Cyber Morning Call

[Referências do Episódio] New Banking Trojan “CHAVECLOAK” Targets Brazil - https://www.fortinet.com/blog/threat-research/banking-trojan-chavecloak-targets-brazil  Multistage RA World Ransomware Uses Anti-AV Tactics, Exploits GPO - https://www.trendmicro.com/en_us/research/24/c/multistage-ra-world-ransomware.html  BlackCat ransomware turns off servers amid claim they stole $22 million ransom - http...

[Referências do Episódio] CryptoChameleon: New Phishing Tactics Exhibited in FCC-Targeted Attack - https://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit  New Wave of SocGholish Infections Impersonates WordPress Plugins - https://blog.sucuri.net/2024/03/new-wave-of-socgholish-infections-impersonates-wordpress-plugins.html  The Art of Domain Deception: Bifrost's Ne...

[Referências do Episódio] Meet Silver SAML: Golden SAML in the Cloud - https://www.semperis.com/blog/meet-silver-saml/  #StopRansomware: Phobos Ransomware - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060a  Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b  Nort...

[Referências do Episódio] When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors - https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east  TimbreStealer campaign targets Mexican users with financial lures - https://blog.talosintelligence.com/timbrestealer-campaign-targets-mexican-users/  One year lat...

[Referências do Episódio] Threat Actor Groups, Including Black Basta, are Exploiting Recent ScreenConnect Vulnerabilities - https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html When Stealers Converge: New Variant of Atomic Stealer in the Wild - https://www.bitdefender.com/blog/labs/when-stealers-converge-new-variant-of-atomic-stealer-...

[Referências do Episódio] Analysis of Nood RAT Used in Attacks Against Linux (Gh0st RAT’s Variant) - https://asec.ahnlab.com/en/62144/ Unveiling UAC-0184: The Steganography Saga of the IDAT Loader Delivering RemcosRAT to a Ukraine Entity in Finland - https://blog.morphisec.com/unveiling-uac-0184-the-remcos-rat-steganography-saga SVR Cyber Actors Adapt Tactics for Initial Cloud Access - https://www...

[Referências do Episódio] PIKABOT, I choose you! - https://www.elastic.co/security-labs/pikabot-i-choose-you  LockBit Ransomware Group Resurfaces After Law Enforcement Takedown - https://thehackernews.com/2024/02/lockbit-ransomware-group-resurfaces.html  Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns - https://unit42.paloaltonetworks.com/i-soon-data-lea...

[Referências do Episódio] Details on Apple’s Shortcuts Vulnerability: A Deep Dive into CVE-2024-23204 - https://www.bitdefender.com/blog/labs/details-on-apples-shortcuts-vulnerability-a-deep-dive-into-cve-2024-23204/  VOLTZITE Threat Group’s Under the Radar Cyber Espionage on U.S. Critical Systems  - https://www.dragos.com/blog/voltzite-threat-group-under-the-radar-cyber-espionage-on-us-critical-s...

[Referências do Episódio] ConnectWise ScreenConnect 23.9.8 security fix - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8  A Catastrophe For Control: Understanding the ScreenConnect Authentication Bypass (CVE-2024-1709 & CVE-2024-1708) - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass  L...

[Referências do Episódio] International investigation disrupts the world’s most harmful cyber crime group - https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group  Cops turn LockBit's ransomware gang's countdown timers against them - https://www.theregister.com/2024/02/20/nca_lockbit_takedown/  Astaroth, Mekotio &amp...

[Referências do Episódio] Anatsa Trojan Returns: Targeting Europe and Expanding Its Reach - https://www.threatfabric.com/blogs/anatsa-trojan-returns-targeting-europe-and-expanding-its-reach  Adversarial Threat Report: Countering the Surveillance-for-Hire Industry & Influence Operations - https://z-p3-scontent.fcgh11-1.fna.fbcdn.net/v/t39.8562-6/428391559_3726563917669737_441724410168993669_n.p...

[Referências do Episódio] Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign - https://go.recordedfuture.com/hubfs/reports/cta-2024-0217.pdf  Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers - https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/  SolarWin...

[Referências do Episódio] Over 13,000 Ivanti gateways vulnerable to actively exploited bugs - https://www.bleepingcomputer.com/news/security/over-13-000-ivanti-gateways-vulnerable-to-actively-exploited-bugs/  Observed Scanning Activity for CVE-2024-22024 - XXE Vulnerability in Ivanti Products - https://www.akamai.com/blog/security-research/2024/feb/scanning-activity-ivanti-cve-february-2024  FLATL...

[Referências do Episódio] February 2024 Security Updates - https://msrc.microsoft.com/update-guide/releaseNote/2024-Feb CVE-2024-21412: Water Hydra Targets Traders With Microsoft Defender SmartScreen Zero-Day - https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html  Critical Exchange Server Flaw (CVE-2024-21410) Under Active Exploitatio...

[Referências do Episódio] New Zardoor backdoor targeting an Islamic organization - https://blog.talosintelligence.com/new-zardoor-backdoor/ CVE-2024-22024 (XXE) for Ivanti Connect Secure and Ivanti Policy Secure - https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US FortiOS - Out-of-bound Write in sslvpnd - https://fortiguard.fort...

[Referências do Episódio] RASPBERRY ROBIN KEEPS RIDING THE WAVE OF ENDLESS 1-DAYS - https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/ Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer - https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-steal...

[Referências do Episódio] ResumeLooters gang infects websites with XSS scripts and SQL injections to vacuum up job seekers’ personal data and CVs - https://www.group-ib.com/blog/resumelooters/ Critical Security Issue Affecting TeamCity On-Premises (CVE-2024-23917) - https://blog.jetbrains.com/teamcity/2024/02/critical-security-issue-affecting-teamcity-on-premises-cve-2024-23917/ Roteiro e apresent...

[Referências do Episódio] Python Info-stealer Distributed by Malicious Excel Document - https://www.fortinet.com/blog/threat-research/python-info-stealer-malicious-excel-document Exploring the (Not So) Secret Code of Black Hunt Ransomware - https://www.rapid7.com/blog/post/2024/02/05/exploring-the-not-so-secret-code-of-blackhunt-ransomware-2/ Roteiro e apresentação: Carlos Cabral e Bianca Oliveira...

[Referências do Episódio] “Água Curupira” em parceria com ransomware “Black Basta” lança ataque de spam usando malware “Pikabot” - https://www.trendmicro.com/ja_jp/research/24/b/a-look-into-pikabot-spam-wave-campaign.html Following The AnyDesk Incident: Customer Credentials Leaked And Published For Sale On The Dark Web - https://www.resecurity.com/blog/article/following-the-anydesk-incident-custom...

[Referências do Episódio] Frog4Shell - FritzFrog Botnet Adds One-Days to Its Arsenal - https://www.akamai.com/blog/security-research/fritzfrog-botnet-new-capabilities-log4shell Hacking Electronic Flight Bags. Airbus NAVBLUE Flysmart+Manager - https://www.pentestpartners.com/security-blog/hacking-electronic-flight-bags-airbus-navblue-flysmart-manager/ The Nine Lives of Commando Cat: Analysing a Nov...

[Referências do Episódio] CVE-2024-21888 Privilege Escalation for Ivanti Connect Secure and Ivanti Policy Secure - https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US How to steal crypto via DNS - https://www.kaspersky.com/blog/fake-macos-activator-steals-bitcoin-exodus-uses-dns/50361/ Pawn Storm Uses Brute Force...

[Referências do Episódio] Trigona Ransomware Threat Actor Uses Mimic Ransomware -  https://asec.ahnlab.com/en/61000/ ESET takes part in global operation to disrupt the Grandoreiro banking trojan - https://www.welivesecurity.com/en/eset-research/eset-takes-part-global-operation-disrupt-grandoreiro-banking-trojan/ New Mitigations to Defend Against Exploitation of Ivant Connect Secure and Policy Secu...

[Referências do Episódio] Buzzing on Christmas Eve: Trigona Ransomware in 3 Hours - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/ Microsoft Teams hit by second outage in three days - https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-hit-by-second-outage-in-three-days/#google_vignette Hundreds Of Network Operators’ Credentials Found Circu...

[Referências do Episódio] Excessive Expansion: Uncovering Critical Security Vulnerabilities in Jenkins - https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/ Eles destruíram o “planeta” inimigo - detalhes do ataque cibernético cntra o centro de hidrometeorologia espacial da Federação Russa - https://gur.gov.ua/content/znyshchyly-vorozhu-plan...

[Referências do Episódio] Cisco Unified Communications Products Remote Code Execution Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm MOSQUITO THE NEW INFOSTEALER ARRIVES TO MEXICO - https://www.metabaseq.com/mosquito-the-new-infoestelar-arrives-to-mexico/ Privacy Concerns about Apple Push Notifications - https://twitter.com/...