Cyber Morning Call

[Referências do Episódio] Chinese State-Sponsored RedJuliett Intensifies Taiwanese Cyber Espionage via Network Perimeter Exploitation - https://www.recordedfuture.com/redjuliett-intensifies-taiwanese-cyber-espionage-via-network-perimeter Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations - https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-202...

[Referências do Episódio] SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques - https://blog.talosintelligence.com/sneakychef-sugarghost-rat/   Unveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and Asia - https://blog.talosintelligence.com/new-spicerat-sneakychef/   Sustained Campaign Using Chinese Espionage Tools Targets Telcos - http...

[Referências do Episódio] UEFICANHAZBUFFEROVERFLOW: WIDESPREAD IMPACT FROM VULNERABILITY IN POPULAR PC AND SERVER FIRMWARE - https://eclypsium.com/blog/ueficanhazbufferoverflow-widespread-impact-from-vulnerability-in-popular-pc-and-server-firmware/   SolarWinds Serv-U path traversal flaw actively exploited in attacks - https://www.bleepingcomputer.com/news/security/solarwinds-serv-u-path-traversal...

[Referências do Episódio] É HOJE!!!!   TURING DAY 2024 - https://www.even3.com.br/tempest-turing-day-2024/ LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations - https://cybersecurity.att.com/blogs/labs-research/highly-evasive-squidloader-targets-chinese-organizations   AN UNPATCHED BUG ALLOWS ANYONE TO IMPERSONATE MICROSOFT CORPORATE EMAIL ACCOUNTS - https://securit...

[Referências do Episódio] TURING DAY 2024 - https://www.even3.com.br/tempest-turing-day-2024/ Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework - https://www.trendmicro.com/en_us/research/24/f/behind-the-great-wall-void-arachne-targets-chinese-speaking-user.html   虫潮降临：Zergeca僵尸网络分析报告 - https://blog.xlab.qianxin.com/the-swarm-awake...

[Referências do Episódio] TURING DAY 2024 - https://www.even3.com.br/tempest-turing-day-2024/ China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence - https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/   VMSA-2024-0012:VMware vCenter Server updates address heap-overflow and privilege escalation vulnerabilities (CVE-2024-37079, CVE-2024-37080, CVE-2024-37081) -...

[Referências do Episódio] TURING DAY 2024 - https://www.even3.com.br/tempest-turing-day-2024/ From Clipboard to Compromise: A PowerShell Self-Pwn - https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn   CVE-2024-3080 - ASUS 路由器 - Improper Authentication - https://www.twcert.org.tw/tw/cp-132-7859-0e104-1.html   CVE-2024-3912 - ASUS 路由器 - Upload arbitrary...

[Referências do Episódio] TURING DAY 2024 - https://www.even3.com.br/tempest-turing-day-2024/ There Are No Secrets || Exploiting Veeam CVE-2024-29855 - https://summoning.team/blog/veeam-recovery-orchestrator-auth-bypass-cve-2024-29855/   UNC3944 Targets SaaS Applications - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications/   Operation Celestial Force employ...

[Referências do Episódio] TURING DAY 2024 - https://www.even3.com.br/tempest-turing-day-2024/ Insights on Cyber Threats Targeting Users and Enterprises in Brazil - https://cloud.google.com/blog/topics/threat-intelligence/cyber-threats-targeting-brazil/   Ransomware Attackers May Have Used Privilege Escalation Vulnerability as Zero-day - https://symantec-enterprise-blogs.security.com/threat-intelli...

[Referências do Episódio] June 2024 Security Updates - https://msrc.microsoft.com/update-guide/releaseNote/2024-Jun   ARM ZERO-DAY IN MALI GPU DRIVERS ACTIVELY EXPLOITED IN THE WILD - https://securityaffairs.com/164430/hacking/arm-zero-day-actively-exploited.html   CVE-2024-23110 - Multiple buffer overflows in diag npu command - https://fortiguard.fortinet.com/psirt/FG-IR-23-460   You’ve Got Mail:...

[Referências do Episódio] TURING DAY 2024 - https://www.even3.com.br/tempest-turing-day-2024/ UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion - https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion/   CVE-2024-29849 - https://github.com/sinsinology/CVE-2024-29849?tab=readme-ov-file  

[Referências do Episódio] New Agent Tesla Campaign Targeting Spanish-Speaking People - https://www.fortinet.com/blog/threat-research/new-agent-tesla-campaign-targeting-spanish-speaking-people Microsoft rolls back ‘dumbest cybersecurity move in a decade’ - https://cyberscoop.com/microsoft-rolls-back-dumbest-cybersecurity-move-in-a-decade/   Stealing everything you’ve ever typed or viewed on your ow...

[Referências do Episódio] Howling at the Inbox: Sticky Werewolf’s Latest Malicious Aviation Attacks - https://blog.morphisec.com/sticky-werewolfs-aviation-attacks New Gitloker attacks wipe GitHub repos in extortion scheme - https://www.bleepingcomputer.com/news/security/new-gitloker-attacks-wipe-github-repos-in-extortion-scheme/#google_vignette Commando Cat: A Novel Cryptojacking Attack Abusing Do...

[Referências do Episódio] TargetCompany’s Linux Variant Targets ESXi Environments - https://www.trendmicro.com/en_us/research/24/f/targetcompany-s-linux-variant-targets-esxi-environments.html   RansomHub: New Ransomware has Origins in Older Knight - https://symantec-enterprise-blogs.security.com/threat-intelligence/ransomhub-knight-ransomware   DarkGate switches up its tactics with new payload, em...

[Referências do Episódio] Threat Actors’ Systems Can Also Be Exposed and Used by Other Threat Actors - https://asec.ahnlab.com/en/66372/   Cybercriminals Attack Banking Customers In EU With V3B Phishing Kit - https://www.resecurity.com/blog/article/cybercriminals-attack-banking-customers-in-eu-with-v3b-phishing-kit   UNC1151 Strikes Again: Unveiling Their Tactics Against Ukraine’s Ministry of Defe...

[Referências do Episódio] DarkGate again but... Improved? - https://www.trellix.com/blogs/research/darkgate-again-but-improved/   Hacking Millions of Modems (and Investigating Who Hacked My Modem) - https://samcurry.net/hacking-millions-of-modems   Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools - https://cloud.google.com/blog/topics/...

[Referências do Episódio] New banking trojan “CarnavalHeist” targets Brazil with overlay attacks - https://blog.talosintelligence.com/new-banking-trojan-carnavalheist-targets-brazil/   LilacSquid: The stealthy trilogy of PurpleInk, InkBox and InkLoader - https://blog.talosintelligence.com/lilacsquid/   Disrupting FlyingYeti's campaign targeting Ukraine - https://blog.cloudflare.com/disrupting-...

[Referências do Episódio] Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks - https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/   Kiteshield Packer is Being Abused by Linux Cyber Threat Actors - https://blog.xlab.qianxin.com/kiteshield_packer_is_being_abused_by_linux_cyber_threat_a...

[Referências do Episódio] Security Advisory: Remote Command Execution on TP-Link Archer C5400X - https://onekey.com/blog/security-advisory-remote-command-execution-on-tp-link-archer-c5400x/   Important Security Update – Enhance your VPN Security Posture! - https://blog.checkpoint.com/security/enhance-your-vpn-security-posture   Preventative Measure Tool to enhance VPN Security Posture - https://su...

[Referências do Episódio] Google fixes eighth actively exploited Chrome zero-day this year - https://www.bleepingcomputer.com/news/security/google-fixes-eighth-actively-exploited-chrome-zero-day-this-year/   The Rust Revolution: New Embargo Ransomware Steps In - https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/   Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intr...

[Referências do Episódio] Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia - https://unit42.paloaltonetworks.com/operation-diplomatic-specter/ SHARP DRAGON EXPANDS TOWARDS AFRICA AND THE CARIBBEAN - https://research.checkpoint.com/2024/sharp-dragon-expands-towards-africa-and-the-carib...

[Referências do Episódio] Deep Dive Into Unfading Sea Haze: A New Threat Actor in the South China Sea - https://www.bitdefender.com/blog/businessinsights/deep-dive-into-unfading-sea-haze-a-new-threat-actor-in-the-south-china-sea/ IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders - https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espi...

[Referências do Episódio] Fórum da Internet do Brasil - MAIS UMA VÍTIMA NÃO: Tecnologias digitais como forma de promoção e proteção de defensores de direitos humanos no Brasil - https://forumdainternet.cgi.br/agenda/3056 Critical GitHub Enterprise Server Flaw Allows Authentication Bypass - https://thehackernews.com/2024/05/critical-github-enterprise-server-flaw.html Enabling encrypted assertions -...

[Referências do Episódio] Grandoreiro banking trojan unleashed: X-Force observing emerging global ca mpaigns - https://securityintelligence.com/x-force/grandoreiro-banking-trojan-unleashed/ BAD KARMA, NO JUSTICE: VOID MANTICORE DESTRUCTIVE ACTIVITIES IN ISRAEL - https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel/ Master of Puppets: Uncovering...

[Referências do Episódio] Springtail: New Linux Backdoor Added to Toolkit - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/springtail-kimsuky-backdoor-espionage Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID - https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio:...