Top resources for Cybersecurity Awareness Month
Plus, many of the world’s largest cloud providers are warning of a vulnerability that attackers exploited in August to launch the largest distributed denial-of-service attack on record.
https://blog.talosintelligence.com/threat-source-newsletter-oct-12-2023/
🎖@malwr
Plus, many of the world’s largest cloud providers are warning of a vulnerability that attackers exploited in August to launch the largest distributed denial-of-service attack on record.
https://blog.talosintelligence.com/threat-source-newsletter-oct-12-2023/
🎖@malwr
Cisco Talos Blog
Top resources for Cybersecurity Awareness Month
Plus, many of the world’s largest cloud providers are warning of a vulnerability that attackers exploited in August to launch the largest distributed denial-of-service attack on record.
Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant
Almost a year after Void Rabisu shifted its targeting from opportunistic ransomware attacks with an emphasis on cyberespionage, the threat actor is still developing its main malware, the ROMCOM backdoor.
https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html
🎖@malwr
Almost a year after Void Rabisu shifted its targeting from opportunistic ransomware attacks with an emphasis on cyberespionage, the threat actor is still developing its main malware, the ROMCOM backdoor.
https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html
🎖@malwr
Trend Micro
Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant
Almost a year after Void Rabisu shifted its targeting from opportunistic ransomware attacks with an emphasis on cyberespionage, the threat actor is still developing its main malware, the ROMCOM backdoor.
🤷♀1
2023-10-12 - DarkGate infection from Teams Chat
https://www.malware-traffic-analysis.net/2023/10/12/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2023/10/12/index.html
🎖@malwr
2023-10-13 - TA577 DarkGate infection
https://www.malware-traffic-analysis.net/2023/10/13/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2023/10/13/index.html
🎖@malwr
2023-10-11 - Lumma Stealer infection
https://www.malware-traffic-analysis.net/2023/10/11/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2023/10/11/index.html
🎖@malwr
Microsoft Azure Sentinel 101: Log Source, DataTable & End Point Monitoring
Lots of great content and experience on how to do monitoring for log sources coming in to Sentinel.
https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-log-source-dataable-end-point-monitoring-be-alerted-when-a-1ff4fae77892
🗣thattechkitten
🎖@malwr
Lots of great content and experience on how to do monitoring for log sources coming in to Sentinel.
https://medium.com/@truvis.thornton/microsoft-azure-sentinel-101-log-source-dataable-end-point-monitoring-be-alerted-when-a-1ff4fae77892
🗣thattechkitten
🎖@malwr
Medium
Microsoft Azure Sentinel 101: Log Source, Dataable & End Point Monitoring — Be alerted when a…
One of the most important thing is monitoring log ingestion and making alerts for when sources go down.
CovenantDecryptor: designed to decrypt the communication data of Covenant traffic - Extract_privatekey script retrieves the p and q primes from a minidump file to construct an RSA private key. decrypt_covenant_traffic script decrypts..
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - naacbin/CovenantDecryptor
Contribute to naacbin/CovenantDecryptor development by creating an account on GitHub.
McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-follow-the-money/
🎖@malwr
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-follow-the-money/
🎖@malwr
McAfee Blog
McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - Follow The Money | McAfee Blog
Episode 3: Follow the Money This is the third installment of the McAfee Advanced Threat Research (ATR) analysis of Sodinokibi and its connections to
👍1
Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation.
https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html
🎖@malwr
While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior and SOCKS implementation.
https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html
🎖@malwr
Trend Micro
Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
While monitoring Earth Lusca, we discovered an intriguing, encrypted file on the threat actor's server — a Linux-based malware, which appears to originate from the open-source Windows backdoor Trochilus, which we've dubbed SprySOCKS due to its swift behavior…
Trench Tales: The College Account Takeover That Never Happened
A story of mass-discovery of LDAP Anonymous Binding leading to the account takeover of all members of a college. Explore the methodology, the challenges and the discoveries of this research project.Continue reading
https://securitycafe.ro/2023/10/16/trench-tales-the-college-account-takeover-that-never-happened/
🎖@malwr
A story of mass-discovery of LDAP Anonymous Binding leading to the account takeover of all members of a college. Explore the methodology, the challenges and the discoveries of this research project.Continue reading
https://securitycafe.ro/2023/10/16/trench-tales-the-college-account-takeover-that-never-happened/
🎖@malwr
Security Café
Trench Tales: The College Account Takeover That Never Happened
A story of mass-discovery of LDAP Anonymous Binding leading to the account takeover of all members of a college. Explore the methodology, the challenges and the discoveries of this research project…
Beware: Lumma Stealer Distributed via Discord CDN
This blog discusses how threat actors abuse Discord’s content delivery network (CDN) to host and spread Lumma Stealer, and talks about added capabilities to the information stealing malware.
https://www.trendmicro.com/en_us/research/23/j/beware-lumma-stealer-distributed-via-discord-cdn-.html
🎖@malwr
This blog discusses how threat actors abuse Discord’s content delivery network (CDN) to host and spread Lumma Stealer, and talks about added capabilities to the information stealing malware.
https://www.trendmicro.com/en_us/research/23/j/beware-lumma-stealer-distributed-via-discord-cdn-.html
🎖@malwr
Trend Micro
Beware Lumma Stealer Distributed via Discord CDN
This blog discusses how threat actors abuse Discord’s content delivery network (CDN) to host and spread Lumma Stealer, and talks about added capabilities to the information stealing malware.
Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerability
Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks.
https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
🎖@malwr
Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks.
https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
🎖@malwr
Cisco Talos
Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities
Cisco has identified active exploitation of two previously unknown vulnerabilities in the Web User Interface (Web UI) feature of Cisco IOS XE software — CVE-2023-20198 and CVE-2023-20273 — when exposed to the internet or untrusted networks.