Cyber Morning Call

[Referências do Episódio] - Fileless Remote Code Execution on Juniper Firewalls - https://vulncheck.com/blog/juniper-cve-2023-36845  - 38TB of data accidentally exposed by Microsoft AI researchers - https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers - Microsoft mitigated exposure of internal information in a storage account due to overly-permissiv...

[Referências do Episódio] - TEMPEST TALKS 2023 - https://www.tempest.com.br/tempest_talk/tempest-talks-2023/ - BlackCat ransomware hits Azure Storage with Sphynx encryptor - https://www.bleepingcomputer.com/news/security/blackcat-ransomware-hits-azure-storage-with-sphynx-encryptor/  - Cybercriminals Combine Phishing and EV Certificates to Deliver Ransomware Payloads - https://thehackernews.com/202...

[Referências do Episódio] - TEMPEST TALKS 2023 - https://www.tempest.com.br/tempest_talk/tempest-talks-2023/ - Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety - https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware  - Windows 11 ‘ThemeBleed’ RCE bug gets proof-of-concept exploit - https://www.ble...

[Referências do Episódio] - TEMPEST TALKS 2023 - https://www.tempest.com.br/tempest_talk/tempest-talks-2023/ - Can't Be Contained: Finding a Command Injection Vulnerability in Kubernetes - https://www.akamai.com/blog/security-research/kubernetes-critical-vulnerability-command-injection - [Security Advisory] CVE-2023-3676: Insufficient input sanitization on Windows nodes leads to privilege esca...

[Referências do Episódio] - TEMPEST TALKS 2023 - https://www.tempest.com.br/tempest_talk/tempest-talks-2023/ - Atualizações de segurança de setembro de 2023 - https://msrc.microsoft.com/update-guide/releaseNote/2023-Sep - Security update available for Adobe Acrobat and Reader  | APSB23-34 - https://helpx.adobe.com/security/products/acrobat/apsb23-34.html - Persistent Threat: New Exploit Puts Thous...

[Referências do Episódio] - TEMPEST TALKS 2023 - https://www.tempest.com.br/tempest_talk/tempest-talks-2023/ - Sponsor with batch-filed whiskers: Ballistic Bobcat’s scan and strike backdoor - https://www.welivesecurity.com/en/eset-research/sponsor-batch-filed-whiskers-ballistic-bobcats-scan-strike-backdoor/ - Iran’s Hacker Hierarchy Exposed - https://web.archive.org/web/20220411033921/https://www....

[Referências do Episódio] - TEMPEST TALKS 2023 - https://www.tempest.com.br/tempest_talk/tempest-talks-2023/  - BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild - https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/    - About the security content of iOS 16.6.1 and iPadOS 16.6.1 - https://support.apple.com/en-us/HT2...

[Referências do Episódio] - THREAT PROFILE CHAE$ 4 MALWARE - https://www.morphisec.com/hubfs/Morphisec_Chae$4_Threat_Profile.pdf - ASUS ROUTERS ARE AFFECTED BY THREE CRITICAL REMOTE CODE EXECUTION FLAWS - https://securityaffairs.com/150399/iot/asus-routers-critical-rces.html - Bogus URL Shorteners Go Mobile-Only in AdSense Fraud Campaign - https://blog.sucuri.net/2023/09/bogus-url-shorteners-go-mo...

[Referências do Episódio] - New Attack Vector In The Cloud: Attackers caught exploiting Object Storage Services - https://www.securityjoes.com/post/new-attack-vector-in-the-cloud-attackers-caught-exploiting-object-storage-services Roteiro e apresentação: Carlos Cabral  Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia

[Referências do Episódio] - VMWare Aria Operations For Networks Static SSH Key RCECVE-2023-34039 - https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/ - SOCIAL ENGINEERING ATTACKS TARGET OKTA CUSTOMERS TO ACHIEVE A HIGHLY PRIVILEGED ROLE - https://securityaffairs.com/150237/hacking/social-engineering-attacks-on-okta-customers.html - Novel RAT discovered “SuperBear” targ...

[Referências do Episódio] - Group-IB detects Classiscam expansion: $64.5 million scam-as-a-service operation targets 251 brands in 79 countries - https://www.group-ib.com/media-center/press-releases/classiscam-2023/ - VMConnect supply chain attack continues, evidence points to North Korea - https://www.reversinglabs.com/blog/vmconnect-supply-chain-campaign-continues  - SapphireStealer: Open-source...

[Referências do Episódio] - 2023-08 Out-of-Cycle Security Bulletin: Junos OS: SRX Series and EX Series: Multiple vulnerabilities in J-Web can be combined to allow a preAuth Remote Code Execution - https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execu...

[Referências do Episódio] - FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown - https://www.fbi.gov/news/stories/fbi-partners-dismantle-qakbot-infrastructure-in-multinational-cyber-takedown  - Kinsing Malware Exploits Novel Openfire Vulnerability - https://blog.aquasec.com/kinsing-malware-exploits-novel-openfire-vulnerability - VMware VMSA-2023-0018 - https://www.vmware...

[Referências do Episódio] - MalDoc in PDF - Detection bypass by embedding a malicious Word file into a PDF file - https://blogs.jpcert.or.jp/en/2023/08/maldocinpdf.html - olevba - https://github.com/decalage2/oletools/wiki/olevba - Phishing-as-a-Service Gets Smarter: Microsoft Sounds Alarm on AiTM Attacks - https://thehackernews.com/2023/08/phishing-as-service-gets-smarter.html - Thread da Microso...

[Referências do Episódio] - Lockbit leak, research opportunities on tools leaked from TAs - https://securelist.com/lockbit-ransomware-builder-analysis/110370/ - Microsoft: Stealthy Flax Typhoon hackers use LOLBins to evade detection - https://www.bleepingcomputer.com/news/security/microsoft-stealthy-flax-typhoon-hackers-use-lolbins-to-evade-detection/ - Flax Typhoon using legitimate software to qu...

[Referências do Episódio] - Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT - https://blog.talosintelligence.com/lazarus-quiterat/ - Lazarus Group's infrastructure reuse leads to discovery of new malware - https://blog.talosintelligence.com/lazarus-collectionrat/  - SMOKE LOADER DROPS WHIFFY RECON WI-FI SCANNING AND GEOLOCATION MALWARE - https://www.secureworks.com/blog/sm...

[Referências do Episódio] - Traders' Dollars in Danger: CVE-2023-38831 zero-Day vulnerability in WinRAR exploited by cybercriminals to target traders - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ - Time keeps on slippin’ slippin’ slippin’: The 2023 Active Adversary Report for Tech Leaders - https://news.sophos.com/en-us/2023/08/23/active-adversary-for-tech-leaders/ - Exploita...

[Referências do Episódio] - Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/carderbee-software-supply-chain-certificate-abuse - Akira ransomware targets Cisco VPNs to breach organizations - https://www.bleepingcomputer.com/news/security/akira-ransomware-targets-cisco-vpns-to-breach...

[Referências do Episódio] - New Juniper Junos OS Flaws Expose Devices to Remote Attacks - Patch Now - https://thehackernews.com/2023/08/new-juniper-junos-os-flaws-expose.html - Patch now! Citrix Sharefile joins the list of actively exploited file sharing software - https://www.malwarebytes.com/blog/news/2023/08/citrix-sharefile-joins-list-of-vulnerabilities-in-file-sharing-software - WinRAR flaw e...

[Referências do Episódio] - Mass-spreading campaign targeting Zimbra users - https://www.welivesecurity.com/en/eset-research/mass-spreading-campaign-targeting-zimbra-users/ - Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector - https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/  - Fake Airplane Mode: A mobile tampering technique to main...

[Referências do Episódio] - ProxyNation: The dark nexus between proxy apps and malware - https://cybersecurity.att.com/blogs/labs-research/proxynation-the-dark-nexus-between-proxy-apps-and-malware - Major Energy Company Targeted in Large QR Code Campaign - https://cofense.com/blog/major-energy-company-targeted-in-large-qr-code-campaign/  - Hakuna Matata Ransomware Targeting Korean Companies - http...

[Referências do Episódio] - Approximately 2000 Citrix NetScalers backdoored in mass-exploitation campaign - https://research.nccgroup.com/2023/08/15/approximately-2000-citrix-netscalers-backdoored-in-mass-exploitation-campaign/ - Evasive Phishing Campaign Steals Cloud Credentials Using Cloudflare R2 and Turnstile - https://www.netskope.com/blog/evasive-phishing-campaign-steals-cloud-credentials-us...

[Referências do Episódio] - Monti Ransomware Unleashes a New Encryptor for Linux - https://www.trendmicro.com/en_us/research/23/h/monti-ransomware-unleashes-a-new-encryptor-for-linux.html - Unwanted Guests: Mitigating Remote Access Trojan Infection Risk - https://www.uptycs.com/blog/remote-access-trojan-qwixx-telegram - Sophisticated, Highly-Targeted Attacks Continue to Plague npm - https://blog.p...

[Referências do Episódio] - MoustachedBouncer: Espionage against foreign diplomats in Belarus - https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/ - Multiple Flaws in CyberPower and Dataprobe Products Put Data Centers at Risk - https://thehackernews.com/2023/08/multiple-flaws-in-cyberpower-and.html - 5 arrested in Poland for running bu...

[Referências do Episódio] - Attackers Distribute Malware via Freeze.rs And SYK Crypter - https://www.fortinet.com/blog/threat-research/malware-distributed-via-freezers-and-syk-crypter  - Cloud Account Takeover Campaign Leveraging EvilProxy Targets Top-Level Executives at over 100 Global Organizations - https://www.proofpoint.com/us/blog/email-and-cloud-threats/cloud-account-takeover-campaign-lever...