cyberveille.decio.ch

cyberveille.decio.ch

7248 bookmarks
Newest
[Security Update] Incident Details
[Security Update] Incident Details
As a result, today we are publishing details of activity by a sophisticated nation-state sponsored threat actor that gained unauthorized access to our systems to target a small and specific set of our customers. Prior to sharing this information, we notified and worked with the impacted customers. We have also been working with our incident response (IR) partners and law enforcement on both our investigation and steps designed to make our systems and our customers’ operations even more secure. The attack vector used by the threat actor has been mitigated.
#jumpcloud#EN#2023#compromise#APT#Incident
·jumpcloud.com·
[Security Update] Incident Details
BlackLotus UEFI Bootkit Source Code Leaked on GitHub
BlackLotus UEFI Bootkit Source Code Leaked on GitHub
The source code for the BlackLotus UEFI bootkit has been shared publicly on GitHub, albeit with several modifications compared to the original malware. Designed specifically for Windows, the bootkit emerged on hacker forums in October last year, being advertised with APT-level capabilities such as secure boot and user access control (UAC) bypass and the ability to disable security applications and defense mechanisms on victim systems.
#securityweek#EN#2023#BlackLotus#UEFI#Bootkit#Source#Code#Leaked#GitHub
·securityweek.com·
BlackLotus UEFI Bootkit Source Code Leaked on GitHub
Microsoft changes signing key system breached by Chinese hackers to steal US gov’t data
Microsoft changes signing key system breached by Chinese hackers to steal US gov’t data
Microsoft has announced changes to a system that was exploited by Chinese hackers over the last month that allowed them to access email accounts and spy on the inner workings of two dozen organizations, including government agencies, a lawmaker’s staff and even Commerce Secretary Gina Raimondo.
#therecord#EN#2023#Microsoft#breached#Storm0558#key#AAD
·therecord.media·
Microsoft changes signing key system breached by Chinese hackers to steal US gov’t data
Uncovering weaknesses in Apple macOS and VMWare vCenter: 12 vulnerabilities in RPC implementation
Uncovering weaknesses in Apple macOS and VMWare vCenter: 12 vulnerabilities in RPC implementation
Cisco Talos discovered 12 memory corruption vulnerabilities in MSRPC implementations on Apple macOS and VMWare vCenter.       - Seven vulnerabilities affect Apple macOS only.       - Two vulnerabilities affect VMWare vCenter.       - Three vulnerabilities affect both.
#talosintelligence#EN#2023#MSRPC#macOS#VMWare#vCenter#vulnerabilities
·blog.talosintelligence.com·
Uncovering weaknesses in Apple macOS and VMWare vCenter: 12 vulnerabilities in RPC implementation
Chinese hackers breached US government email accounts, Microsoft and White House say | CNN Politics
Chinese hackers breached US government email accounts, Microsoft and White House say | CNN Politics
China-based hackers have breached email accounts at two-dozen organizations, including some United States government agencies, in an apparent spying campaign aimed at acquiring sensitive information, according to statements from Microsoft and the White House late Tuesday.
#cnn#EN#2023#China#US#Microsoft#breached#Storm0558
·edition.cnn.com·
Chinese hackers breached US government email accounts, Microsoft and White House say | CNN Politics
KB5029033: Notice of additions to the Windows Driver.STL revocation list - Microsoft Support
KB5029033: Notice of additions to the Windows Driver.STL revocation list - Microsoft Support
The Microsoft Windows Hardware Compatibility Program (WHCP) certifies that drivers, and other products, run reliably on Windows and on Windows certified hardware. First reported by Sophos, and later Trend Micro and Cisco, Microsoft has investigated and confirmed a list of third-party WHCP-certified drivers used in cyber threat campaigns. Because of the drivers’ intent and functionality, Microsoft has added them to the Windows Driver.STL revocation list.
#microsoft#EN#2023#drivers#signed#Microsof-signed#blocklist
·support.microsoft.com·
KB5029033: Notice of additions to the Windows Driver.STL revocation list - Microsoft Support
Storm-0978 attacks reveal financial and espionage motives
Storm-0978 attacks reveal financial and espionage motives
Microsoft has identified a phishing campaign conducted by the threat actor tracked as Storm-0978 targeting defense and government entities in Europe and North America. The campaign involved the abuse of CVE-2023-36884, which included a zero-day remote code execution vulnerability exploited via Microsoft Word documents.
#microsoft#EN#2023#Storm-0978#Follina#CVE-2023-36884#ero-day#remote#phishing
·microsoft.com·
Storm-0978 attacks reveal financial and espionage motives