cyberveille.decio.ch

cyberveille.decio.ch

5334 bookmarks
Custom sorting
MAR-10365227-3.v1 China Chopper Webshells
MAR-10365227-3.v1 China Chopper Webshells
CISA analyzed 15 files associated with China Chopper malware. The files are modified Offline Address Book (OAB) Virtual Directory (VD) configuration files for Microsoft Exchange servers. The files have been modified with a variant of the China Chopper webshell. The webshells allow an attacker to remotely access the server and execute arbitrary code on the system(s).referenced in this bulletin or otherwise.
#uscert#csirt#cert#en#2022#CISA#China#Chopper#malware#Analysis
·cisa.gov·
MAR-10365227-3.v1 China Chopper Webshells
DeftTorero TTPs in 2019–2021
DeftTorero TTPs in 2019–2021
Earlier this year, we started hunting for possible new DeftTorero (aka Lebanese Cedar, Volatile Cedar) artifacts. This threat actor is believed to originate from the Middle East and was publicly disclosed to the cybersecurity community as early as 2015. Notably, no other intelligence was shared until 2021, which led us to speculate on a possible shift by the threat actor to more fileless/LOLBINS techniques, and the use of known/common offensive tools publicly available on the internet that allows them to blend in.
#securelist#EN#2022#DeftTorero#LebaneseCedar#Lebanon#webshell
·securelist.com·
DeftTorero TTPs in 2019–2021
Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors | Mandiant
Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors | Mandiant
Earlier this year, Mandiant identified a novel malware ecosystem impacting VMware ESXi, Linux vCenter servers, and Windows virtual machines that enables a threat actor to take the following actions: 1) Maintain persistent administrative access to the hypervisor 2) Send commands to the hypervisor that will be routed to the guest VM for execution 3) Transfer files between the ESXi hypervisor and guest machines running beneath it 4) Tamper with logging services on the hypervisor
#mandiant#EN#2022#esxi#hypervisors#malware#BadVIB(E)s#0-day
·mandiant.com·
Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors | Mandiant
Logiciels espions et surveillance : un rapport de l’ONU met en garde contre les menaces croissantes pour la vie privée et les droits de l’homme
Logiciels espions et surveillance : un rapport de l’ONU met en garde contre les menaces croissantes pour la vie privée et les droits de l’homme
Le droit à la vie privée est de plus en plus menacé par l’utilisation de technologies numériques modernes en réseau, dont les caractéristiques en font de formidables outils de surveillance, de contrôle et d’oppression, selon un nouveau rapport de l’ONU. Il est donc essentiel que ces technologies soient encadrées par une réglementation efficace reposant sur le droit international des droits de l’homme et les normes applicables en la matière PDF Document link
#OHCHR#ONU#FR#2022#surveillance#espion#spyware#Pegasus#rapport
·ohchr.org·
Logiciels espions et surveillance : un rapport de l’ONU met en garde contre les menaces croissantes pour la vie privée et les droits de l’homme
Under the hood of a Doppelgänger
Under the hood of a Doppelgänger
This work is the result of a collaboration with EU DisinfoLab an independent non-profit organization focused on tackling sophisticated disinformation campaigns targeting the EU. EU DisinfoLab has during the past three months been investigating a large disinformation campaign targeting western audience with pro-Russian propaganda. While our partner has focused on the actual disinformation being spread, Qurium has looked into the technical infrastructure in use to better understand how the campaign has been setup and operated. The complete report from EU Disinfo Lab can be found here: Doppelganger. Below follows the results of Qurium’s digital forensics investigation and a list of more than 50 domains used in the disinformation campaign.
#qurium#EUDisinfoLab#EU#NE#2022#report#Doppelgänger#propaganda#disifnormation#campaign
·qurium.org·
Under the hood of a Doppelgänger
Ukraine warns of 'massive cyberattacks' coming from Russia on critical infrastructure sites
Ukraine warns of 'massive cyberattacks' coming from Russia on critical infrastructure sites
The Russian government is planning “massive cyberattacks” against Ukrainian critical infrastructure facilities to “increase the effect of missile strikes on electrical supply facilities,” the Ukrainian government said Monday.
#cyberscoop#EN#2022#massive#cyberattacks#geopolitics#Russia-Ukraine-war#Ukraine#government#threat#infrastructures
·cyberscoop.com·
Ukraine warns of 'massive cyberattacks' coming from Russia on critical infrastructure sites
Warning: New attack campaign utilized a new 0-day RCE vulnerability on Microsoft Exchange Server
Warning: New attack campaign utilized a new 0-day RCE vulnerability on Microsoft Exchange Server
Circa the beginning of August 2022, while doing security monitoring & incident response services, GTSC SOC team discovered that a critical infrastructure was being attacked, specifically to their Microsoft Exchange application. During the investigation, GTSC Blue Team experts determined that the attack utilized an unpublished Exchange security vulnerability, i.e., a 0-day vulnerability, thus immediately came up with a temporary containment plan.
#gteltsc.vn#EN#2022#Microsoft-Exchange#Exchange#0-day#RCE#vulnerability#campaign#IoCs
·gteltsc.vn·
Warning: New attack campaign utilized a new 0-day RCE vulnerability on Microsoft Exchange Server