cyberveille.decio.ch

cyberveille.decio.ch

5334 bookmarks
Custom sorting
CISA, FBI, and MS-ISAC Release Advisory on Phobos Ransomware
CISA, FBI, and MS-ISAC Release Advisory on Phobos Ransomware
Today, CISA, the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint Cybersecurity Advisory (CSA), #StopRansomware: Phobos Ransomware, to disseminate known tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs), which are from incident response investigations tied to Phobos ransomware activity from as recently as February, 2024.
#cisa#EN#2024#Phobos#Ransomware#Critical-infrastructure#StopRansomware:
·cisa.gov·
CISA, FBI, and MS-ISAC Release Advisory on Phobos Ransomware
Phobos Ransomware Aggressively Targeting U.S. Critical Infrastructure
Phobos Ransomware Aggressively Targeting U.S. Critical Infrastructure
U.S. cybersecurity and intelligence agencies have warned of Phobos ransomware attacks targeting government and critical infrastructure entities, outlining the various tactics and techniques the threat actors have adopted to deploy the file-encrypting malware. "Structured as a ransomware-as-a-service (RaaS) model, Phobos ransomware actors have targeted entities including municipal and county governments, emergency services, education, public healthcare, and critical infrastructure to successfully ransom several million in U.S. dollars," the government said.
#thehackernews#EN#2024#Phobos#Ransomware#CISA#US#Critical-infrastructure
·thehackernews.com·
Phobos Ransomware Aggressively Targeting U.S. Critical Infrastructure
Rapid7 flames JetBrains over vulnerability disclosure
Rapid7 flames JetBrains over vulnerability disclosure
Security shop Rapid7 is criticizing JetBrains for flouting its policy against silent patching regarding fixes for two fresh vulnerabilities in the TeamCity CI/CD server. Rapid7 says it reported the two TeamCity vulnerabilities in mid-February, claiming JetBrains soon after suggested releasing patches for the flaws before publicly disclosing them. Such a move is typically seen as a no-no by the infosec community, which favors transparency, but there's apparently a time and a place for these things.
#theregister#EN#2024#Rapid7#flames#JetBrains
·theregister.com·
Rapid7 flames JetBrains over vulnerability disclosure
Blackcat ransomware site reportedly seized but UK agency denies responsibility
Blackcat ransomware site reportedly seized but UK agency denies responsibility
website used by hackers responsible for a breach at UnitedHealth Group (UNH.N), opens new tab has been replaced by a notice saying it has been seized by international law enforcement. But at least one of the agencies allegedly responsible said it had nothing to do with the seizure, raising the possibility that the hackers - who also go by the moniker ALPHV - faked their own takedown. A message posted to the website of the Blackcat hacking gang on Tuesday said it had been impounded "as part of a coordinated law enforcement action" by U.S. authorities and other law enforcement agencies. Among the logos of non-American agencies involved were those of Europol and Britain's National Crime Agency.
#reuters#EN#2024#AlphV#UnitedHealth-Group#BlackCat#ransomware#UK#denies
·reuters.com·
Blackcat ransomware site reportedly seized but UK agency denies responsibility
Developing: AlphV allegedly scammed Change Healthcare and its own affiliate (1)
Developing: AlphV allegedly scammed Change Healthcare and its own affiliate (1)
Developing: Someone claiming to be an “affiliate plus” for AlphV claims they were responsible for the Change Healthcare attack but that AlphV stole the payment Change Healthcare had made and suspended the affiliate’s account. The affiliate’s claims appeared on Ramp Forum and have been circulating since then. The post can be seen below, via @vx-underground:
#databreaches.net#EN#2024#AlphV#affiliate#scam#Change#Healthcare
·databreaches.net·
Developing: AlphV allegedly scammed Change Healthcare and its own affiliate (1)
Ukraine Claims it Hacked Russian MoD - Infosecurity Magazine
Ukraine Claims it Hacked Russian MoD - Infosecurity Magazine
Hackers operating from Ukraine’s Main Intelligence Directorate (GUR) have claimed another scalp; the Russian Ministry of Defense (MoD). The GUR, part of Kyiv’s Ministry of Defense, said a “special operation” enabled it to breach the servers of the Russian MoD (Minoborony) to obtain sensitive documents. These included orders and reports apparently circulated among over 2000 structural units of the ministry.
#infosecurity-magazine#EN#2024#Minoborony#MoD#Russia-Ukraine-war#GUR#breach
·infosecurity-magazine.com·
Ukraine Claims it Hacked Russian MoD - Infosecurity Magazine
CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)
CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)
In February 2024, Rapid7’s vulnerability research team identified two new vulnerabilities affecting JetBrains TeamCity CI/CD server: CVE-2024-27198 is an authentication bypass vulnerability in the web component of TeamCity that arises from an alternative path issue (CWE-288) and has a CVSS base score of 9.8 (Critical). CVE-2024-27199 is an authentication bypass vulnerability in the web component of TeamCity that arises from a path traversal issue (CWE-22) and has a CVSS base score of 7.3 (High).
#rapid7#EN#2024#research#JetBrains#TeamCity#CVE-2024-27198#CVE-2024-27199
·rapid7.com·
CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)
Russia’s chief propagandist leaks intercepted German military Webex conversation
Russia’s chief propagandist leaks intercepted German military Webex conversation
Russia has been accused of attempting to inflame divisions in Germany by publishing an intercepted conversation in which Bundeswehr officials discuss the country’s support for Ukraine, particularly around the supply of Taurus cruise missiles. The 38-minute conversation, which took place on February 19, was first published on social media platform Telegram by Margarita Simonyan, the editor-in-chief of RT and a sanctioned propagandist, who said the recording had been provided to her by “comrades in uniform.”
#therecord.media#EN#2024#Russia#Germany#air-force#leak#webex#Russia-Ukraine-war
·therecord.media·
Russia’s chief propagandist leaks intercepted German military Webex conversation
FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga. – Krebs on Security
FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga. – Krebs on Security
The FBI’s takedown of the LockBit ransomware group last week came as LockBit was preparing to release sensitive data stolen from government computer systems in Fulton County, Ga. But LockBit is now regrouping, and the gang says it will publish the stolen Fulton County data on March 2 unless paid a ransom. LockBit claims the cache includes documents tied to the county’s ongoing criminal prosecution of former President Trump, but court watchers say teaser documents published by the crime gang suggest a total leak of the Fulton County data could put lives at risk and jeopardize a number of other criminal trials
#krebsonsecurity#EN#2024#lockbit#Fulton-County#leak#Trump#FBI#claim
·krebsonsecurity.com·
FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga. – Krebs on Security
Mail in the middle – a tool to automate spear phishing campaigns
Mail in the middle – a tool to automate spear phishing campaigns
The idea is simple; take advantage of the typos that people make when they enter email addresses. If we positioned ourselves in between the sender of an email (be it a person or a system) and the legitimate recipient, we may be able to capture plenty of information about the business, including personally identifiable information, email verification processes, etc. This scenario is effectively a Person-in-the-Middle (PiTM), but for email communications.
#Orange-Cyberdefence#sensepost#2024#EN#Typosquatting#tool#mail#domain
·sensepost.com·
Mail in the middle – a tool to automate spear phishing campaigns
NoName057(16) DDoSia project: 2024 updates and behavioural shifts
NoName057(16) DDoSia project: 2024 updates and behavioural shifts
Learn about NoName057(16), a pro-Russian hacktivist group behind Project DDoSia targeting entities supporting Ukraine. Discover an overview of the changes made by the group, both from the perspective of the software shared by the group to generate DDoS attacks and the specifics of the evolution of the C2 servers. It also provides an overview of the country and sectors targeted by the group for 2024.
#sekoia#EN#2024#NoName057(16)#DDoSia#Analysis
·blog.sekoia.io·
NoName057(16) DDoSia project: 2024 updates and behavioural shifts