How Memory Forensics Revealed Exploitation of Ivanti Connect Secure VPN Zero-Day Vulnerabilities

In a recent series of blog posts related to two zero-day vulnerabilities in Ivanti Connect Secure VPN, Volexity shared details of active in-the-wild exploitation; provided an update on how exploitatio...

https://www.volexity.com/blog/2024/02/01/how-memory-forensics-revealed-exploitation-of-ivanti-connect-secure-vpn-zero-day-vulnerabilities/


🎖@malwr

VajraSpy: A Patchwork of espionage apps

ESET researchers discovered several Android apps carrying VajraSpy, a RAT used by the Patchwork APT group

https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/


🎖@malwr

What is the Cyber Kill Chain? And How to Use It with Threat Intelligence?

A common misconception with cyber threat intelligence is that it's just about catching attacks before they happen. Learn why this assumption is wrong.

https://www.recordedfuture.com/blog/cyber-kill-chain


🎖@malwr

Applying Threat Intelligence to the Diamond Model of Intrusion Analysis

As an analyst, you may have come across various threat models in your career. In the cybersecurity and threat intelligence industries, there are several approaches used to analyze and track the characteristics of cyber intrusions by advanced threat actors. One popular approach is the Diamond Model of Intrusion Analysis.

https://www.recordedfuture.com/blog/diamond-model-intrusion-analysis


🎖@malwr

North Korea-Aligned TAG-71 Spoofs Financial Institutions in Asia and US

TAG-71, linked to North Korea's APT38, targets global finance & venture firms, risking sensitive info exposure and business disruption.

https://www.recordedfuture.com/north-korea-aligned-tag-71-spoofs-financial-institutions


🎖@malwr

Private Eyes: China’s Embrace of Open-Source Military Intelligence

Using advanced technology, the People's Liberation Army (PLA) leverages open-source intelligence (OSINT) for military advantage.

https://www.recordedfuture.com/private-eyes-chinas-embrace-open-source-military-intelligence


🎖@malwr

Unveiling Atlassian Confluence Vulnerability CVE-2023-22527: Understanding and Mitigating Remote Code Execution Risks

In this blog entry, we discuss CVE-2023-22527, a vulnerability in Atlassian Confluence that has a CVSS score of 10 and could allow threat actors to perform remote code execution.

https://www.trendmicro.com/en_us/research/24/b/unveiling-atlassian-confluence-vulnerability-cve-2023-22527--und.html


🎖@malwr

Scarabs colon-izing vulnerable servers

Analysis of Spacecolon, a toolset used to deploy Scarab ransomware on vulnerable servers, and its operators, CosmicBeetle

https://www.welivesecurity.com/en/eset-research/scarabs-colon-izing-vulnerable-servers/


🎖@malwr

PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content

A network of at least 123 websites operated from within the People’s Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beijing disinformation and ad hominem attacks within much larger volumes of commercial press releases. We name this campaign PAPERWALL. We attribute the PAPERWALL campaign to Shenzhen Haimaiyunxiang Media Co., Ltd., aka Haimai, a PR firm in China based on digital infrastructure linkages between the firm’s official website and the network. These findings confirm the increasingly important role private firms play in the realm of digital influence operations and the propensity of the Chinese government to make use of them.

https://citizenlab.ca/2024/02/paperwall-chinese-websites-posing-as-local-news-outlets-with-pro-beijing-content/


🎖@malwr

📍📍📍Forward posts to the other groups you are in📍📍📍

New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization

Talos discovered a new, stealthy espionage campaign that has likely persisted since at least March 2021. The observed activity affects an Islamic non-profit organization using backdoors for a previously unreported malware family we have named “Zardoor.”

https://blog.talosintelligence.com/new-zardoor-backdoor/


🎖@malwr