cyberveille.decio.ch

cyberveille.decio.ch

7248 bookmarks
Newest
SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation
SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation
The Securities and Exchange Commission has notified the chief financial officer and CISO of SolarWinds about potential enforcement actions related to the 2020 cyberattack against the company’s Orion software platform, the company disclosed in a regulatory filing with the agency.
#cybersecuritydive#EN#2023#regulation#SolarWinds#CISO#CFO#cyberattack#action#justice#legal
·cybersecuritydive.com·
SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation
Tracing Ransomware Threat Actors Through Stylometric Analysis and Chat Log Examination
Tracing Ransomware Threat Actors Through Stylometric Analysis and Chat Log Examination
I stumbled upon an intriguing concept presented by Will Thomas (BushidoToken) in his blog post titled “Unmasking Ransomware Using Stylometric Analysis: Shadow, 8BASE, Rancoz.” This concept revolves around utilizing stylometry to identify potential modifications in new ransomware variants based on existing popular strains. If you’re interested, you can read the blog post here. (Notably, Will Thomas also appeared on Dark Net Diaries, discussing his tracking of the Revil ransomware.)
#callyso0414#YUCA#medium#EN#2023#ransomware#logs#log#chats#Stylometric#Analysis
·medium.com·
Tracing Ransomware Threat Actors Through Stylometric Analysis and Chat Log Examination
Une équipe d’intervention cantonale épaulera les communes vaudoises en cas de cyberattaque
Une équipe d’intervention cantonale épaulera les communes vaudoises en cas de cyberattaque
Via une convention avec les communes, l’IT du canton de Vaud va créer une équipe d’intervention chargée de leur prêter main forte aux niveaux organisationnel et technique en cas de cyberattaque. La force de réaction s'appuiera également sur des prestataires spécialisés locaux.
#ictjournal#CH#FR#VD#Vaud#convention#cyberattaque
·ictjournal.ch·
Une équipe d’intervention cantonale épaulera les communes vaudoises en cas de cyberattaque
Dismantling encrypted criminal EncroChat communications leads to over 6 500 arrests and close to EUR 900 million seized
Dismantling encrypted criminal EncroChat communications leads to over 6 500 arrests and close to EUR 900 million seized
The dismantling of EncroChat in 2020 sent shockwaves across OCGs in Europe and beyond. It helped to prevent violent attacks, attempted murders, corruption and large-scale drug transports, as well as obtain large-scale information on organised crime.   OCGs worldwide illegally used the encryption tool EncroChat for criminal purposes. Since the dismantling, investigators managed to intercept, share and analyse over 115...
#europol#EN#2023#EncroChat#encrypted
·europol.europa.eu·
Dismantling encrypted criminal EncroChat communications leads to over 6 500 arrests and close to EUR 900 million seized
Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution
Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution
Our research team is committed to continuously identifying potential security vulnerabilities and techniques that threat actors may exploit to bypass existing security controls. In this blog post, our team is detailing on a comprehensive research specifically focused on process injection techniques utilized by attackers to deceive robust security products integrated into the security stack, such as EDRs and XDRs. Throughout the blog post, we will delve into various process injection techniques e
#securityjoes#EN#2023#Mockingjay#EDR#bypass#technique#RWX#Code#Execution
·securityjoes.com·
Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution
PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID
PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID
Deep Instinct’s Threat Research Lab recently noticed a new strain of a JavaScript-based dropper that is delivering Bumblebee and IcedID. The dropper contains comments in Russian and employs the unique user-agent string “PindOS”, which may be a reference to current (and past) anti-American sentiment in Russia. Bumblebee is a malware loader first discovered in March 2022. It was associated with Conti group and was being used as a replacement for BazarLoader. It acts as a primary vector for multiple types of other malware, including ransomware. IcedID is a modular banking malware designed to steal financial information. It has been seen in the wild since at least 2017 and has recently been observed shifting some of its focus to malware delivery.
#deepinstinct#EN#2023#JavaScript#Dropper#PindOS#Bumblebee#analysis
·deepinstinct.com·
PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID
Fragments of Cross-Platform Backdoor Hint at Larger Mac OS Attack
Fragments of Cross-Platform Backdoor Hint at Larger Mac OS Attack
During routine detection maintenance, our Mac researchers stumbled upon a small set of files with backdoor capabilities that seem to form part of a more complex malware toolkit. The following analysis is incomplete, as we are trying to identify the puzzle pieces that are still missing.
#bitdefender#EN#2023#macOS#malware#Cross-Platform#Backdoor
·bitdefender.com·
Fragments of Cross-Platform Backdoor Hint at Larger Mac OS Attack
BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities | Recorded Future
BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities | Recorded Future
Recorded Future's Insikt Group, in partnership with Ukraine's Computer Emergency Response Team (CERT-UA), has uncovered a campaign targeting high-profile entities in Ukraine that was cross-correlated with a spearphishing campaign uncovered by Recorded Future’s Network Traffic Intelligence. The campaign leveraged news about Russia’s war against Ukraine to encourage recipients to open emails, which immediately compromised vulnerable Roundcube servers (an open-source webmail software), using CVE-2020-35730, without engaging with the attachment. We found that the campaign overlaps with historic BlueDelta activity exploiting the Microsoft Outlook zero-day vulnerability CVE-2023-23397 in 2022.
#recordedfuture#EN#2023#Russia-Ukraine-war#Ukraine#Roundcube#CVE-2023-23397#CVE-2020-35730
·recordedfuture.com·
BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities | Recorded Future
Unpacking RDStealer: An Exfiltration Malware Targeting RDP Workloads
Unpacking RDStealer: An Exfiltration Malware Targeting RDP Workloads
In June 2023, Bitdefender Labs published a research paper about espionage operation in East Asia. This operation was ongoing since at least the beginning of 2022, showing a high level of sophistication typically associated with state-sponsored groups. Despite trying various methods, we have been unable to attribute these attacks to a specific threat actor, but the target aligns with the interest of China-based threat actors.
#bitdefender#EN#2023#RDStealer#China#RDP#Exfiltration#Malware
·bitdefender.com·
Unpacking RDStealer: An Exfiltration Malware Targeting RDP Workloads
Des données personnelles aussi touchées lors de la cyberattaque contre la Confédération - rts.ch - Suisse
Des données personnelles aussi touchées lors de la cyberattaque contre la Confédération - rts.ch - Suisse
Outre des données opérationnelles de la Confédération, l'attaque informatique par rançongiciel contre l'entreprise bernoise Xplain a permis de mettre la main sur des informations concernant des particuliers, affirme Le Matin Dimanche.
#rts#FR#CH#2023#xplain#rançongiciel#Confédération
·rts.ch·
Des données personnelles aussi touchées lors de la cyberattaque contre la Confédération - rts.ch - Suisse