Cyber Morning Call

[Referências do Episódio] Star Blizzard increases sophistication and evasion in ongoing attacks - https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/  Hi, My Name Is Keyboard - https://github.com/skysafe/reblog/tree/main/cve-2023-45866  Spoofing DNS Records by Abusing DHCP DNS Dynamic Updates - https://www.akamai.com/blog/...

[Referências do Episódio] Curse of the Krasue: New Linux Remote Access Trojan targets Thailand - https://www.group-ib.com/blog/krasue-rat/ By the same token: How adversaries infiltrate AWS cloud accounts - https://redcanary.com/blog/aws-sts/ Getting gooey with GULOADER: deobfuscating the downloader - https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader  Roteiro e apresentaçã...

[Referências do Episódio] Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-339a TA422’s Dedicated Exploitation Loop—the Same Week After Week - https://www.proofpoint.com/us/blog/threat-insight/ta422s-dedicated-exploitation-loop-same-week-after-week  Beware of predatory fin(tech): Loan sha...

[Referências do Episódio] P2Pinfect - New Variant Targets MIPS Devices - https://www.cadosecurity.com/p2pinfect-new-variant-targets-mips-devices/  Boletim de segurança do Android – dezembro de 2023 - https://source.android.com/docs/security/bulletin/2023-12-01?hl=pt  POL Cyber Command has observed malicious activity against Microsoft Exchange servers - https://www.wojsko-polskie.pl/woc/articles/ak...

[Referências do Episódio] New Tool Set Found Used Against Organizations in the Middle East, Africa and the US - https://unit42.paloaltonetworks.com/new-toolset-targets-middle-east-africa-usa/  Microsoft Warns of Malvertising Scheme Spreading CACTUS Ransomware - https://thehackernews.com/2023/12/microsoft-warns-of-malvertising-scheme.html  HUMAN Satori Threat Intelligence Alert: Account Takeover At...

[Referências do Episódio] About the security content of iOS 17.1.2 and iPadOS 17.1.2 - https://support.apple.com/en-us/HT214031  Zyxel security advisory for authentication bypass and command injection vulnerabilities in NAS products - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products ...

[Referências do Episódio] Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency - https://home.treasury.gov/news/press-releases/jy1933  Zoom Vulnerability Allowed Hackers to Take Over Meetings, Steal Data - https://www.hackread.com/zoom-vulnerability-hackers-hijack-meetings-data/  New BLUFFS attack lets attackers hijack Bluetooth connections - https://www.bleepingcomputer.co...

[Referências do Episódio] Chrome Releases - Stable Channel Update for Desktop - Tuesday, November 28, 2023 - https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html CVE-2023-49103: ownCloud Critical Vulnerability Quickly Exploited in the Wild - https://www.greynoise.io/blog/cve-2023-49103-owncloud-critical-vulnerability-quickly-exploited-in-the-wild  DeleFriend: Sev...

[Referências do Episódio] DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads - https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/ Elastic catches DPRK passing out KANDYKORN - https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn BlueNoroff APT group targets macOS with ‘RustBucket...

[Referências do Episódio] DPRK state-linked cyber actors conduct software supply chain attacks - https://www.documentcloud.org/documents/24174869-rok-uk-joint-cyber-security-advisoryeng Guidelines for secure AI system development - https://www.ncsc.gov.uk/files/Guidelines-for-secure-AI-system-development.pdf  Roteiro e apresentação: Carlos Cabral Edição de áudio: Paulo Arruzzo Narração de encerram...

[Referências do Episódio] $19 Stanley cup deal is a Black Friday scam - https://www.malwarebytes.com/blog/news/2023/11/19-stanley-cup-deal-is-a-black-friday-scam ISRAEL-HAMAS WAR SPOTLIGHT: SHAKING THE RUST OFF SYSJOKER - https://research.checkpoint.com/2023/israel-hamas-war-spotlight-shaking-the-rust-off-sysjoker/ Telekopye: Chamber of Neanderthals’ secrets - https://www.welivesecurity.com/en/ese...

[Referências do Episódio] Diamond Sleet supply chain compromise distributes a modified CyberLink installer - https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/ New botnet malware exploits two zero-days to infect NVRs and routers - https://www.bleepingcomputer.com/news/security/new-botnet-malware-exploits-two-ze...

[Referências do Episódio] #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a New "Agent Tesla" Variant: Unusual "ZPAQ" Archive Format Delivers Malware - https://www.gdatasoftware.com/blog/2023/11/37822-agent-tesla-zpaq Hacking Employers and Seeking Employment:...

[Referências do Episódio] Unveiling LummaC2 stealer’s novel Anti-Sandbox technique: Leveraging trigonometry for human behavior detection - https://outpost24.com/blog/lummac2-anti-sandbox-technique-trigonometry-human-detection/ MALWARE SPOTLIGHT – INTO THE TRASH: ANALYZING LITTERDRIFTER - https://research.checkpoint.com/2023/malware-spotlight-into-the-trash-analyzing-litterdrifter/ APT29 attacks em...

[Referências do Episódio]  Zimbra 0-day used to target international government organizations - https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/ Fortinet warns of critical command injection bug in FortiSIEM - https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-command-injection-bug-in-fortisiem/ Scattered Spider - h...

[Referências do Episódio] November 2023 Security Updates - https://msrc.microsoft.com/update-guide/releaseNote/2023-Nov Redundant Prefix Issue - ID 793262 - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/redundant-prefix-issue.html Citrix Hypervisor Security Bulletin for CVE-2023-23583 and CVE-2023-46835 - https://support.citrix.co...

[Referências do Episódio] CISA Adds Six Known Exploited Vulnerabilities to Catalog - https://www.cisa.gov/news-events/alerts/2023/11/13/cisa-adds-six-known-exploited-vulnerabilities-catalog #StopRansomware: Royal Ransomware - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a Ddostf DDoS Bot Malware Attacking MySQL Servers - https://asec.ahnlab.com/en/58878/  In-Depth Analysis of...

[Referências do Episódio] Bitter Pill: Third-Party Pharmaceutical Vendor Linked to Pharmacy and Health Clinic Cyberattack - https://www.huntress.com/blog/third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack BiBi Wiper Used in the Israel-Hamas War Now Runs on Windows - https://blogs.blackberry.com/en/2023/11/bibi-wiper-used-in-the-israel-hamas-war-now-runs-on-windows N...

[Referências do Episódio] Microsoft: SysAid zero-day flaw exploited in Clop ransomware attacks - https://www.bleepingcomputer.com/news/security/microsoft-sysaid-zero-day-flaw-exploited-in-clop-ransomware-attacks/ SysAid On-Prem Software CVE-2023-47246 Vulnerability - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification Hive Ransomware's Offspring: Hu...

[Referências do Episódio] Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology - https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology Warning Against Phobos Ransomware Distributed via Vulnerable RDP - https://asec.ahnlab.com/en/58753/ Python obfuscation traps - https://checkmarx.com/blog/python-obfuscation-traps/ Roteiro e...

[Referências do Episódio] BlueNoroff strikes again with new macOS malware - https://www.jamf.com/blog/bluenoroff-strikes-again-with-new-macos-malware/ Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware - https://www.group-ib.com/blog/farnetwork/ Chinese APT Targeting Cambodian Government - https://unit42.paloaltonetworks.com/chinese-apt-linked-to...

[Referências do Episódio] Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors - https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/  Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518 - https://www.rapid7.com/blog/post/2023/11/06/etr-rapid7-observed-exploitation-of-atlassian-confluence-cve-2023-22518/  CV...

[Referências do Episódio] Looney Tunables Vulnerability Exploited by Kinsing - https://blog.aquasec.com/loony-tunables-vulnerability-exploited-by-kinsing  WhatsApp spy mod spreads through Telegram, attacks Arabic-speaking users - https://securelist.com/spyware-whatsapp-mod/110984/  New Microsoft Exchange zero-days allow RCE, data theft attacks - https://www.bleepingcomputer.com/news/microsoft/new-...

[Referências do Episódio] CVE-2023-22518 - Improper Authorization Vulnerability In Confluence Data Center and Confluence Server - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-confluence-server-1311473907.html FROM ALBANIA TO THE MIDDLE EAST: THE SCARRED MANTICORE IS LISTENING - https://research.checkpoint.com/2023/from-...

[Referências do Episódio] - Three new NGINX ingress controller vulnerabilities reported and how they affect Kubernetes - https://www.armosec.io/blog/cve-2023-5043-nginx-ingress/ - K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747 - https://my.f5.com/manage/s/article/K000137353 - A cascade of compromise: unveiling Lazarus’ new campaign - htt...