cyberveille.decio.ch

cyberveille.decio.ch

5334 bookmarks
Custom sorting
ZINC weaponizing open-source software - Microsoft Security Blog
ZINC weaponizing open-source software - Microsoft Security Blog
In recent months, Microsoft has detected a wide range of social engineering campaigns using weaponized legitimate open-source software by an actor we track as ZINC. Microsoft Threat Intelligence Center (MSTIC) observed activity targeting employees in organizations across multiple industries including media, defense and aerospace, and IT services in the US, UK, India, and Russia. Based on the observed tradecraft, infrastructure, tooling, and account affiliations, MSTIC attributes this campaign with high confidence to ZINC, a state-sponsored group based out of North Korea with objectives focused on espionage, data theft, financial gain, and network destruction.
#microsoft#EN#2022#Microsoft#weaponized#ZINC#open-source#MSTIC#apt#North-Korea
·microsoft.com·
ZINC weaponizing open-source software - Microsoft Security Blog
New RisePro Stealer distributed by the prominent PrivateLoader
New RisePro Stealer distributed by the prominent PrivateLoader
PrivateLoader is an active malware in the loader market, used by multiple threat actors to deliver various payloads, mainly information stealer. Since our previous investigation, we keep tracking the malware to map its ecosystem and delivered payloads. Starting from this tria.ge submission, we recognized a now familiar first payload, namely PrivateLoader. However, the dropped stealer was not part of our stealer growing collection, notably including RedLine or Raccoon. Eventually SEKOIA.IO realised it was a new undocumented stealer, known as RisePro. This article aims at presenting SEKOIA.IO RisePro information stealer analysis.
#sekoia#EN#2022#PrivateLoader#malware#stealer#RisePro#analysis
·blog.sekoia.io·
New RisePro Stealer distributed by the prominent PrivateLoader
L’art de l’évasion How Shlayer hides its configuration inside Apple proprietary DMG files
L’art de l’évasion How Shlayer hides its configuration inside Apple proprietary DMG files
While conducting routine threat hunting for macOS malware on Ad networks, I stumbled upon an unusual Shlayer sample. Upon further analysis, it became clear that this variant was different from the known Shlayer variants such as OSX/Shlayer.D, OSX/Shlayer.E, or ZShlayer. We have dubbed it OSX/Shlayer.F.
#objective-see#2022#EN#Shlayer#macos#malware#IoCs#analysis
·objective-see.org·
L’art de l’évasion How Shlayer hides its configuration inside Apple proprietary DMG files
Threat Spotlight: XLLing in Excel - threat actors using malicious add-ins
Threat Spotlight: XLLing in Excel - threat actors using malicious add-ins
As more and more users adopt new versions of Microsoft Office, it is likely that threat actors will turn away from VBA-based malicious documents to other formats such as XLLs or rely on exploiting newly discovered vulnerabilities to launch malicious code.
#talosintelligence#EN#2022#Excel#XLLing#malicious#add-ins#XLL#analysis
·blog.talosintelligence.com·
Threat Spotlight: XLLing in Excel - threat actors using malicious add-ins
Raspberry Robin Malware Targets Telecom, Governments
Raspberry Robin Malware Targets Telecom, Governments
We found samples of the Raspberry Robin malware spreading in telecommunications and government office systems beginning September. The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools.
#trendmicro#EN#2022#malware#apt#endpoints#RaspberryRobin#obfuscation#analysis
·trendmicro.com·
Raspberry Robin Malware Targets Telecom, Governments
An infostealer comes to town: Dissecting a highly evasive malware targeting Italy
An infostealer comes to town: Dissecting a highly evasive malware targeting Italy
Cluster25 researchers analyzed several campaigns (also publicly reported by CERT-AGID) that used phishing emails to spread an InfoStealer malware written in .NET through an infection chain that involves Windows Shortcut (LNK) files and Batch Scripts (BAT). Taking into account the used TTPs and extracted evidence, the attacks seem perpetrated by the same adversary (internally named AUI001).
#cluster25#EN#2022#infostealer#Italy#phishing#Campaigns#analysis#Alibaba2044#IoCs
·blog.cluster25.duskrise.com·
An infostealer comes to town: Dissecting a highly evasive malware targeting Italy
New Kiss-a-dog Cryptojacking Campaign Targets Docker and Kubernetes
New Kiss-a-dog Cryptojacking Campaign Targets Docker and Kubernetes
CrowdStrike has uncovered a new cryptojacking campaign targeting vulnerable Docker and Kubernetes infrastructure using an obscure domain from the payload, container escape attempt and anonymized “dog” mining pools. Called “Kiss-a-dog,” the campaign used multiple command-and-control (C2) servers to launch attacks that attempted to mine cryptocurrency, utilize user and kernel mode rootkits to hide the activity, backdoor compromised containers, move laterally in the network and gain persistence.  The CrowdStrike Falcon® platform helps protect organizations of all sizes from sophisticated breaches, including cryptojacking campaigns such as this.
#crowdstrike#EN#2022#Kiss-a-dog#Cryptojacking#docker#kubernetes
·crowdstrike.com·
New Kiss-a-dog Cryptojacking Campaign Targets Docker and Kubernetes
A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook?
A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook?
Robot vacuum companies say your images are safe, but a sprawling global supply chain for data from our devices creates risk.
#technologyreview#EN#2022#privacy#robots#robot-vacuums#iRobot#Roomba#Amazon#artificial-intelligence#machine-learning#computer-vision#internet-of-things#surveillance#Federal-Trade-Commission
·technologyreview.com·
A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook?
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
At the end of September, GTSC reported the finding of two 0-day vulnerabilities in Microsoft Exchange Server, CVE-2022-41040 and CVE-2022-41082. The cybersecurity community dubbed the pair of vulnerabilities ProxyNotShell.
#securelist#EN#2022#DLL-hijacking#Malware-Descriptions#Microsoft-Exchange#Trojan#Vulnerabilities-and-exploits#Zero-day#CVE-2022-41040#CVE-2022-41082#analysis
·securelist.com·
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
À propos du chiffrement côté client - Aide Administrateur Google Workspace
À propos du chiffrement côté client - Aide Administrateur Google Workspace
Vous pouvez chiffrer les données de votre organisation à l'aide de vos propres clés de chiffrement, en plus du chiffrement par défaut fourni par Google Workspace. Avec le chiffrement côté client (CSE) Google Workspace, le chiffrement du contenu est géré dans le navigateur du client avant la transmission ou le stockage des données dans le cloud via Google Drive. De cette façon, les serveurs Google ne peuvent pas accéder à vos clés de chiffrement ni déchiffrer vos données. Après avoir configuré le CSE, vous pouvez choisir quels utilisateurs peuvent créer du contenu chiffré côté client et le partager en interne ou en externe.
#Google#Workspace#2022#FR#chiffrement
·support.google.com·
À propos du chiffrement côté client - Aide Administrateur Google Workspace