Cyber Morning Call

[Referências do Episódio] Social Media Malvertising Campaign Promotes Fake AI Editor Website for Credential Theft - https://www.trendmicro.com/en_us/research/24/h/malvertising-campaign-fake-ai-editor-website-credential-theft.html   Identifying a BOLA Vulnerability in Harbor, a Cloud-Native Container Registry - https://unit42.paloaltonetworks.com/bola-vulnerability-impacts-container-registry-harbor...

[Referências do Episódio] Beware the RAT: Android Remote Access malware strikes in Malaysia - https://www.group-ib.com/blog/craxs-rat-malaysia/   Mint Stealer: A Comprehensive Study of a Python-Based Information Stealer - https://www.cyfirma.com/research/mint-stealer-a-comprehensive-study-of-a-python-based-information-stealer/   Critical ServiceNow vulnerabilities being targeted by hackers, cyber...

[Referências do Episódio] - Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ - VMSA-2024-0013:VMware ESXi and vCenter Server updates address multiple security vulnerabilities (CVE-2024-37085, CVE-2024-37086, CVE-2024-37087) - https...

[Referências do Episódio] Malicious Python Package Targets macOS Developers To Access Their GCP Accounts - https://checkmarx.com/blog/malicious-python-package-targets-macos-developers-to-access-their-gcp-accounts/   Rafel RAT: A Pest Invading Droid Systems - https://www.bitdefender.com/blog/businessinsights/rafel-rat-a-pest-invading-droid-systems/   SeleniumGreed: Threat actors exploit exposed Sel...

[Referências do Episódio] APT45: North Korea’s Digital Military Machine - https://cloud.google.com/blog/topics/threat-intelligence/apt45-north-korea-digital-military-machine/   North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs - https://www.cisa.gov/sites/default/files/2024-07/aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.p...

[Referências do Episódio] Polícia descobre central que funcionava como unidade móvel de golpes - https://globoplay.globo.com/v/12781788/   Ataque hacker em plataforma do governo afeta sistemas de nove ministérios e dois órgãos - https://folha.com/hg5ytlkn   Docker Security Advisory: AuthZ Plugin Bypass Regression in Docker Engine - https://www.docker.com/blog/docker-security-advisory-docker-engine...

[Referências do Episódio] Daggerfly: Espionage Group Makes Major Update to Toolset - https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset   Exploiting CVE-2024-21412: A Stealer Campaign Unleashed - https://www.fortinet.com/blog/threat-research/exploiting-cve-2024-21412-stealer-campaign-unleashed   CVE-2024-21412 - Internet Shortcut Files Security F...

[Referências do Episódio] Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android - https://www.welivesecurity.com/en/eset-research/cursed-tapes-exploiting-evilvideo-vulnerability-telegram-android/   Solving the 7777 Botnet enigma: A cybersecurity quest - https://blog.sekoia.io/solving-the-7777-botnet-enigma-a-cybersecurity-quest/   VIGORISH VIPER: A VENOMOUS BET - https://ins...

[Referências do Episódio] REMEDIATION AND GUIDANCE HUB: FALCON CONTENT UPDATE FOR WINDOWS HOSTS - https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/   Fake CrowdStrike fixes target companies with malware, data wipers - https://www.bleepingcomputer.com/news/security/fake-crowdstrike-fixes-target-companies-with-malware-data-wipers/   Threat Actors Exploit Recent CrowdStr...

[Referências do Episódio] SolarWinds Security Vulnerabilities - https://www.solarwinds.com/trust-center/security-advisories   SAPwned: SAP AI vulnerabilities expose customers’ cloud environments and private AI artifacts - https://www.wiz.io/blog/sapwned-sap-ai-vulnerabilities-ai-security   SAPwned: SAP AI vulnerabilities expose customers’ cloud environments and private AI artifacts - https://www.w...

[Referências do Episódio] Cisco Smart Software Manager On-Prem Password Change Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-auth-sLw3uhUy   Cisco Secure Email Gateway Arbitrary File Write Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-bGG2UsjH   FIN7 Reboot | Cybercrime Ga...

[Referências do Episódio] Scattered Spider Adopts RansomHub and Qilin Ransomware for Cyber Attacks - https://thehackernews.com/2024/07/scattered-spider-adopts-ransomhub-and.html   Qilin Revisited: Diving into the techniques and procedures of the recent Qilin Ransomware Attacks - https://www.group-ib.com/blog/qilin-revisited/   Satori Threat Intelligence Alert: Konfety Spreads ‘Evil Twin’ Apps for...

[Referências do Episódio] CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks - https://www.trendmicro.com/en_us/research/24/g/CVE-2024-38112-void-banshee.html   NEW BUGSLEEP BACKDOOR DEPLOYED IN RECENT MUDDYWATER CAMPAIGNS - https://research.checkpoint.com/2024/new-bugsleep-backdoor-deployed-in-recent-muddywater-campaigns/   MuddyWater replaces...

[Referências do Episódio] CRITICAL FLAW IN EXIM MTA COULD ALLOW TO DELIVER MALWARE TO USERS’ INBOXES - https://securityaffairs.com/165649/hacking/critical-flaw-exim-mta.html   Fake Microsoft Teams for Mac delivers Atomic Stealer - https://www.malwarebytes.com/blog/threat-intelligence/2024/07/fake-microsoft-teams-for-mac-delivers-atomic-stealer   Braodo Info Stealer Targeting Vietnam and Abroad - h...

[Referências do Episódio] DodgeBox: A deep dive into the updated arsenal of APT41 | Part  - https://www.zscaler.com/blogs/security-research/dodgebox-deep-dive-updated-arsenal-apt41-part-1   'Chupa-cabra' e infiltrado: como hackers deram dano milionário ao INSS - https://www.uol.com.br/tilt/noticias/redacao/2023/07/12/chupa-cabra-e-infiltrado-como-hackers-deram-dano-milionario-ao-inss.htm C...

[Referências do Episódio] DarkGate: Dancing the Samba With Alluring Excel Files - https://unit42.paloaltonetworks.com/darkgate-malware-uses-excel-files/   New Malware Campaign Targeting Spanish Language Victims - https://cofense.com/blog/new-malware-campaign-targeting-spanish-language-victims/   Asia's SMS stealers: 1,000 bots and one study - https://www.ptsecurity.com/ww-en/analytics/pt-esc-t...

[Referências do Episódio] Microsoft and Adobe Patch Tuesday, July 2024 Security Update Review - https://blog.qualys.com/vulnerabilities-threat-research/2024/07/09/microsoft-patch-tuesday-july-2024-security-update-review   RESURRECTING INTERNET EXPLORER: THREAT ACTORS USING ZERO-DAY TRICKS IN INTERNET SHORTCUT FILE TO LURE VICTIMS (CVE-2024-38112) - https://research.checkpoint.com/2024/resurrecting...

[Referências do Episódio] Decrypted: DoNex Ransomware and its Predecessors - https://decoded.avast.io/threatresearch/decrypted-donex-ransomware-and-its-predecessors/   CloudSorcerer – A new APT targeting Russian government entities - https://securelist.com/cloudsorcerer-new-apt-cloud-actor/113056/   Kematian-Stealer : A Deep Dive into a New Information Stealer - https://www.cyfirma.com/research/ke...

[Referências do Episódio] Kimsuky Group’s New Backdoor Appears (HappyDoor) - https://asec.ahnlab.com/en/67660/   Turning Jenkins Into a Cryptomining Machine From an Attacker's Perspective - https://www.trendmicro.com/en_us/research/24/g/turning-jenkins-into-a-cryptomining-machine-from-an-attackers-pe.html   Cloudflare 1.1.1.1 incident on June 27, 2024 - https://blog.cloudflare.com/cloudflare-1...

[Referências do Episódio] Mekotio Banking Trojan Threatens Financial Systems in Latin America - https://www.trendmicro.com/en_us/research/24/g/mekotio-banking-trojan.html   Eldorado Ransomware: The New Golden Empire of Cybercrime? - https://www.group-ib.com/blog/eldorado-ransomware/   Mallox Ransomware Variant Targets Linux: Decryptor Discovered - https://www.uptycs.com/blog/mallox-ransomware-linu...

[Referências do Episódio] regreSSHion: Remote Unauthenticated Code Execution Vulnerability in OpenSSH server - https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server   China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigatio...

[Referências do Episódio] 2024-06: Out-Of-Cycle Security Bulletin: Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed (CVE-2024-2973) - https://supportportal.juniper.net/s/article/2024-06-Out-Of-Cycle-Security-Bulletin-Session-Smart-Router-SSR-On-redundant-router-deployments-API-authentication-can-be-bypassed-CVE-2024-2973?language=en_US   June 27, 2024 A...

[Referências do Episódio] Kimsuky deploys TRANSLATEXT to target South Korean academia - https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia   MerkSpy: Exploiting CVE-2021-40444 to Infiltrate Systems - https://www.fortinet.com/blog/threat-research/merkspy-exploiting-cve-2021-40444-to-infiltrate-systems   TeamViewer IT security update - https://ww...

[Referências do Episódio] Auth. Bypass In (Un)Limited Scenarios - Progress MOVEit Transfer (CVE-2024-5806) - https://labs.watchtowr.com/auth-bypass-in-un-limited-scenarios-progress-moveit-transfer-cve-2024-5806/   Fortra FileCatalyst Workflow Unauthenticated SQLi - https://www.tenable.com/security/research/tra-2024-25   Multiple vulnerabilities in TP-Link Omada system could lead to root access - h...

[Referências do Episódio] From Dormant to Dangerous: P2Pinfect Evolves to Deploy New Ransomware and Cryptominer - https://www.cadosecurity.com/blog/from-dormant-to-dangerous-p2pinfect-evolves-to-deploy-new-ransomware-and-cryptominer   New attack uses MSC files and Windows XSS flaw to breach networks - https://www.bleepingcomputer.com/news/security/new-grimresource-attack-uses-msc-files-and-windows...