cyberveille.decio.ch

cyberveille.decio.ch

7248 bookmarks
Custom sorting
Blackcat ransomware site reportedly seized but UK agency denies responsibility
Blackcat ransomware site reportedly seized but UK agency denies responsibility
website used by hackers responsible for a breach at UnitedHealth Group (UNH.N), opens new tab has been replaced by a notice saying it has been seized by international law enforcement. But at least one of the agencies allegedly responsible said it had nothing to do with the seizure, raising the possibility that the hackers - who also go by the moniker ALPHV - faked their own takedown. A message posted to the website of the Blackcat hacking gang on Tuesday said it had been impounded "as part of a coordinated law enforcement action" by U.S. authorities and other law enforcement agencies. Among the logos of non-American agencies involved were those of Europol and Britain's National Crime Agency.
#reuters#EN#2024#AlphV#UnitedHealth-Group#BlackCat#ransomware#UK#denies
·reuters.com·
Blackcat ransomware site reportedly seized but UK agency denies responsibility
Developing: AlphV allegedly scammed Change Healthcare and its own affiliate (1)
Developing: AlphV allegedly scammed Change Healthcare and its own affiliate (1)
Developing: Someone claiming to be an “affiliate plus” for AlphV claims they were responsible for the Change Healthcare attack but that AlphV stole the payment Change Healthcare had made and suspended the affiliate’s account. The affiliate’s claims appeared on Ramp Forum and have been circulating since then. The post can be seen below, via @vx-underground:
#databreaches.net#EN#2024#AlphV#affiliate#scam#Change#Healthcare
·databreaches.net·
Developing: AlphV allegedly scammed Change Healthcare and its own affiliate (1)
Ukraine Claims it Hacked Russian MoD - Infosecurity Magazine
Ukraine Claims it Hacked Russian MoD - Infosecurity Magazine
Hackers operating from Ukraine’s Main Intelligence Directorate (GUR) have claimed another scalp; the Russian Ministry of Defense (MoD). The GUR, part of Kyiv’s Ministry of Defense, said a “special operation” enabled it to breach the servers of the Russian MoD (Minoborony) to obtain sensitive documents. These included orders and reports apparently circulated among over 2000 structural units of the ministry.
#infosecurity-magazine#EN#2024#Minoborony#MoD#Russia-Ukraine-war#GUR#breach
·infosecurity-magazine.com·
Ukraine Claims it Hacked Russian MoD - Infosecurity Magazine
CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)
CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)
In February 2024, Rapid7’s vulnerability research team identified two new vulnerabilities affecting JetBrains TeamCity CI/CD server: CVE-2024-27198 is an authentication bypass vulnerability in the web component of TeamCity that arises from an alternative path issue (CWE-288) and has a CVSS base score of 9.8 (Critical). CVE-2024-27199 is an authentication bypass vulnerability in the web component of TeamCity that arises from a path traversal issue (CWE-22) and has a CVSS base score of 7.3 (High).
#rapid7#EN#2024#research#JetBrains#TeamCity#CVE-2024-27198#CVE-2024-27199
·rapid7.com·
CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)
Russia’s chief propagandist leaks intercepted German military Webex conversation
Russia’s chief propagandist leaks intercepted German military Webex conversation
Russia has been accused of attempting to inflame divisions in Germany by publishing an intercepted conversation in which Bundeswehr officials discuss the country’s support for Ukraine, particularly around the supply of Taurus cruise missiles. The 38-minute conversation, which took place on February 19, was first published on social media platform Telegram by Margarita Simonyan, the editor-in-chief of RT and a sanctioned propagandist, who said the recording had been provided to her by “comrades in uniform.”
#therecord.media#EN#2024#Russia#Germany#air-force#leak#webex#Russia-Ukraine-war
·therecord.media·
Russia’s chief propagandist leaks intercepted German military Webex conversation
FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga. – Krebs on Security
FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga. – Krebs on Security
The FBI’s takedown of the LockBit ransomware group last week came as LockBit was preparing to release sensitive data stolen from government computer systems in Fulton County, Ga. But LockBit is now regrouping, and the gang says it will publish the stolen Fulton County data on March 2 unless paid a ransom. LockBit claims the cache includes documents tied to the county’s ongoing criminal prosecution of former President Trump, but court watchers say teaser documents published by the crime gang suggest a total leak of the Fulton County data could put lives at risk and jeopardize a number of other criminal trials
#krebsonsecurity#EN#2024#lockbit#Fulton-County#leak#Trump#FBI#claim
·krebsonsecurity.com·
FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga. – Krebs on Security
Mail in the middle – a tool to automate spear phishing campaigns
Mail in the middle – a tool to automate spear phishing campaigns
The idea is simple; take advantage of the typos that people make when they enter email addresses. If we positioned ourselves in between the sender of an email (be it a person or a system) and the legitimate recipient, we may be able to capture plenty of information about the business, including personally identifiable information, email verification processes, etc. This scenario is effectively a Person-in-the-Middle (PiTM), but for email communications.
#Orange-Cyberdefence#sensepost#2024#EN#Typosquatting#tool#mail#domain
·sensepost.com·
Mail in the middle – a tool to automate spear phishing campaigns
NoName057(16) DDoSia project: 2024 updates and behavioural shifts
NoName057(16) DDoSia project: 2024 updates and behavioural shifts
Learn about NoName057(16), a pro-Russian hacktivist group behind Project DDoSia targeting entities supporting Ukraine. Discover an overview of the changes made by the group, both from the perspective of the software shared by the group to generate DDoS attacks and the specifics of the evolution of the C2 servers. It also provides an overview of the country and sectors targeted by the group for 2024.
#sekoia#EN#2024#NoName057(16)#DDoSia#Analysis
·blog.sekoia.io·
NoName057(16) DDoSia project: 2024 updates and behavioural shifts
CISA cautions against using hacked Ivanti VPN gateways even after factory resets
CISA cautions against using hacked Ivanti VPN gateways even after factory resets
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed today that attackers who hack Ivanti VPN appliances using one of multiple actively exploited vulnerabilities may be able to maintain root persistence even after performing factory resets.
#bleepingcomputer#EN#2024#CISA#FBI#Ivanti#Warning
·bleepingcomputer.com·
CISA cautions against using hacked Ivanti VPN gateways even after factory resets
Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Connect and Policy Secure Gateways | CISA
Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Connect and Policy Secure Gateways | CISA
Based upon the authoring organizations’ observations during incident response activities and available industry reporting, as supplemented by CISA’s research findings, the authoring organizations recommend that the safest course of action for network defenders is to assume a sophisticated threat actor may deploy rootkit level persistence on a device that has been reset and lay dormant for an arbitrary amount of time. For example, as outlined in PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure), sophisticated actors may remain silent on compromised networks for long periods. The authoring organizations strongly urge all organizations to consider the significant risk of adversary access to, and persistence on, Ivanti Connect Secure and Ivanti Policy Secure gateways when determining whether to continue operating these devices in an enterprise environment.
#CISA#EN#2024#Ivanti#Vulnerabilities#Connect#persistence#Warning
·cisa.gov·
Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Connect and Policy Secure Gateways | CISA
BlackCat Ransomware Affiliate TTPs
BlackCat Ransomware Affiliate TTPs
This blog post provides a detailed look at the TTPs of a ransomware affiliate operator. In this case, the endpoint had been moved to another infrastructure (as illustrated by various command lines, and confirmed by the partner), so while Huntress SOC analysts reported the activity to the partner, no Huntress customer was impacted by the ransomware deployment.
#huntress#EN#2024#BlackCat#Ransomware#TTPs#ScreenConnect
·huntress.com·
BlackCat Ransomware Affiliate TTPs