Found 12 bookmarks
Custom sorting
Star Blizzard increases sophistication and evasion in ongoing attacks
Star Blizzard increases sophistication and evasion in ongoing attacks
Microsoft Threat Intelligence continues to track and disrupt malicious activity attributed to a Russian state-sponsored actor we track as Star Blizzard, who has improved their detection evasion capabilities since 2022 while remaining focused on email credential theft against targets.
#microsoft#EN#2023#Threat#Intelligence#Star-Blizzard#attacks#analysis
·microsoft.com·
Star Blizzard increases sophistication and evasion in ongoing attacks
MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
CISA received 4 files for analysis from an incident response engagement conducted at an Aeronautical Sector organization. 2 files (bitmap.exe, wkHPd.exe) are identified as variants of Metasploit (Meterpreter) and designed to connect and receive unencrypted payloads from their respective command and control (C2) servers. Note: Metasploit is an open source penetration testing software; Meterpreter is a Metasploit attack payload that runs an interactive shell. These executables are used as attack payloads to run interactive shells, allowing a malicious actor the ability to control and execute code on a system. 2 files (resource.aspx, ConfigLogin.aspx) are Active Server Pages (ASPX) web shells designed to execute remote JavaScript code on the victim server.
#cisa#EN#2023#Multiple#Nation-State#Threat#Actors#Exploit#CVE-2022-47966#CVE-2022-42475
·cisa.gov·
MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
Raising Online Defenses Through Transparency and Collaboration | Meta
Raising Online Defenses Through Transparency and Collaboration | Meta
We're sharing a look into our defense strategy and the latest news on how we build it into our products. A recent study shows that de-platforming hate networks reduces consumption and production of hateful content on Facebook and diminishes the ability of these hate networks to operate online. We’re sharing new threat research on two of the largest known covert influence operations in the world from China and Russia, targeting 50+ apps and countries, including the US. * We added new transparency features to Threads, including state-controlled media labels to help people know exactly who they interact with on the new app.
#Facebook#EN#2023#meta#threat#research#de-platforming#influence-operation#covert
·about.fb.com·
Raising Online Defenses Through Transparency and Collaboration | Meta
DDoS threat report for 2023 Q2
DDoS threat report for 2023 Q2
Q2 2023 saw an unprecedented escalation in DDoS attack sophistication. Pro-Russian hacktivists REvil, Killnet and Anonymous Sudan joined forces to attack Western sites. Mitel vulnerability exploits surged by a whopping 532%, and attacks on crypto rocketed up by 600%. Read the full story...
#Cloudflare#EN#2023#DDoS#threat#report#Q2#REvil#Killnet
·blog.cloudflare.com·
DDoS threat report for 2023 Q2
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Summary Three key takeaways from our analysis of Vidar infrastructure: Russian VPN gateways are potentially providing anonymity for Vidar operators / customers, making it more challenging for analysts to have a complete overview of this threat. These gateways now appear to be migrating to Tor. Vidar operators appear to be expanding their infrastructure, so analysts need to keep them in their sights. We expect a new wave of customers and as a result, an increase of campaigns in the upcoming weeks
#team-cymru#EN#2023#Vidar#infostealer#analysis#threat#infrastructure#VPN
·team-cymru.com·
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Summary Three key takeaways from our analysis of Vidar infrastructure: Russian VPN gateways are potentially providing anonymity for Vidar operators / customers, making it more challenging for analysts to have a complete overview of this threat. These gateways now appear to be migrating to Tor. Vidar operators appear to be expanding their infrastructure, so analysts need to keep them in their sights. We expect a new wave of customers and as a result, an increase of campaigns in the upcoming weeks
#team-cymru#EN#2023#Vidar#infostealer#analysis#threat#infrastructure#VPN
·team-cymru.com·
Darth Vidar: The Dark Side of Evolving Threat Infrastructure