Cyber Morning Call

[Referências do Episódio] How the Sys:All Loolhole Allowed Us To Penetrate GKE in Production - https://orca.security/resources/blog/sys-all-google-kubernetes-engine-risk-example/ NSPX30: A sophisticated AitM-enabled implant evolving since 2005 - https://www.welivesecurity.com/en/eset-research/nspx30-sophisticated-aitm-enabled-implant-evolving-since-2005/ Roteiro e apresentação: Carlos Cabral e Bia...

[Referências do Episódio] Kasseika Ransomware Deploys BYOVD Attacks, Abuses PsExec and Exploits Martini Driver - https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware-deploys-byovd-attacks-abuses-psexec-and-expl.html CYBERCRIME CENTRAL: VEXTRIO OPERATES MASSIVE CRIMINAL AFFILIATE PROGRAM - https://blogs.infoblox.com/cyber-threat-intelligence/cybercrime-central-vextrio-operates-massive...

[Referências do Episódio] About the security content of iOS 17.3 and iPadOS 17.3 - https://support.apple.com/en-us/HT214059 Cracked software beats gold: new macOS backdoor stealing cryptowallets - https://securelist.com/new-macos-backdoor-crypto-stealer/111778/ ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals - https://www.sentinelone.com/labs/a-glimpse-in...

[Referências do Episódio] Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard - https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/ Chinese Espionage Group UNC3886 Found Exploiting CVE-2023-34048 Since Late 2021 - https://www.mandiant.com/resources/blog/chinese-vmware-exploitation-since-2021 Roteiro e apresentaç...

[Referências do Episódio] Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware - https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/  7777-Botnet Infection Vectors - https://vulncheck.com/blog/ip-intel-7777-botnet   Ivanti Connect Secure VPN Exploitation: New Observations - https://www.volexity.com/blog/2024/01...

[Referências do Episódio] New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/  LockBit Ransomware Distributed Via Word Files Disguised as Resumes - https://asec.ahn...

[Referências do Episódio] NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-6548 and CVE-2023-6549 - https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549  Chrome Releases: Stable Channel Update for Desktop - Tuesday, January 16, 2024 - https://chromereleases.googleblog.com/2024/01/stable-channel-update-f...

[Referências do Episódio] “MyFlaw” — Cross Platform 0-Day RCE Vulnerability Discovered in Opera’s Browser Guardio - https://labs.guard.io/myflaw-cross-platform-0-day-rce-vulnerability-discovered-in-operas-browsers-099361a808ab  CVE-2023-36025 Exploited for Defense Evasion in Phemedrone Stealer Campaign - https://www.trendmicro.com/en_us/research/24/a/cve-2023-36025-exploited-for-defense-evasion-in...

[Referências do Episódio] Remcos RAT Being Distributed via Webhards - https://asec.ahnlab.com/en/60270/  GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 - https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/  Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

[Referências do Episódio] KB CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways - https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US Active Exploitation of Two Zero-Day Vulnerabi...

[Referências do Episódio] China Says It Cracked Apple AirDrop to Identify Message Sources - https://www.bloomberg.com/news/articles/2024-01-09/china-says-cracked-apple-s-airdrop-to-identify-message-sources  司法鉴定：司法鉴定揭开“隔空投送”匿名传输的神秘面纱 - https://sfj.beijing.gov.cn/sfj/sfdt/ywdt82/flfw93/436331732/index.html  New decryptor for Babuk Tortilla ransomware variant released - https...

[Referências do Episódio] Sabotage in Iran: Een missie in duisternis - https://www.volkskrant.nl/kijkverder/v/2024/sabotage-in-iran-een-missie-in-duisternis~v989743/ Dutch man sabotaged Iranian nuclear program without Dutch government's knowledge: report - https://nltimes.nl/2024/01/08/dutch-man-sabotaged-iranian-nuclear-program-without-dutch-governments-knowledge-report Roteiro e apresentação...

[Referências do Episódio] Turkish espionage campaigns in the Netherlands - https://www.huntandhackett.com/blog/turkish-espionage-campaigns#tur5   The Tortoise and The Malwahare - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html  AsyncRAT loader: Obfuscation, DGAs, decoys and Govno - https://cybersecurity.att.com/blogs/labs-research/asyncrat-loade...

[Referências do Episódio]  Infostealer infection of an Orange employee results in BGP disruptions - https://www.infostealers.com/article/infostealer-infection-of-an-orange-employee-results-in-bgp-disruptions/  A “ridiculously weak“ password causes disaster for Spain’s No. 2 mobile carrier - https://arstechnica.com/security/2024/01/a-ridiculously-weak-password-causes-disaster-for-spains-no-2-mobile...

[Referências do Episódio] CISA warns federal agencies of exploited Google Chrome and open-source vulnerabilities - https://therecord.media/cisa-adds-chrome-open-source-bugs  Tweet da Shadowserver sobre máquinas vulneráveis ao Terrapin Attack - https://twitter.com/Shadowserver/status/1742482640815419653  INFO: Accessible SSH Report - https://www.shadowserver.org/what-we-do/network-reporting/accessi...

[Referências do Episódio] Operation Triangulation: What You Get When Attack iPhones of Researchers - https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers  Operation Triangulation: The last (hardware) mystery - https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/  Operation Triangulation - https://securelist.com/trng-2...

[Referências do Episódio] Tweets da Microsoft sobre ataques do APT33 com o FalseFont - https://twitter.com/MsftSecIntel/status/1737895710169628824  Threat Actor 'UAC-0099' Continues to Target Ukraine - https://www.deepinstinct.com/blog/threat-actor-uac-0099-continues-to-target-ukraine Lapsus$: GTA 6 hacker handed indefinite hospital order - https://www.bbc.com/news/technology-67663128   Ro...

[Referências do Episódio] Stable Channel Update for Desktop - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html  BKA und ZIT schalten Darknet-Plattform Kingdom Market - https://www.documentcloud.org/documents/24233774-pm231220_darknet_kingdom_market?responsive=1&title=1 Why Is an Australian Footballer Collecting My Passwords? The Various Ways Malicious Jav...

[Referências do Episódio] Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Variant - https://www.justice.gov/opa/pr/justice-department-disrupts-prolific-alphvblackcat-ransomware-variant  Post do vx-underground sobre a briga entre BlackCat e FBI - https://twitter.com/vxunderground/status/1737167608997097839  USD 300 million seized and 3,500 suspects arrested in international financial...

[Referências do Episódio] Mute the Sound: Chaining Vulnerabilities to Achieve RCE on Outlook: Pt 1 - https://www.akamai.com/blog/security-research/chaining-vulnerabilities-to-achieve-rce-part-one  Mute the Sound: Chaining Vulnerabilities to Achieve RCE on Outlook: Pt 2 - https://www.akamai.com/blog/security-research/chaining-vulnerabilities-to-achieve-rce-part-two  MongoDB Security Notice - https:...

[Referências do Episódio] Security Advisory: Disable your SQL Database Integrations - https://www.3cx.com/blog/news/sql-database-integration/  Exposing The Cyber-Extortion Trinity - BianLian, White Rabbit, And Mario Ransomware Gangs Spotted In A Joint Campaign - https://www.resecurity.com/blog/article/Exposing-Cyber-Extortion-Trinity-BianLian-White-Rabbit-Mario-Ransomware-Gangs-Spotted-Joint-Campa...

[Referências do Episódio] OilRig’s persistent attacks using cloud service-powered downloaders - https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/  Opening a Can of Whoop Ads: Detecting and Disrupting a Malvertising Campaign Distributing Backdoors - https://www.mandiant.com/resources/blog/detecting-disrupting-malvertising-backdoors Ace in t...

[Referências do Episódio] Malvertisers zoom in on cryptocurrencies and initial access - https://www.malwarebytes.com/blog/threat-intelligence/2023/12/malvertisers-zoom-in-on-cryptocurrencies-and-initial-access  BazarCall Attack Leverages Google Forms to Increase Perceived Credibility - https://abnormalsecurity.com/blog/bazarcall-attack-leverages-google-forms Hackers are exploiting critical Apache...

[Referências do Episódio] Atualizações de Segurança de dezembro de 2023 - https://msrc.microsoft.com/update-guide/releaseNote/2023-Dec   Speculative Leaks Security Notice - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7007.html  Threat actors misuse OAuth applications to automate financially driven attacks - https://www.microsoft.com/en-us/security/blog/2023/12/12/threat-actor...

[Referências do Episódio] China’s cyber army is invading critical U.S. services - https://www.washingtonpost.com/technology/2023/12/11/china-hacking-hawaii-pacific-taiwan-conflict/  Sandman APT | China-Based Adversaries Embrace Lua - https://www.sentinelone.com/labs/sandman-apt-china-based-adversaries-embrace-lua/ Making Order out of Chaos: How to Deal with Threat Group Names - Katie Nickels - htt...