cyberveille.decio.ch

cyberveille.decio.ch

5334 bookmarks
Custom sorting
Michigan school districts reopen after three-day closure due to ransomware attack
Michigan school districts reopen after three-day closure due to ransomware attack
Public schools in two Michigan counties are reopening on Thursday after a ransomware attack crippled their ability to function and closed doors to students for three days. All of the public schools in Jackson and Hillsdale counties announced their reopening on Thursday in letters to parents, assuring them that cybersecurity experts, tech officials and law enforcement worked around the clock to restore the systems following outages that began on Monday.
#therecord#EN#2022#schools#US#ransomware#Public#closed#students
·therecord.media·
Michigan school districts reopen after three-day closure due to ransomware attack
A Comprehensive Look at Emotet’s Fall 2022 Return
A Comprehensive Look at Emotet’s Fall 2022 Return
  • Emotet returned to the email threat landscape in early November for the first time since July 2022. It is once again one of the most high-volume actors observed by Proofpoint, distributing hundreds of thousands of emails per day. * Proofpoint observed multiple changes to Emotet and its payloads including the lures used, and changes to the Emotet modules, loader, and packer. * Emotet was observed dropping IcedID. * The new activity suggests Emotet is returning to its full functionality acting as a delivery network for major malware families. * New operators or management might be involved as the botnet has some key differences with previous deployments.
#proofpoint#EN#2022#Emotet#Return#IcedID
·proofpoint.com·
A Comprehensive Look at Emotet’s Fall 2022 Return
CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures
CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures
Rapid7 discovered several vulnerabilities and exposures in F5 BIG-IP and BIG-IQ devices running a customized distribution of CentOS detailed in F5's Base Operating Systems support article. The affected products are detailed in the vendor advisories below:
#rapid7#EN#2022#CVE-2022-41622#CVE-2022-41800#F5#BIG-IP#vulnerabilities
·rapid7.com·
CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures
Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
From mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity. In the course of incident response activities, CISA determined that cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware Horizon server, installed XMRig crypto mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence.
#cisa#EN#2022#uscert#csirt#cert#cybersecurity#cyber-security#Log4Shell#VM#APT#Iran#USware
·cisa.gov·
Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester
New RapperBot Campaign – We Know What You Bruting for this Time
New RapperBot Campaign – We Know What You Bruting for this Time
FortiGuard Labs provides an analysis on RapperBot focusing on comparing samples for different campaigns, including one aiming to launch Distributed Denial of Service (DDoS) attacks. Read our blog to learn more about the differences observed in this campaign vs previous RapperBot and similar campaigns in the past.
#fortinet#EN#2022#RapperBot#DDoS-attacks#DDoS#analysis#IoCs
·fortinet.com·
New RapperBot Campaign – We Know What You Bruting for this Time
Videosorveglianza: stop del Garante privacy a riconoscimento facciale e occhiali smart. L’Autorità apre istruttorie nei confronti di due Comuni
Videosorveglianza: stop del Garante privacy a riconoscimento facciale e occhiali smart. L’Autorità apre istruttorie nei confronti di due Comuni
L’Autorità ha aperto un’istruttoria nei confronti del Comune di Lecce, che ha annunciato l’avvio di un sistema che prevede l’impiego di tecnologie di riconoscimento facciale. In base alla normativa europea e nazionale, ha ricordato l’Autorità, il trattamento di dati personali realizzato da soggetti pubblici, mediante dispositivi video, è generalmente ammesso se necessario per l’esecuzione di un compito di interesse pubblico o connesso all’esercizio di pubblici poteri.
#garanteprivacy#IT#Italy#privacy#stop#riconoscimento#facciale
·garanteprivacy.it·
Videosorveglianza: stop del Garante privacy a riconoscimento facciale e occhiali smart. L’Autorità apre istruttorie nei confronti di due Comuni
CVE-2022-45047: Apache MINA SSHD unsafe deserialization vulnerability
CVE-2022-45047: Apache MINA SSHD unsafe deserialization vulnerability
Recently, Apache MINA fixed an unsafe deserialization vulnerability. The bug exists in the class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider, an attacker could exploit this vulnerability to deserialize and thus achieve remote code execution. Track as CVE-2022-45047, the flaw severity is important.
#securityonline#EN#2022#CVE-2022-4504#Apache#MINA#SSHD#unsafe#deserialization
·securityonline.info·
CVE-2022-45047: Apache MINA SSHD unsafe deserialization vulnerability
BumbleBee Zeros in on Meterpreter
BumbleBee Zeros in on Meterpreter
In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector from a Contact Forms campaign. We have previously reported on two BumbleBee intrusions (1, 2), and this report is a continuation of a series of reports uncovering multiple TTPs seen by BumbleBee post exploitation operators. The intrusion began with the delivery of an ISO file that contained an LNK and a DLL. The threat actors leveraged BumbleBee to load a Meterpreter agent and Cobalt Strike Beacons. They then performed reconnaissance, used two different UAC bypass techniques, dumped credentials, escalated privileges using a ZeroLogon exploit, and moved laterally through the environment.
#thedfirreport#EN#2022#bumblebee#case#analysis
·thedfirreport.com·
BumbleBee Zeros in on Meterpreter
LockBit ransomware suspect nabbed in Canada, faces charges in the US
LockBit ransomware suspect nabbed in Canada, faces charges in the US
Automation features make LockBit one of the more destructive pieces of ransomware. Federal prosecutors on Thursday charged a dual Russian and Canadian national for his alleged participation in a global campaign to spread ransomware known as LockBit. Mikhail Vasiliev, 33, of Bradford, Ontario, Canada, was taken into custody in late October by authorities in Ontario, officials at Interpol said. He is now in custody in Canada awaiting extradition to the US.
#arstechnica#EN#2022#LockBit#Canada#member#arrest
·arstechnica.com·
LockBit ransomware suspect nabbed in Canada, faces charges in the US
Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns
Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns
  • The InterPlanetary File System (IPFS) is an emerging Web3 technology that is currently seeing widespread abuse by threat actors. * Cisco Talos has observed multiple ongoing campaigns that leverage the IPFS network to host their malware payloads and phishing kit infrastructure while facilitating other attacks. * IPFS is often used for legitimate
#talosintelligence#EN#2022#IPFS#Phishing#Malware#Campaigns
·blog.talosintelligence.com·
Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns
Abusing windows’ tokens to compromise active directory without touching lsass
Abusing windows’ tokens to compromise active directory without touching lsass
During an internal assessment, I performed an NTLM relay and ended up owning the NT AUTHORITY\SYSTEM account of the Windows server. Looking at the users connected on the same server, I knew that a domain administrator account was connected. All I had to do to compromise the domain, was compromise the account. This could be achieved by dumping the memory of the LSASS process and collecting their credentials or Kerberos TGT’s. Seemed easy until I realised an EDR was installed on the system. Long story short, I ended up compromising the domain admin account without touching the LSASS process. To do so, I relied on an internal Windows mechanism called token manipulation. The goal of this blog post is to present how I did it. We will see what access tokens are, what they are used for, how we can manipulate them to usurp legitimate accounts without touching LSASS and finally I will present a tool and a CrackMapExec module that can be used during such assessments. All the source code, binaries and CrackMapExec module can be found here https://github.com/sensepost/impersonate.
#sensepost#EN#2022#orange#LSASS#CrackMapExec#redteam#impersonate#tokens#abusing#Windows
·sensepost.com·
Abusing windows’ tokens to compromise active directory without touching lsass
The Case of Cloud9 Chrome Botnet
The Case of Cloud9 Chrome Botnet
The Zimperium zLabs team recently discovered a malicious browser extension, originally called Cloud9, which not only steals the information available during the browser session but can also install malware on a user's device and subsequently assume control of the entire device. In this blog, we will take a deeper look into this malicious browser extension.
#zimperium#EN#2022#browser#extension#Cloud9#malicious#stealer#malware#Analysis
·zimperium.com·
The Case of Cloud9 Chrome Botnet
A cyberattack blocked the trains in Denmark
A cyberattack blocked the trains in Denmark
At the end of October, a cyber attack caused the trains to stop in Denmark, the attack hit a third-party IT service provider. A cyber attack caused training the trains operated by DSB to stop in Denmark the last weekend, threat actors hit a third-party IT service provider. The attack hit the Danish company Supeo […]
#securityaffairs#EN#2022#Denmark#cyberattack#trains#DSB
·securityaffairs.co·
A cyberattack blocked the trains in Denmark