cyberveille.decio.ch

cyberveille.decio.ch

5334 bookmarks
Custom sorting
China’s iPhone ban expected to expand to more government agencies soon
China’s iPhone ban expected to expand to more government agencies soon
A report yesterday revealed that China has banned government officials from using iPhones and other foreign technology within government agencies. Now, a report from Bloomberg says that this is only the start of China’s crackdown on iPhone, with a much broader set of restrictions also in the works.
#9to5mac#China#ban#iPhone#EN#2023#government
·9to5mac.com·
China’s iPhone ban expected to expand to more government agencies soon
MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
CISA received 4 files for analysis from an incident response engagement conducted at an Aeronautical Sector organization. 2 files (bitmap.exe, wkHPd.exe) are identified as variants of Metasploit (Meterpreter) and designed to connect and receive unencrypted payloads from their respective command and control (C2) servers. Note: Metasploit is an open source penetration testing software; Meterpreter is a Metasploit attack payload that runs an interactive shell. These executables are used as attack payloads to run interactive shells, allowing a malicious actor the ability to control and execute code on a system. 2 files (resource.aspx, ConfigLogin.aspx) are Active Server Pages (ASPX) web shells designed to execute remote JavaScript code on the victim server.
#cisa#EN#2023#Multiple#Nation-State#Threat#Actors#Exploit#CVE-2022-47966#CVE-2022-42475
·cisa.gov·
MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
Mac users targeted in new malvertising campaign delivering Atomic Stealer
Mac users targeted in new malvertising campaign delivering Atomic Stealer
  • Malicious ads for Google searches are targeting Mac users Phishing sites trick victims into downloading what they believe is the app they want The malware is bundled in an ad-hoc signed app so it cannot be revoked by Apple * The payload is a new version of the recent Atomic Stealer for OSX
#malwarebytes#EN#2023#macos#AtomicStealer#stealer#tradingview
·malwarebytes.com·
Mac users targeted in new malvertising campaign delivering Atomic Stealer
W3LL oiled machine: Group-IB uncovers covert BEC phishing empire targeting Microsoft 365
W3LL oiled machine: Group-IB uncovers covert BEC phishing empire targeting Microsoft 365
The report details the operations of W3LL, a threat actor behind a phishing empire that has remained largely unknown until now. Group-IB’s Threat Intelligence and Cyber Investigations teams have tracked the evolution of W3LL and uncovered that they played a major role in compromising Microsoft 365 business email accounts over the past 6 years. The threat actor created a hidden underground market, named W3LL Store, that served a closed community of at least 500 threat actors who could purchase a custom phishing kit called W3LL Panel, designed to bypass MFA, as well as 16 other fully customized tools for business email compromise (BEC) attacks. Group-IB investigators identified that W3LL’s phishing tools were used to target over 56,000 corporate Microsoft 365 accounts in the USA, Australia and Europe between October 2022 and July 2023. According to Group-IB’s rough estimates, W3LL’s Store’s turnover for the last 10 months may have reached $500,000. All the information collected by Group-IB’s cyber investigators about W3LL has been shared with relevant law enforcement organizations. PDF Document
#group-ib#EN#2023#BEC#phishing#W3LL#Microsoft365
·group-ib.com·
W3LL oiled machine: Group-IB uncovers covert BEC phishing empire targeting Microsoft 365
Zaun Data Breach
Zaun Data Breach
Zaun Data Breach – Update. Zaun Ltd - fencing and gate manufacturers. Our ranges include perimeter and security fencing, gates and railings.
#zaun#EN#2023#databreach
·zaun.co.uk·
Zaun Data Breach
VMConnect supply chain attack continues, evidence points to North Korea - Security Boulevard
VMConnect supply chain attack continues, evidence points to North Korea - Security Boulevard
In early August, ReversingLabs identified a malicious supply chain campaign that the research team dubbed “VMConnect.” That campaign consisted of two dozen malicious Python packages posted to the Python Package Index (PyPI) open-source repository. The packages mimicked popular open-source Python tools, including vConnector, a wrapper module for pyVmomi VMware vSphere bindings; eth-tester, a collection of tools for testing Ethereum-based applications; and databases, a tool that gives asynchronous support for a range of databases.
#securityboulevard#EN#2023#Supply-Chain-Attack#VMConnect#PyPI
·securityboulevard.com·
VMConnect supply chain attack continues, evidence points to North Korea - Security Boulevard
An Ongoing Open Source Attack Reveals Roots Dating Back To 2021
An Ongoing Open Source Attack Reveals Roots Dating Back To 2021
Developers in the cryptocurrency sphere are being targeted once again, as yet another threat actor has been exposed. This user has been publishing malicious NPM packages with the purpose of exfiltrating sensitive data such as source code and configuration files from the victim’s machines. The threat actor behind this campaign has been linked to malicious activity dating back to 2021. Since then, they have continuously published malicious code.
#checkmarx#EN#2023#malicious#NPM#Supply-chain-security
·checkmarx.com·
An Ongoing Open Source Attack Reveals Roots Dating Back To 2021