Found 3149 bookmarks
Custom sorting
Des dizaines de milliers d'entreprises victimes indirectes d'une cyberattaque
Des dizaines de milliers d'entreprises victimes indirectes d'une cyberattaque
Plus de 45'000 PME et près d'un millier de fiduciaires suisses ne peuvent plus utiliser leur logiciel de gestion "Winbiz cloud", accessible en ligne. La faute à une attaque informatique qui a touché l'hébergeur bernois Infopro. La situation devrait perdurer jusqu'à ce week-end.
#rts#CH#FR#2022#Winbiz#fiduciaires#Infopro#attaque
·rts.ch·
Des dizaines de milliers d'entreprises victimes indirectes d'une cyberattaque
Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice | Proofpoint US
Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice | Proofpoint US
Key Takeaways * Nighthawk is an advanced C2 framework intended for red team operations through commercial licensing. * Proofpoint researchers observed initial use of the framework in September 2022 by a likely red team. * We have seen no indications at this time that leaked versions of Nighthawk are being used by attributed threat actors in the wild. * The tool has a robust list of configurable evasion techniques that are referenced as “opsec” functions throughout its code. P* roofpoint researchers expect Nighthawk will show up in threat actor campaigns as the tool becomes more widely recognized or as threat actors search for new, more capable tools to use against targets.
#proofpoint#EN#2022#redteam#tool#Nighthawk#C2#framework#threat
·proofpoint.com·
Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice | Proofpoint US
Why would you want to hack Electric Vehicle Charging Stations?
Why would you want to hack Electric Vehicle Charging Stations?
A Russian zero-day exploit purchase site is interested in tools for hacking of Electric Vehicle Charging Stations. This raises a number of questions. Why would anybody want to hack such targets? Also, why would Russian entities (in particular) be interested in such targets? The best answer to these is “good question!”, and let's put politics aside. Let’s explore the potential cybersecurity risks of electric vehicle charging station, assuming the ability of compromising them at a scale, having some kind of tools. It turns out that this is a fascinating security problem!
#lukaszolejnik#EN#2022#cyber-risk#cyberwarfare#security#0-day#Vehicle#Charging#Stations
·blog.lukaszolejnik.com·
Why would you want to hack Electric Vehicle Charging Stations?
Endurance Ransomware Claims Breach of US Federal Government
Endurance Ransomware Claims Breach of US Federal Government
The WatchGuard Security Team spends a lot of time chasing ransomware extortion groups throughout the dark web. So, it only fits that one of the newer ransomware extortion groups is named Endurance Ransomware. It appears this “group” is one individual known as IntelBroker, who has allegedly breached several entities of the US government and two […]
#secplicity#EN#2022#WatchGuard#ransomware#Endurance#US
·secplicity.org·
Endurance Ransomware Claims Breach of US Federal Government
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately
#zerodayinitiative#EN#2022#0-day#CVE-2022-41040#CVE-2022-41082#PowerShell
·zerodayinitiative.com·
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Making Cobalt Strike harder for threat actors to abuse
Making Cobalt Strike harder for threat actors to abuse
Cobalt Strike, the popular tool used by red teams to test the resilience of their cyber defenses, has seen many iterations and improvements over the last decade. First released in 2012, it was originally the commercial spinoff of the open-source Armitage project that added a graphical user interface (GUI) to the Metasploit framework to help security practitioners detect software vulnerabilities more quickly.
#google#EN#2022#Cobalt-Strike#YARA#rules#detect
·cloud.google.com·
Making Cobalt Strike harder for threat actors to abuse
Michigan school districts reopen after three-day closure due to ransomware attack
Michigan school districts reopen after three-day closure due to ransomware attack
Public schools in two Michigan counties are reopening on Thursday after a ransomware attack crippled their ability to function and closed doors to students for three days. All of the public schools in Jackson and Hillsdale counties announced their reopening on Thursday in letters to parents, assuring them that cybersecurity experts, tech officials and law enforcement worked around the clock to restore the systems following outages that began on Monday.
#therecord#EN#2022#schools#US#ransomware#Public#closed#students
·therecord.media·
Michigan school districts reopen after three-day closure due to ransomware attack
A Comprehensive Look at Emotet’s Fall 2022 Return
A Comprehensive Look at Emotet’s Fall 2022 Return
  • Emotet returned to the email threat landscape in early November for the first time since July 2022. It is once again one of the most high-volume actors observed by Proofpoint, distributing hundreds of thousands of emails per day. * Proofpoint observed multiple changes to Emotet and its payloads including the lures used, and changes to the Emotet modules, loader, and packer. * Emotet was observed dropping IcedID. * The new activity suggests Emotet is returning to its full functionality acting as a delivery network for major malware families. * New operators or management might be involved as the botnet has some key differences with previous deployments.
#proofpoint#EN#2022#Emotet#Return#IcedID
·proofpoint.com·
A Comprehensive Look at Emotet’s Fall 2022 Return
CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures
CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures
Rapid7 discovered several vulnerabilities and exposures in F5 BIG-IP and BIG-IQ devices running a customized distribution of CentOS detailed in F5's Base Operating Systems support article. The affected products are detailed in the vendor advisories below:
#rapid7#EN#2022#CVE-2022-41622#CVE-2022-41800#F5#BIG-IP#vulnerabilities
·rapid7.com·
CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures
Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
From mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity. In the course of incident response activities, CISA determined that cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware Horizon server, installed XMRig crypto mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence.
#cisa#EN#2022#uscert#csirt#cert#cybersecurity#cyber-security#Log4Shell#VM#APT#Iran#USware
·cisa.gov·
Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
New RapperBot Campaign – We Know What You Bruting for this Time
New RapperBot Campaign – We Know What You Bruting for this Time
FortiGuard Labs provides an analysis on RapperBot focusing on comparing samples for different campaigns, including one aiming to launch Distributed Denial of Service (DDoS) attacks. Read our blog to learn more about the differences observed in this campaign vs previous RapperBot and similar campaigns in the past.
#fortinet#EN#2022#RapperBot#DDoS-attacks#DDoS#analysis#IoCs
·fortinet.com·
New RapperBot Campaign – We Know What You Bruting for this Time
CVE-2022-45047: Apache MINA SSHD unsafe deserialization vulnerability
CVE-2022-45047: Apache MINA SSHD unsafe deserialization vulnerability
Recently, Apache MINA fixed an unsafe deserialization vulnerability. The bug exists in the class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider, an attacker could exploit this vulnerability to deserialize and thus achieve remote code execution. Track as CVE-2022-45047, the flaw severity is important.
#securityonline#EN#2022#CVE-2022-4504#Apache#MINA#SSHD#unsafe#deserialization
·securityonline.info·
CVE-2022-45047: Apache MINA SSHD unsafe deserialization vulnerability