Cyber Morning Call

[Referências do Episódio] - Malvertising Used as Entry Vector for BlackCat, Actors Also Leverage SpyBoy Terminator - https://www.trendmicro.com/en_us/research/23/f/malvertising-used-as-entry-vector-for-blackcat-actors-also-lever.html - PhonyC2: Revealing a New Malicious Command & Control Framework by MuddyWater - https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-contr...

[Referências do Episódio] - The DPRK strikes using a new variant of RUSTBUCKET - https://www.elastic.co/pt/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket - The Lazarus Hei$t Podcast - https://www.bbc.co.uk/programmes/w13xtvg9/episodes/downloads - The Lazarus Heist: From Hollywood to High Finance: Inside North Korea's Global Cyber War - https://www.amazon.com/Lazarus-Heist-Hollywo...

[Referências do Episódio] - 8Base Ransomware: A Heavy Hitting Player - https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html - 8Base Ransomware Spikes in Activity, Threatens U.S. and Brazilian Businesses - https://thehackernews.com/2023/06/8base-ransomware-spikes-in-activity.html - Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor - https://unit...

[Referências do Episódio] - Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution - https://www.securityjoes.com/post/process-mockingjay-echoing-rwx-in-userland-to-achieve-code-execution - 81% concerned about ChatGPT security and safety risks, Malwarebytes survey shows - https://www.malwarebytes.com/blog/news/2023/06/chatgpt  - Process Injection - https://attack.mitre.org/technique...

[Referências do Episódio] - Anatsa banking Trojan hits UK, US and DACH with new campaign - https://www.threatfabric.com/blogs/anatsa-hits-uk-and-dach-with-new-campaign - Malicious Actors Utilizing QR Codes to Deploy Phishing Pages to Mobile Devices - https://cofense.com/blog/malicious-actors-utilizing-qr-codes-to-deploy-phishing-pages-to-mobile-devices/  - Grafana security release: New versions of...

[Referências do Episódio] - FG-IR-23-074 - FortiNAC - java untrusted object deserialization RCE - https://www.fortiguard.com/psirt/FG-IR-23-074  - CWE-502: Deserialization of Untrusted Data - https://cwe.mitre.org/data/definitions/502.html  - An Overview of the Different Versions of the Trigona Ransomware - https://www.trendmicro.com/en_us/research/23/f/an-overview-of-the-trigona-ransomware.html -...

[Referências do Episódio] - Contas Laranja: o elo final da lavagem de dinheiro do cibercrime no Brasil - https://sidechannel.blog/contas-laranja-o-elo-final-da-lavagem-de-dinheiro-do-cibercrime-no-brasil/ - IoT devices and Linux-based systems targeted by OpenSSH trojan campaign - https://www.microsoft.com/en-us/security/blog/2023/06/22/iot-devices-and-linux-based-systems-targeted-by-openssh-trojan...

[Referências do Episódio] - Graphican: Flea Uses New Backdoor in Attacks Targeting Foreign Ministries - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/flea-backdoor-microsoft-graph-apt15  - Ransomware Redefined: RedEnergy Stealer-as-a-Ransomware attacks - https://www.zscaler.com/blogs/security-research/ransomware-redefined-redenergy-stealer-ransomware-attacks  - VMware -...

[Referências do Episódio] - Turing Day 2023 -  https://www.even3.com.br/turingday2023/ - ASUS Product Security Advisory - https://www.asus.com/content/asus-product-security-advisory/ - Inside of the WASP's nest: deep dive into PyPI-hosted malware - https://blog.virustotal.com/2023/06/inside-of-wasps-nest-deep-dive-into.html  - Rogue Android Apps Target Pakistani Individuals in Sophisticated Es...

[Referências do Episódio] - MOVEit Transfer and MOVEit Cloud Vulnerability - https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability  - Hijacking S3 Buckets: New Attack Technique Exploited in the Wild by Supply Chain Attackers  - https://checkmarx.com/blog/hijacking-s3-buckets-new-attack-technique-exploited-in-the-wild-by-supply-chain-attackers/ - Understanding Malware-as-...

[Referências do Episódio] - Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally - Warning: GravityRAT Android Trojan Steals WhatsApp Backups and Deletes Files - https://thehackernews.com/2023/06/warning-gravityrat-android-trojan.html - HP WOLF SEC...

[Referências do Episódio] - Cadet Blizzard emerges as a novel and distinct Russian threat actor - https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/ - Understanding Ransomware Threat Actors: LockBit - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a  - Fake Security Researcher GitHub Repositories Deliver...

[Referências do Episódio] - Microsoft June 2023 Patch Tuesday fixes 78 flaws, 38 RCE bugs - https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2023-patch-tuesday-fixes-78-flaws-38-rce-bugs/ - VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors - https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass - VMSA-...

[Referências do Episódio] - Analysis of CVE-2023-27997 and Clarifications on Volt Typhoon Campaign - https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign - Volt Typhoon targets US critical infrastructure with living-off-the-land techniques - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastr...

[Referências do Episódio] - Tweet de Charles Fol sobre a vulnerabilidade CVE-2023-27997 - https://twitter.com/cfreal_/status/1667852157536616451 - MOVEit Transfer Critical Vulnerability – CVE Pending Reserve Status (June 9, 2023) - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-CVE-Pending-Reserve-Status-June-9-2023 - STEALTH SOLDIER BACKDOOR USED IN TARGETED ESPIO...

[Referências do Episódio] - Outlook.com hit by outages as hacktivists claim DDoS attacks - https://www.bleepingcomputer.com/news/microsoft/outlookcom-hit-by-outages-as-hacktivists-claim-ddos-attacks/ - Anonymous Sudan: Threat Intelligence Report - https://files.truesec.com/hubfs/Reports/Anonymous%20Sudan%20-%20Publish%201.2%20-%20a%20Truesec%20Report.pdf - Malicious Actors Manipulating Photos and...

[Referências do Episódio] - Thread da Microsoft sobre ataques explorando a CVE-2023-34362 no MOVEit Transfer - https://twitter.com/MsftSecIntel/status/1665537730946670595 - MOVEit Transfer Critical Vulnerability (May 2023) - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023 - Announcing Windows 11 Insider Preview Build 25381 - https://blogs.windows.com/windo...

[Referências do Episódio] - North Korea Using Social Engineering to Enable Hacking of Think Tanks, Academia, and Media - https://media.defense.gov/2023/Jun/01/2003234055/-1/-1/0/JOINT_CSA_DPRK_SOCIAL_ENGINEERING.PDF - North Korean Advanced Persistent Threat Focus: Kimsuky - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a - New Magecart-Style Campaign Abusing Legitimate Websites...

[Referências do Episódio] - Operation Triangulation: iOS devices targeted with previously unknown malware - https://securelist.com/operation-triangulation/109842/ - New Horabot campaign targets the Americas - https://blog.talosintelligence.com/new-horabot-targets-americas/ - When byte code bites: Who checks the contents of compiled Python files? - https://www.reversinglabs.com/blog/when-python-byt...

[Referências do Episódio] - Tempest Vuln Watchlist - https://www.tempest.com.br/gerenciamento/threat-intelligence/vuln-watchlist/#contact - SUPPLY CHAIN RISK FROM GIGABYTE APP CENTER BACKDOOR - https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/ - Dark Pink. Episode 2 - https://www.group-ib.com/blog/dark-pink-episode-2/ - CISA Adds One Known Exploited Vulnerability to C...

[Referências do Episódio] - PixBankBot: New ATS-Based Malware Poses Threat to the Brazilian Banking Sector - https://blog.cyble.com/2023/05/30/pixbankbot-new-ats-based-malware-poses-threat-to-the-brazilian-banking-sector/ - New macOS vulnerability, Migraine, could bypass System Integrity Protection - https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-by...

[Referências do Episódio] - GobRAT malware written in Go language targeting Linux routers - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - DogeRAT: The Android Malware Campaign Targeting Users Across Multiple Industries - https://cloudsek.com/blog/dogerat-the-android-malware-campaign-targeting-users-across-multiple-industries [Ficha técnica] Apresentação: Carlos Cabral Roteiro: Carlos Cabral...

[Referências do Episódio] - New Info Stealer Bandit Stealer Targets Browsers, Wallets - https://www.trendmicro.com/en_us/research/23/e/new-info-stealer-bandit-stealer-targets-browsers-wallets.html - CISA adds recently patched Barracuda zero-day to its Known Exploited Vulnerabilities catalog - https://securityaffairs.com/146729/security/cisa-barracuda-0day-catalog.html - Barracuda identified a vuln...

[Referências do Episódio] - Operation Magalenha | Long-Running Campaign Pursues Portuguese Credentials and PII - https://www.sentinelone.com/labs/operation-magalenha-long-running-campaign-pursues-portuguese-credentials-and-pii/ - Volt Typhoon targets US critical infrastructure with living-off-the-land techniques - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-cri...

[Referências do Episódio] - Legion Update to attach SSH Servers - https://www.cadosecurity.com/updates-to-legion-a-cloud-credential-harvester-and-smtp-hijacker/ - Technical Analysis of Pikabot - https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot - Agrius Deploys Moneybird in attacks against israeli organizations - https://research.checkpoint.com/2023/agrius-deploys-moneybir...