Cyber Morning Call

Referências do Episódio Earth Kurma APT Campaign Targets Southeast Asian Government, Telecom Sectors io_uring Is Back , This Time as a Rootkit Fire In The Hole, We’re Breaching The Vault - Commvault Remote Code Execution ( CVE-2025-34028 ) Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio M-Trends 2025 : Data, Insights, and Recommendations From the Frontlines 2025 Data Breach Investigations Report Distribution of PebbleDash Malware in March 2025 Operation SyncHole : Lazarus APT goes back to the well Russian Infrastructure Plays Crucial Role in North Korean Cybercrime Operations LACNIC 43 BsidesSP Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição...

Referências do Episódio Ripple's xrpl.js npm Package Backdoored to Steal Private Keys XRP supply chain attack : Official NPM package infected with crypto stealing backdoor NFC Fraud Wave: Evolution of Ghost Tap on the Dark Web Phishing for Codes : Russian Threat Actors Target Microsoft 365 OAuth Workflows Cookie-Bite : How Your Digital Crumbs Let Threat Actors Bypass MFA and Maintain Access to...

Referências do Episódio SOC Tempest com Google SecOps CVE-2025-32433: Erlang/OTP SSH Unauthenticated Remote Code Execution Vulnerability Billbug : Intrusion Campaign Against Southeast Asia Continues Detecting Multi-Stage Infection Chains Madness SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation Phishing attacks leveraging HTML code inside SVG files Roteiro e apresentação:...

Referências do Episódio CVE-2025-24054 , NTLM exploit in the wild About Apple Security Updates CISA adds One Known Exploited Vulnerability to Catalog Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio Renewed APT29 Phishing Campaign Against European Diplomats UNC5174’s evolution in China’s ongoing cyber warfare: From SNOWLIGHT to VShell CrazyHunter Campaign Targets Taiwanese Critical Sectors Threat actors misuse Node.js to deliver malware and other malicious payloads The CVE program for tracking security flaws is about to lose federal funding Roteiro e apresentação: Carl...

Referências do Episódio BPFDoor’s Hidden Controller Used Against Asia, Middle East Targets Cyber Threats 2021 :A Year in Retrospect Red Menshen (a.k.a. Earth Bluecrow) CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild Waiting Thread Hijacking : A Stealthier Version of Thread Execution Hijacking New Malware Variant Identified: ResolverRAT Enters the Ma...

Referências do Episódio Palo Alto warns of brute-force login attempts on PAN-OS GlobalProtect gateways indicating possible upcoming attacks Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio Unraveling the U.S. toll road smishing scams Smishing Triad : Chinese eCrime Group Targets 121+ Countries, Intros New Banking Phishing Kit Shuckworm Targets Foreign Military Mission Based in Ukraine Analysis of Threat Actor Activity CVE-2022-42475 - Heap-based buffer overflow in sslvpnd CVE-2023-27997 - Heap buffer overflow in sslvpn pre-authentication CVE-2024-21762 - Out-...

Referências do Episódio AkiraBot | AI-Powered Bot Bypasses CAPTCHAs, Spams Websites At Scale - https://www.sentinelone.com/labs/akirabot-ai-powered-bot-bypasses-captchas-spams-websites-at-scale/   Operation Endgame follow-up leads to five detentions and interrogations as well as server takedowns - https://www.europol.europa.eu/media-press/newsroom/news/operation-endgame-follow-leads-to-five-detent...

Referências do Episódio April 2025 Security Updates - https://msrc.microsoft.com/update-guide/releaseNote/2025-Apr   Microsoft’s April 2025 Patch Tuesday Addresses 121 CVEs (CVE-2025-29824) Exploitation of CLFS zero-day leads to ransomware activity PipeMagic Trojan Exploits Windows Zero-Day Vulnerability to Deploy Ransomware Security updates available for Adobe ColdFusion | APSB25-15 CVE-2024-4888...

Referências do Episódio Android Security Bulletin— April 2025   Google fixes Android zero-days exploited in attacks, 60 other flaws How ToddyCat tried to hide behind AV software Windows Remote Desktop Protocol: Remote to Rogue Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio SOC Tempest com Google SecOps Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads Analyzing the BeaverTail Infostealer NEPTUNE RAT : An advanced Windows RAT with System Destruction Capabilities and Password Exfiltration from 270+ Applications WinRAR flaw bypasses Windows Mark of the Web security alerts Roteiro e apresentação: C...

Referências do Episódio April Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways ( CVE-2025-22457 ) Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability ( CVE-2025-22457 ) Critical Flaw in Apache Parquet Allows Remote Attackers to Execute Arbitrary Code Critical RCE Vulnerability in Apache Parquet ( CVE-2025-30065 ) – Advisory a...

Referências do Episódio Tomcat in the Crosshairs: New Research Reveals Ongoing Attacks CVE-2025-24813 Detail Stripe API Skimming Campaign: Additional Victims and Insights RolandSkimmer : Silent Credit Card Thief Uncovered Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio Nearly 24,000 IPs Target PAN-OS GlobalProtect in Coordinated Login Scan Campaign Surge in Palo Alto Networks Scanner Activity Indicates Possible Upcoming Threats DPRK IT Workers Expanding in Scope and Scale Fourteen North Korean Nationals Indicted for Carrying Out Multi-Year Fraudulent Information Technology Worker Scheme and Related Extortions CrushFTP CVE-2025-2825 flaw a...

Referências do Episódio From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic The Espionage Toolkit of Earth Alux : A Closer Look at its Advanced Techniques Operation HollowQuill : Malware delivered into Russian R&D Networks via Research Decoy PDFs Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Ga...

Referências do Episódio Security Vulnerability fixed in Firefox 136.0.4, Firefox ESR 128.8.1, Firefox ESR 115.21.1 The Shelby Strategy SUN:DOWN – Destabilizing the Grid via Orchestrated Exploitation of Solar Power Systems Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio RedCurl's Ransomware Debut : A Technical Deep Dive You will always remember this as the day you finally caught FamousSparrow Inside Atlantis AIO : Credential Stuffing Across 140+ Platforms CoffeeLoader : A Brew of Stealthy Techniques Malware found on npm infecting local package with reverse shell Blasting Past Webp:An analysis of the NSO BLASTPASS iMessage exploit Rotei...

Referências do Episódio CVE-2025-2783 Operation ForumTroll : APT attack with Google Chrome zero-day exploit chain CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin EncryptHub linked to MMC zero-day attacks on Windows systems CVE-2025-22230 The Curious Case of PlayBoy Locker Amid Reports of Worldwide Reboots, GreyNoise Observes In-the-Wild Activity Against DrayTek Routers Rasp...

Referências do Episódio IngressNightmare : 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX Critical flaw in Next.js lets hackers bypass authorization New Phishing Campaign Uses Browser-in-the-Browser Attacks to Target Video Gamers/Counter-Strike 2 Players Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerrame...

Referências do Episódio Weaver Ant , the Web Shell Whisperer: Tracking a Live China-nexus Operation VanHelsing , new RaaS in Town Oracle denies breach after hacker claims theft of 6 million data records Série de tweets da Microsoft sobre nova campanha do Latrodectus Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio Critical Cisco Smart Licensing Utility flaws now exploited in attacks Cisco Smart Licensing Utility Vulnerabilities ( CVE-2024-20439 e CVE-2024-20440 ) CVE-2025-23120 By Executive Order, We Are Banning Blacklists - Domain-Level RCE in Veeam Backup & Replication (CVE-2025-23120) RansomHub : Attackers Leverage New Custom Backdoor Unboxing Anubis: Exploring the Stealthy Ta...

Referências do Episódio Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations Arcane stealer : We want all your data Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

Referências do Episódio /bin/live da Mente Binária ZDI-CAN-25373 : Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns CISA Warns of Active Exploitation in GitHub Action Supply Chain Compromise Operation AkaiRyū : MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de en...