cyberveille.decio.ch

cyberveille.decio.ch

6938 bookmarks
Custom sorting
Un prestataire des missions locales victime d’un acte de cyber-malveillance
Un prestataire des missions locales victime d’un acte de cyber-malveillance
Le ministère du Travail et de l’Emploi a pris connaissance de la violation du système d’information, porté par un prestataire de services, utilisé par le réseau des Missions locales. Cette cyber-attaque a eu lieu dans la nuit du 23 octobre 2024 au 24 octobre 2024. Des investigations sont en cours chez le prestataire pour connaître l’origine de cet évènement. La sécurité des systèmes d’information du réseau des Missions locales elles-mêmes n’est pas en cause.
#travail-emploi.gouv.fr#FR#2024#Communiqué#ministère#Missions#locales#prestataire
·travail-emploi.gouv.fr·
Un prestataire des missions locales victime d’un acte de cyber-malveillance
Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
Since August 2023, Microsoft has observed intrusion activity targeting and successfully stealing credentials from multiple Microsoft customers that is enabled by highly evasive password spray attacks. Microsoft has linked the source of these password spray attacks to a network of compromised devices we track as CovertNetwork-1658, also known as xlogin and Quad7 (7777). Microsoft is […]
#microsoft#EN#2024#Storm-0940#Quad7#CovertNetwork-1658#analysis
·microsoft.com·
Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
Amazon identified internet domains abused by APT29
Amazon identified internet domains abused by APT29
APT29 aka Midnight Blizzard recently attempted to phish thousands of people. Building on work by CERT-UA, Amazon recently identified internet domains abused by APT29, a group widely attributed to Russia’s Foreign Intelligence Service (SVR). In this instance, their targets were associated with government agencies, enterprises, and militaries, and the phishing campaign was apparently aimed at […]
#amazon#EN#2024#APT29#MidnightBlizzard#attribution#rdp#spear-phishing
·aws.amazon.com·
Amazon identified internet domains abused by APT29
Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
Since October 22, 2024, Microsoft Threat Intelligence has observed Russian threat actor Midnight Blizzard sending a series of highly targeted spear-phishing emails to individuals in government, academia, defense, non-governmental organizations, and other sectors. This activity is ongoing, and Microsoft will continue to investigate and provide updates as available. Based on our investigation of previous Midnight […]
#microsoft#EN#2024#APT29#MidnightBlizzard#rdp#spear-phishing
·microsoft.com·
Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
Attacker Abuses Victim Resources to Reap Rewards from Titan Network
Attacker Abuses Victim Resources to Reap Rewards from Titan Network
  • Trend Micro researchers observed an attacker exploiting the Atlassian Confluence vulnerability CVE-2023-22527 to achieve remote code execution for cryptomining via the Titan Network. The malicious actor used public IP lookup services and various system commands to gather details about the compromised machine. The attack involved downloading and executing multiple shell scripts to install Titan binaries and connect to the Titan Network with the attacker’s identity. * The malicious actor connects compromised machines to the Cassini Testnet, which allows them to participate in the delegated proof of stake system for reward tokens.
#trendmicro#EN#2024#Titan#Network#Confluence#exploitation#Atlassian#vulnerability#CVE-2023-22527
·trendmicro.com·
Attacker Abuses Victim Resources to Reap Rewards from Titan Network
Change Healthcare says 100 million people impacted by February ransomware attack
Change Healthcare says 100 million people impacted by February ransomware attack
Change Healthcare updated filings with the federal government to warn that about 100 million people had information accessed by hackers during a ransomware attack in February. The Department of Health and Human Services’s (HHS) Office for Civil Rights said Change Healthcare notified them on October 22 that “approximately 100 million individual notices have been sent regarding this breach.”
#therecord.media#EN#2024#Change#Healthcare#Data-Breach#HHS#ransomware#health#PII
·therecord.media·
Change Healthcare says 100 million people impacted by February ransomware attack
LightSpy: Implant for iOS
LightSpy: Implant for iOS
ThreatFabric’s latest insights on LightSpy malware, targeting both iOS and macOS. Learn about the evolving tactics, new destructive features, and the importance of keeping devices updated to defend against these advanced cyber threats.
#threatfabric#EN#2024#LightSpy#iOS
·threatfabric.com·
LightSpy: Implant for iOS
Cyberattaque: la panne de Onelog persiste (update)
Cyberattaque: la panne de Onelog persiste (update)
Mise à jour du 28 octobre 2024: Depuis le jeudi 24 octobre, il est impossible de se connecter et de s'enregistrer via Onelog, Single Sign-On porté conjointement par plusieurs entreprises de médias suisses, en raison d'une cyber-attaque. Les répercussions de la cyberattaque se poursuivent, indique un communiqué daté d'aujourd'hui 28 octobre. Onelog souligne collaborer intensivement avec les entreprises concernées pour rétablir les services affectés dans les prochains jours. Des enquêtes sont menées pour évaluer l'ampleur de l'attaque, en coordination avec les autorités suisses et européennes. En raison de l’enquête en cours, aucun autre détail ne peut être divulgué. Onelog promet de communiquer des informations complémentaires dès que possible.
#ictjournal#FR#2024#cyberattaque#Suisse#Onelog
·ictjournal.ch·
Cyberattaque: la panne de Onelog persiste (update)
Inside the Open Directory of the “You Dun” Threat Group
Inside the Open Directory of the “You Dun” Threat Group
  • Analysis of an open directory found a Chinese speaking threat actor’s toolkit and history of activity. The threat actor displayed extensive scanning and exploitation using WebLogicScan, Vulmap, and Xray, targeting organizations in South Korea, China, Thailand, Taiwan, and Iran. The Viper C2 framework was present as well as a Cobalt Strike kit which included TaoWu and Ladon extensions. * The Leaked LockBit 3 builder was used to create a LockBit payload with a custom ransom note that included reference to a Telegram group which we investigated further in the report.
#thedfirreport#EN#2024#Analysis#open-directory#LockBit#operational#You-Dun#group#China#tools#scan
·thedfirreport.com·
Inside the Open Directory of the “You Dun” Threat Group