Cyber Morning Call

[Referências do Episódio] - Microsoft August 2023 Patch Tuesday warns of 2 zero-days, 87 flaws - https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2023-patch-tuesday-warns-of-2-zero-days-87-flaws/ - Security update available for Adobe Commerce | APSB23-42 - https://helpx.adobe.com/security/products/magento/apsb23-42.html  - Security update available for Adobe Acrobat and Reader  | A...

[Referências do Episódio] - Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile Engineering Company - https://www.sentinelone.com/labs/comrades-in-arms-north-korea-compromises-sanctioned-russian-missile-engineering-company/  - Yashma Ransomware, Tracing the Chaos Family Tree - https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree - New threat ac...

[Referências do Episódio] - CVE-2023-39143: PaperCut Path Traversal/File Upload RCE Vulnerability - https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/ - Reptile Malware Targeting Linux Systems - https://asec.ahnlab.com/en/55785/ - ICMP Shell (ISH) - https://icmpshell.sourceforge.net/#:~:text=ICMP%20Shell%20(ISH)%20is%20a,C%20for%20the%20UNIX%20environment...

[Referências do Episódio] - 2022 Top Routinely Exploited Vulnerabilities - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a - 「Royal」と似た挙動を行う新たなランサムウェア「BlackSuit」を分析 - https://www.trendmicro.com/ja_jp/research/23/h/investigating-blacksuit-ransomwares-similarities-to-royal.html  - Malicious Apps Use Sneaky Versioning Technique to Bypass Google Play Store...

[Referências do Episódio] - Over 640 Citrix servers backdoored with web shells in ongoing attacks - https://www.bleepingcomputer.com/news/security/over-640-citrix-servers-backdoored-with-web-shells-in-ongoing-attacks/ - Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures - https://thehackernews.com/2023/08/russian-cyber-adversary-bluecharlie.html  - BlueCharlie, Pr...

[Referências do Episódio] - Google AMP – The Newest of Evasive Phishing Tactic - https://cofense.com/blog/google-amp-the-newest-of-evasive-phishing-tactic/ - Cado Security Labs Encounter Novel Malware, Redis P2Pinfect - https://www.cadosecurity.com/redis-p2pinfect/ - Report: Ransomware Command-and-Control Providers Unmasked by Halcyon Researchers - https://www.halcyon.ai/blog/report-ransomware-com...

[Referências do Episódio] - Sliver C2 Being Distributed Through Korean Program Development Company - https://asec.ahnlab.com/en/55652/ - Three Years Later: The Meow Campaign Reaches Jupyter - https://blog.aquasec.com/three-years-later-the-meow-campaign-reaches-jupyter - ESTRATÉGIA DE CIBERSEGURANÇA DOS EUA: OS PILARES PARA ENFRENTAR O TEMPESTUOSO MAR DA INTERNET - https://www.opeu.org.br/2023/04/0...

[Referências do Episódio] - CISA Releases Malware Analysis Reports on Barracuda Backdoors - https://www.cisa.gov/news-events/alerts/2023/07/28/cisa-releases-malware-analysis-reports-barracuda-backdoors - CVE-2023-35081 - Remote Arbitrary File Write - https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US - Linux version of Abyss Locker ransomware targets VMware ESXi...

[Referências do Episódio] - Zimbra patches zero-day vulnerability exploited in XSS attacks - https://www.bleepingcomputer.com/news/security/zimbra-patches-zero-day-vulnerability-exploited-in-xss-attacks/ - Preventing Web Application Access Control Abuse - https://www.cisa.gov/sites/default/files/2023-07/aa23-208a_joint_csa_preventing_web_application_access_control_abuse.pdf  - GameOver(lay): Easy-...

[Referências do Episódio] - Into the tank with Nitrogen - https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/ - Fake Blockchain Games Deliver RedLine Stealer & Realst Stealer - A New macOS Infostealer Malware - https://iamdeadlyz.gitbook.io/malware-research/july-2023/fake-blockchain-games-deliver-redline-stealer-and-realst-stealer-a-new-macos-infostealer-malware - Apple Crime...

[Referências do Episódio] - BREAKING DOWN THE CASBANEIRO INFECTION CHAIN – PART II - https://blog.sygnia.co/breaking-down-casbaneiro-infection-chain-part2 - How User Account Control works - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works - UAC Bypass – Fodhelper - https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/...

[Referências do Episódio] - About the security content of iOS 16.6 and iPadOS 16.6 - https://support.apple.com/en-ca/HT213841 - About the security content of macOS Ventura 13.5 - https://support.apple.com/en-us/HT213843 - FortiGuard Labs Discovers Multiple Vulnerabilities in Microsoft Message Queuing Service - https://www.fortinet.com/blog/threat-research/microsoft-message-queuing-service-vulnerab...

[Referências do Episódio] - Thread da Shadowserver sobre o volume de máquinas vulneráveis à CVE-2023-3519 - https://twitter.com/Shadowserver/status/1682355280317919233?s=20 - Ransom Monetization Rates Fall to Record Low Despite Jump In Average Ransom Payments - https://www.coveware.com/blog/2023/7/21/ransom-monetization-rates-fall-to-record-low-despite-jump-in-average-ransom-payments - Threat Grou...

[Referências do Episódio] - Bad ad fad leads to IcedID, Gozi infections - https://news.sophos.com/en-us/2023/07/20/bad-ad-fad-leads-to-icedid-gozi-infections/ - Qualys Security Advisory - CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent - https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt - OpenSSH Security - July 19, 2023 - https://www.o...

[Referências do Episódio] - P2PInfect: The Rusty Peer-to-Peer Self-Replicating Worm - https://unit42.paloaltonetworks.com/peer-to-peer-worm-p2pinfect/    - Lookout Attributes Advanced Android Surveillanceware to Chinese Espionage Group APT41 - https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41    - Comprehensive analysis of initial attack samples exploitin...

[Referências do Episódio] - Citrix ADC and Citrix Gateway Security Bulletin for CVE-2023-3519, CVE-2023-3466, CVE-2023-3467 - https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467 - Bad. Build: A Critical Privilege Escalation Design Flaw in Google Cloud Build Enables a Supply Chain Attack - https://orca.security/resourc...

[Referências do Episódio] - Massive Targeted Exploit Campaign Against WooCommerce Payments Underway - https://www.wordfence.com/blog/2023/07/massive-targeted-exploit-campaign-against-woocommerce-payments-underway/ - Active Exploitation of Multiple Adobe ColdFusion Vulnerabilities - https://www.rapid7.com/blog/post/2023/07/17/etr-active-exploitation-of-multiple-adobe-coldfusion-vulnerabilities/ - C...

[Referências do Episódio] - Vm2 Security Advisories - https://github.com/patriksimek/vm2/security/advisories - vm2 - Project Discontinued - https://github.com/patriksimek/vm2 - isolated-vm -- Access to multiple isolates in nodejs - https://www.npmjs.com/package/isolated-vm - Analysis of Storm-0558 techniques for unauthorized email access - https://www.microsoft.com/en-us/security/blog/2023/07/14/a...

[Referências do Episódio] - Urgent Security Notice: SonicWall GMS/Analytics Impacted by suite of vulnerabilities - https://www.sonicwall.com/support/product-notification/urgent-security-notice-sonicwall-gms-analytics-impacted-by-suite-of-vulnerabilities/230710150218060/  - PoC Exploit: Fake Proof of Concept with Backdoor Malware - https://www.uptycs.com/blog/new-poc-exploit-backdoor-malware - Dipl...

[Referências do Episódio] - Microsoft July 2023 Patch Tuesday warns of 6 zero-days, 132 flaws - https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2023-patch-tuesday-warns-of-6-zero-days-132-flaws/ - Storm-0978 attacks reveal financial and espionage motives - https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/ - Fortinet -...

[Referências do Episódio] - About the security content of Safari 16.5.2 - https://support.apple.com/en-us/HT213826 - About the security content of Rapid Security Responses for iOS 16.5.1 and iPadOS 16.5.1 - https://support.apple.com/en-us/HT213823 - VMware - VMSA-2023-0007.1 - https://www.vmware.com/security/advisories/VMSA-2023-0007.html - RomCom hackers target NATO Summit attendees in phishing a...

[Referências do Episódio] - Tailing Big Head Ransomware’s Variants, Tactics, and Impact - https://www.trendmicro.com/en_us/research/23/g/tailing-big-head-ransomware-variants-tactics-and-impact.html - Three new MOVEit bugs spur CISA warning as more victims report breaches - https://therecord.media/three-new-moveit-bugs-spur-cisa-warning - Distribution of NetSupport Malware Using Email - https://ase...

[Referências do Episódio] - Boletim de segurança do Android - julho de 2023 - https://source.android.com/docs/security/bulletin/2023-07-01?hl=pt-br - Cisco ACI Multi-Site CloudSec Encryption Information Disclosure Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX - Threat Alert: Anatomy of Silentbob’s Cloud Attack - htt...

[Referências do Episódio] - StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability - https://github.com/lrh2000/StackRot - Merge branch 'expand-stack' - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9471f1f2f50282b9e8f59198ec6bb738b4ccc009  - New tool exploits Microsoft Teams bug to send malware to users - https://www.bleepingcomputer.com/...

[Referências do Episódio] - CHINESE THREAT ACTORS TARGETING EUROPE IN SMUGX CAMPAIGN - https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/ - Neo_Net | The Kingpin of Spanish eCrime - https://www.sentinelone.com/blog/neo_net-the-kingpin-of-spanish-ecrime/ - 69% Fortigate Firewalls Vulnerable CVE-2023-27997 Exploitable - https://bishopfox.com/blog/cve-2023-...