cyberveille.decio.ch

cyberveille.decio.ch

6798 bookmarks
Custom sorting
Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON | Microsoft Security Blog
Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON | Microsoft Security Blog
At CYBERWARCON 2024, Microsoft Threat Intelligence analysts will share research and insights on North Korean and Chinese threat actors representing years of threat actor tracking, infrastructure monitoring and disruption, and their attack tooling.
#microsoft#EN#2024#CYBERWARCON#DPRK#North-Korea#China#analysis#intlligence
·microsoft.com·
Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON | Microsoft Security Blog
PROSPERO & Proton66: Tracing Uncovering the links between bulletproof networks
PROSPERO & Proton66: Tracing Uncovering the links between bulletproof networks
  • The Russian autonomous system PROSPERO (AS200593) could be linked with a high level of confidence to Proton66 (AS198953), another Russian AS, that we believe to be connected to the bulletproof services named ‘SecureHost‘ and ‘BEARHOST‘. We notably observed that both network’s configurations are almost identical in terms of peering agreements and their respective share of loads throughout time. Amongst the activities shared by the two networks, we noticed that both GootLoader and SpyNote malwares recently changed their infrastructure of command-and-control servers and phishing pages from to Proton66. Additionally, the domains hosting the phishing pages deploying SpyNote were hosted on either one of the two AS and had already been used in previous campaigns delivering revoked AnyDesk and LiveChat versions for both Windows and Mac. Regarding the other malicious activities found on PROSPERO’s IPs, we found that throughout September, multiple SMS spam campaigns targeting citizens from various countries were leading to phishing domains hosted on PROSPERO and Proton66. While most phishing templates were usurping bank login pages to steal credit card details, we also noticed that some of them were used to deploy android spywares such as Coper (a.k.a. Octo). * SocGholish, another initial access broker (IAB) that we found to be hosting a major part of its infrastructure on Proton66, continues to leverage this autonomous system to host fingerprinting scripts contained on the websites it infects. Along SocGholish, we found out that FakeBat, another loader that infects systems through compromised websites, was using the same IPs to host both screening and redirection script
#intrinsec#EN#2024#AS200593#AS198953#PROSPERO#GootLoader#SpyNote#Russia#bulletproof#BEARHOST#SocGholish
·intrinsec.com·
PROSPERO & Proton66: Tracing Uncovering the links between bulletproof networks
Cinq membres du groupe de pirates Scattered Spider arrêtés
Cinq membres du groupe de pirates Scattered Spider arrêtés
Quatre Américains et un Britannique sont désormais poursuivis pour leur implication dans ce groupe, accusé notamment d’avoir piraté les casinos MGM Resorts. Spécialisé dans l’hameçonnage, ce collectif pourrait être l’émanation d’une vaste communauté de pirates anglophones.
#pixels#FR#2024#lemonde#ScatteredSpider#busted#arrêtés#cybercriminels#jeunes
·lemonde.fr·
Cinq membres du groupe de pirates Scattered Spider arrêtés
Ruag développe un smartphone pour l'armée suisse
Ruag développe un smartphone pour l'armée suisse
Dans le cadre d'un nouveau projet, le groupe technologique Ruag modifie un smartphone Samsung pour les institutions gouvernementales et les autorités telles que l'armée et les organisations à gyrophare. Un smartphone appelé "Guardian" est un nouveau projet de communication sécurisée. C'est l'entreprise d'armement Ruag MRO qui en est responsable. Le prototype actuel devrait également fonctionner par satellite dans un avenir proche. Ruag collabore avec Wisekey, une société de sécurité genevoise, pour la connexion par satellite. C'est ce que rapportent plusieurs médias suisses comme le "Walliser Bote" et "Watson".
#digitec#FR#2024#Ruag#smartphone#armée#suisse
·digitec.ch·
Ruag développe un smartphone pour l'armée suisse
750 000 fichiers et dossiers patients sensibles français en fuite sur le dark web, que se passe-t-il ?
750 000 fichiers et dossiers patients sensibles français en fuite sur le dark web, que se passe-t-il ?
[Article mis à jour le 19 novembre 2024 à 17h40] Un cybercriminel a mis en ligne, mardi, une base de données contenant les informations hospitalières et personnelles de plus de 750 000 personnes. Celui-ci revendique une fuite de données du logiciel de gestion médicale Mediboard.
#clubic#FR#2024#santé#médicaux#hôpitaux#near2tlg#dataleak#Mediboard#softway
·clubic.com·
750 000 fichiers et dossiers patients sensibles français en fuite sur le dark web, que se passe-t-il ?
FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
We analyze FrostyGoop malware, which targets OT systems. This article walks through newly discovered samples, indicators, and also examines configurations and network communications. We analyze FrostyGoop malware, which targets OT systems. This article walks through newly discovered samples, indicators, and also examines configurations and network communications.
#unit42.paloaltonetworks#FrostyGoop#EN#2024#analysis#malware
·unit42.paloaltonetworks.com·
FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
Office of Public Affairs | Phobos Ransomware Administrator Extradited from South Korea to Face Cybercrime Charge
Office of Public Affairs | Phobos Ransomware Administrator Extradited from South Korea to Face Cybercrime Charge
The Justice Department unsealed criminal charges today against Evgenii Ptitsyn, 42, a Russian national, for allegedly administering the sale, distribution, and operation of Phobos ransomware.
#justice.gov#US#2024#EN#Phobos#Ransomware#Administrator#Extradited
·justice.gov·
Office of Public Affairs | Phobos Ransomware Administrator Extradited from South Korea to Face Cybercrime Charge
Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
This is a pair of vulnerabilities, described as ‘Authentication Bypass in the Management Web Interface’ and a ‘Privilege Escalation‘ respectively, strongly suggesting they are used as a chain to gain superuser access, a pattern that we’ve seen before with Palo Alto appliances. Before we’ve even dived into to code, we’ve already ascertained that we’re looking for a chain of vulnerabilities to achieve that coveted pre-authenticated Remote Code Execution.
#watchtowr#EN#2024#CVE-2024-0012#CVE-2024-9474#Palo#Alto#PAN-OS
·labs.watchtowr.com·
Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany | WIRED
Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany | WIRED
More than 3 billion phone coordinates collected by a US data broker expose the detailed movements of US military and intelligence workers in Germany—and the Pentagon is powerless to stop it.
#wired#EN#2024#surveillance#Datastream#data-broker#security#nsa#military#national-security#germany#pentagon
·wired.com·
Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany | WIRED
T-Mobile confirms it was hacked in recent wave of telecom breaches
T-Mobile confirms it was hacked in recent wave of telecom breaches
T-Mobile confirms it was hacked in the wave of recently reported telecom breaches conducted by Chinese threat actors to gain access to private communications, call records, and law enforcement information requests.
#bleepingcomputer#EN#2024#China#Cyber-espionage#Cyberattack#Salt-Typhoon#T-Mobile#Telecommunications#Security#InfoSec#Computer-Security
·bleepingcomputer.com·
T-Mobile confirms it was hacked in recent wave of telecom breaches
Stealthy Attributes of APT Lazarus: Evading Detection with Extended Attributes
Stealthy Attributes of APT Lazarus: Evading Detection with Extended Attributes
APT Lazarus has begun attempting to smuggle code using custom extended attributes. Extended attributes are metadata that can be associated with files and directories in various file systems. They allow users to store additional information about a file beyond the standard attributes like file size, timestamps, and permissions.
#group-ib#EN#2024#Extended#attributes#macos#Smuggling#APT#Lazarus
·group-ib.com·
Stealthy Attributes of APT Lazarus: Evading Detection with Extended Attributes