Cyber Morning Call

[Referências do Episódio] Take my money: OCR crypto stealers in Google Play and App Store - https://securelist.com/sparkcat-stealer-in-app-store-and-google-play/115385/  ThreatMon on X:A New Hannibal Stealer Shared” - https://x.com/MonThreat/status/1887121738229600582 Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

[Referências do Episódio] 8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur - https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/  CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks - https://www.trendmicro.com/en_us/research/25/a/cve-2025-0411-ukrainian-organizations-ta...

[Referências do Episódio] Malicious packages deepseek and deepseekai published in Python Package Index - https://www.google.com/url?q=https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/malicious-packages-deepseeek-and-deepseekai-published-in-python-package-index&sa=D&source=docs&ust=1738667193797493&usg=AOvVaw3E9BNcNdMeT3UO3xeP4Sgr  Coral Jasmine on X - https://x.co...

[Referências do Episódio] WhatsApp says journalists and civil society members were target of Israeli spyware  - https://www.theguardian.com/technology/2025/jan/31/whatsapp-israel-spyware  How scammers are exploiting DeepSeek’s rise - https://www.welivesecurity.com/en/cybersecurity/scammers-exploiting-deepseek-hype/ Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arru...

[Referências do Episódio] Coyote Banking Trojan: A Stealthy Attack via LNK files  - https://www.fortinet.com/blog/threat-research/coyote-banking-trojan-a-stealthy-attack-via-lnk-files No need to RSVP: a closer look at the Tria Stealer campaign - https://securelist.com/tria-stealer-collects-sms-data-from-android-devices/115295/ HTTP Client Tools Exploitation for Account Takeover Attacks - https://w...

[Referências do Episódio] Operation Phantom Circuit: North Korea’s Global Data Exfiltration Campaign  - https://securityscorecard.com/blog/operation-phantom-circuit-north-koreas-global-data-exfiltration-campaign/ Devil-Traff: A New Bulk SMS Platform Driving Phishing Campaigns - https://slashnext.com/blog/devil-traff-a-new-bulk-sms-platform-driving-phishing-campaigns/ FBI seizes Cracked.io, Nulled....

[Referências do Episódio] New TorNet backdoor seen in widespread campaign - https://blog.talosintelligence.com/new-tornet-backdoor-campaign/ Security Brief: Threat Actors Take Taxes Into Account - https://www.proofpoint.com/us/blog/threat-insight/security-brief-threat-actors-take-taxes-account Critical Vulnerabilities in Node.js Expose Systems to Remote Attacks - https://cyble.com/blog/critical-vu...

para preencher

[Referências do Episódio] Tempest analisa suposto ataque contra AWS Amazon pelo grupo GD LockerSec  Exploit Me, Baby, One More Time: Command Injection in Kubernetes Log Query - https://www.akamai.com/blog/security-research/2025/jan/2024-january-kubernetes-log-query-rce-windows [Security Advisory] CVE-2024-9042: Command Injection affecting Windows nodes via nodes/*/logs/query API - https://discuss....

[Referências do Episódio] TLP Black, minha newsletter - https://tlpblack.substack.com/   Product Notice: Urgent Security Notification - SMA 1000 - https://www.sonicwall.com/support/knowledge-base/product-notice-urgent-security-notification-sma-1000/250120090802840   Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications - https://www.cisa.gov/sites/default/files/2025-01/aa25-02...

[Referências do Episódio] Targeted supply chain attack against Chrome browser extensions - https://blog.sekoia.io/targeted-supply-chain-attack-against-chrome-browser-extensions/   ClamAV OLE2 File Format Decryption Denial of Service Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA   Cisco BroadWorks SIP Denial of Service Vu...

[Referências do Episódio] Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” - https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/ Mass Campaign of Murdoc Botnet Mirai: A New Variant of Corona Mirai - https://blog.qualys.com/vulnerabilities-threat-research/2025/01/21/mass-campaign-...

[Referências do Episódio] Love and hate under war: The GamaCopy organization, which imitates the Russian Gamaredon, uses military — related bait to launch attacks on Russia - https://medium.com/@knownsec404team/love-and-hate-under-war-the-gamacopy-organization-which-imitates-the-russian-gamaredon-uses-560ba5e633fa   Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arr...

[Referências do Episódio] Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise - https://home.treasury.gov/news/press-releases/jy2792   ANDROID MALWARE IN DONOT APT OPERATIONS - https://www.cyfirma.com/research/android-malware-in-donot-apt-operations/   Critical Flaws in WGS-804HPT Switches Enable RCE and Network Exploitation - https://thehackernew...

[Referências do Episódio] New Star Blizzard spear-phishing campaign targets WhatsApp accounts - https://www.microsoft.com/en-us/security/blog/2025/01/16/new-star-blizzard-spear-phishing-campaign-targets-whatsapp-accounts/   Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344 - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/    Snea...

[Referências do Episódio] Hackers leak configs and VPN credentials for 15,000 FortiGate devices - https://www.bleepingcomputer.com/news/security/hackers-leak-configs-and-vpn-credentials-for-15-000-fortigate-devices/   2022 zero day was used to raid Fortigate firewall configs. Somebody just released them. - https://doublepulsar.com/2022-zero-day-was-used-to-raid-fortigate-firewall-configs-somebody-...

[Referências do Episódio] Atualizações de Segurança de janeiro de 2025 - https://msrc.microsoft.com/update-guide/releaseNote/2025-Jan   Microsoft January 2025 Patch Tuesday fixes 8 zero-days, 159 flaws - https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2025-patch-tuesday-fixes-8-zero-days-159-flaws/   January 14, 2025—KB5049981 (OS Builds 19044.5371 and 19045.5371) - https://suppo...

[Referências do Episódio] TLP Black - https://tlpblack.substack.com/p/n-1-tufoes-na-america-do-norte   Abusing AWS Native Services: Ransomware Encrypting S3 Buckets with SSE-C - https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c   Analyzing CVE-2024-44243, a macOS System Integrity Protection bypass through kernel extensions - https://www.microsoft.c...

[Referências do Episódio] FunkSec – Alleged Top Ransomware Group Powered by AI - https://research.checkpoint.com/2025/funksec-alleged-top-ransomware-group-powered-by-ai/   Google Project Zero Researcher Uncovers Zero-Click Exploit Targeting Samsung Devices - https://thehackernews.com/2025/01/google-project-zero-researcher-uncovers.html   Transaction Simulation Spoofing: A New Threat in Web3 - http...

[Referências do Episódio] Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain - https://www.recordedfuture.com/research/reddelta-chinese-state-sponsored-group-targets-mongolia-taiwan-southeast-asia   Banshee: The Stealer That “Stole Code” From MacOS XProtect - https://research.checkpoint.com/2025/banshee-macos-stealer-that-stole-code-fr...

[Referências do Episódio] Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283) - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US   Security Update: Ivanti Connect Secure, Policy Secure and Neurons for ZTA Gateways - https://www.ivanti.com/blog/securi...

[Referências do Episódio] Android Security Bulletin January 2025 - https://source.android.com/docs/security/bulletin/2025-01-01 MediaTek reveals host of security vulnerabilities, so patch now - https://www.techradar.com/pro/security/mediatek-reveals-host-of-security-vulnerabilities-so-patch-now Genetic Engineering Meets Reverse Engineering: DNA Sequencer's Vulnerable BIOS - https://eclypsium.com/b...

[Referências do Episódio] Gayfemboy：一个利用四信工业路由0DAY传播的僵尸网络 - https://blog.xlab.qianxin.com/gayfemboy/   Moxa Alerts Users to High-Severity Vulnerabilities in Cellular and Secure Routers - https://thehackernews.com/2025/01/moxa-alerts-users-to-high-severity.html   CISA Update on Treasury Breach - https://www.cisa.gov/news-events/news/cisa-update-treasury-breach   Nota de faleciment...

[Referências do Episódio] LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49113 - https://www.safebreach.com/blog/ldapnightmare-safebreach-labs-publishes-first-proof-of-concept-exploit-for-cve-2024-49113/   Breaking the Chain: Wiz Uncovers a Signature Verification Bypass in Nuclei, the Popular Vulnerability Scanner (CVE-2024-43405) - https://www.wiz.io/blog/nuc...

[Referências do Episódio] NonEuclid Remote Access Trojan - https://www.cyfirma.com/research/noneclid-rat/   HIGH: Vulnerable POP3 Report - https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-report/   Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia