Cyber Morning Call

[Referências do Episódio] Threat actors misusing Quick Assist in social engineering attacks leading to ransomware - https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/ To the Moon and back(doors): Lunar landing in diplomatic missions - https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-l...

[Referências do Episódio] Microsoft May 2024 Security Updates - https://msrc.microsoft.com/update-guide/releaseNote/2024-May CVE-2024-30040 - Windows MSHTML Platform Security Feature Bypass Vulnerability - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30040 CVE-2024-30051 - Windows DWM Core Library Elevation of Privilege Vulnerability - https://msrc.microsoft.com/update-guide/vuln...

[Referências do Episódio] Apple security releases - https://support.apple.com/en-us/HT201222 Stable Channel Update for Desktop - Monday, May 13, 2024 - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html Leveraging DNS Tunneling for Tracking and Scanning - https://unit42.paloaltonetworks.com/three-dns-tunneling-campaigns/#post-133492-_lgyxeg31r22j MITRE Unveils...

[Referências do Episódio] Mallox affiliate leverages PureCrypter in MS-SQL exploitation campaigns - https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/#h-identified-affiliates GoTo Meeting loads Remcos RAT via Rust Shellcode Loader - https://www.gdatasoftware.com/blog/2024/05/37906-gotomeeting-loads-remcos Malicious Go Binary Delivered...

[Referências do Episódio] Stable Channel Update for Desktop - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html APT28 campaign targeting Polish government institutions - https://cert.pl/en/posts/2024/05/apt28-campaign/ Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

[Referências do Episódio] BIG VULNERABILITIES IN NEXT-GEN BIG-IP - https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/ Talos discloses multiple zero-day vulnerabilities, two of which could lead to code execution - https://blog.talosintelligence.com/vulnerability-roundup-zero-days-may-8-2024/ RemcosRAT Distributed Using Steganography - https://asec.ahnlab.com/en/65111/ Roteiro e apre...

[Referências do Episódio] United States International Cyberspace & Digital Policy Strategy - https://www.state.gov/united-states-international-cyberspace-and-digital-policy-strategy/?utm_source=newsletter&utm_medium=email&utm_campaign=newsletter_axioscodebook&stream=top zEus Stealer Distributed via Crafted Minecraft Source Pack - https://www.fortinet.com/blog/threat-research/zeus-stealer-distribut...

[Referências do Episódio] Zscaler ThreatLabz 2024 VPN Risk Report with Cybersecurity Insiders - https://www.zscaler.com/campaign/threatlabz-vpn-risk-report TunnelVision (CVE-2024-3661): How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak - https://www.leviathansecurity.com/blog/tunnelvision Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narraçã...

[Referências do Episódio] Cyberangriffe auf die SPD und auf Rüstungs-, IT- und Luftfahrt­unternehmen sind APT 28 und damit dem russischen Militär­geheim­dienst GRU zuzuordnen - https://www.bmi.bund.de/SharedDocs/pressemitteilungen/DE/2024/05/aktuelle-Cyberangriffe.html Statement of the MFA on the Cyberattacks Carried by Russian Actor APT28 on Czechia - https://mzv.gov.cz/jnp/en/issues_and_press/pr...

[Referências do Episódio] “Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps - https://www.microsoft.com/en-us/security/blog/2024/05/01/dirty-stream-attack-discovering-and-mitigating-a-common-vulnerability-pattern-in-android-apps/ HPE Aruba Networking Product Security Advisory - Advisory ID: ARUBA-PSA-2024-004 - https://www.arubanetworks.com/assets/ale...

[Referências do Episódio] Eight Arms to Hold You: The Cuttlefish Malware - https://blog.lumen.com/eight-arms-to-hold-you-the-cuttlefish-malware/ JFrog Security research discovers coordinated attacks on Docker Hub that planted millions of malicious repositories - https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/ DEFENDING OT OPERATIO...

[Referências do Episódio] Zloader Learns Old Tricks - https://www.zscaler.com/blogs/security-research/zloader-learns-old-tricks MUDDLING MEERKAT: THE GREAT FIREWALL MANIPULATOR- https://blogs.infoblox.com/threat-intelligence/a-cunning-operator-muddling-meerkat-and-chinas-great-firewall/ Smart devices: new law helps citizens to choose secure products - https://www.ncsc.gov.uk/blog-post/smart-device...

[Referências do Episódio] How to Block Residential Proxies using Okta - https://sec.okta.com/blockanonymizers Cisco warns of large-scale brute-force attacks against VPN services - https://www.bleepingcomputer.com/news/security/cisco-warns-of-large-scale-brute-force-attacks-against-vpn-services/ Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encer...

[Referências do Episódio] Brokewell: do not go broke from new banking malware! - https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware WP Automatic WordPress plugin hit by millions of SQL injections attacks - https://www.bleepingcomputer.com/news/security/wp-automatic-wordpress-plugin-hit-by-millions-of-sql-injection-attacks/#google_vignette CVE-2024-2389: Command Inj...

[Referências do Episódio] ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/ Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability - https://sec.cloudapps.cisco.com/security/center...

[Referências do Episódio] Suspected CoralRaider continues to expand victimology using three information stealers - https://blog.talosintelligence.com/suspected-coralraider-continues-to-expand-victimology-using-three-information-stealers/ GuptiMiner: Hijacking Antivirus Updates for Distributing Backdoors and Casual Mining - https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-fo...

[Referências do Episódio] Sistema de pagamentos do governo é invadido, e há suspeita de desvio de recursos - https://www1.folha.uol.com.br/mercado/2024/04/sistema-de-pagamentos-do-governo-e-invadido-e-ha-suspeita-de-desvio-de-recursos.shtml Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials - https://www.microsoft.com/en-us/security/blog/202...

[Referências do Episódio] More on the PAN-OS CVE-2024-3400 - https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/ Diagrama da Fundação ShadowServer sobre a CVE-2024-3400 - https://dashboard.shadowserver.org/statistics/combined/map/?map_type=std&day=2024-04-18&source=http_vulnerable&source=http_vulnerable6&tag=possible-cve-2024-3400%2B&geo=all&data_set=count&scale=log GitHub commen...

[Referências do Episódio] Threat Group FIN7 Targets the U.S. Automotive Industry - https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry DuneQuixote campaign targets Middle Eastern entities with “CR4T” malware - https://securelist.com/dunequixote/112425/ #StopRansomware: Akira Ransomware - https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomwar...

[Referências do Episódio] Unearthing APT44: Russia’s Notorious Cyber Sabotage Unit Sandworm - https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm Ivanti fixed two critical flaws in its Avalanche MDM - https://securityaffairs.com/161952/security/ivanti-avalanche-mdm-critical-flaws.html Cisco warns of large-scale brute-force attacks against VPN services - https://www.b...

[Referências do Episódio] - Exploit released for Palo Alto PAN-OS bug used in attacks, patch now - https://www.bleepingcomputer.com/news/security/exploit-released-for-palo-alto-pan-os-bug-used-in-attacks-patch-now/#google_vignette   - LeackyCLI: AWS and Google Cloud Command-Line Tools Can Expose Sensitive Credentials in Build Logs - https://orca.security/resources/blog/leakycli-aws-google-cloud-co...

[Referências do Episódio] SteganoAmor campaign: TA558 mass-attacking companies and public institutions all around the world - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/steganoamor-campaign-ta558-mass-attacking-companies-and-public-institutions-all-around-the-world/#id0 From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering - https://www.proofpoint....

[Referências do Episódio] Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) - https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect - https://security.paloaltonetworks.co...

CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect Gateway - https://security.paloaltonetworks.com/CVE-2024-3400

[Referências do Episódio] Entendendo operações de ransomware-as-a-service a partir da perspectiva de um afiliado - https://www.sidechannel.blog/entendendo-operacoes-de-ransomware-as-a-service-a-partir-da-perspectiva-de-um-afiliado/ Security Brief: TA547 Targets German Organizations with Rhadamanthys Stealer - https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-org...