds with Rietspoof
https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-spoofing-reeds-rietspoof/
🎖@malwr
https://www.virusbulletin.com/virusbulletin/2020/01/vb2019-paper-spoofing-reeds-rietspoof/
🎖@malwr
Virusbulletin
Virus Bulletin :: VB2019 paper: Spoofing in the reeds with Rietspoof
Rietspoof is a piece of malware that is multi-staged, using different file types throughout its infection chain. It contains several types of stages – both extractors and downloaders; the fourth stage also contains support for remote-control commands. Initially…
Nice Try: 501 (Ransomware) Not Implemented
https://www.fireeye.com/blog/threat-research/2020/01/nice-try-501-ransomware-not-implemented.html
🎖@malwr
https://www.fireeye.com/blog/threat-research/2020/01/nice-try-501-ransomware-not-implemented.html
🎖@malwr
Trellix
Research | Trellix Stories
Trellix Research, get the latest cybersecurity trends, best practices, security vulnerabilities, and more from industry leaders.
Suspected Iranian hacking campaign targets European energy companies.
FULL LINK: https://www.zdnet.com/article/suspected-iranian-hacking-campaign-targets-european-energy-sector/
🗣Spectrumsploit
🎖@malwr
FULL LINK: https://www.zdnet.com/article/suspected-iranian-hacking-campaign-targets-european-energy-sector/
🗣Spectrumsploit
🎖@malwr
