Cyber Morning Call

[Referências do Episódio] - Meet the GoldenJackal APT group. Don’t expect any howls - https://securelist.com/goldenjackal-apt-group/109677/ - Android app breaking bad: From legitimate screen recording to file exfiltration within a year - https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/ - Lazarus Group Targeting Windows IIS Web Server...

[Referências do Episódio] - BlackCat Ransomware Deploys New Signed Kernel Driver - https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html - CLOUD-BASED MALWARE DELIVERY: THE EVOLUTION OF GULOADER - https://research.checkpoint.com/2023/cloud-based-malware-delivery-the-evolution-of-guloader/ - CISA Adds Three Known Exploited Vulnerabilities to Catalo...

[Referências do Episódio] - PyPI new user and new project registrations temporarily suspended: Incident Report for Python Infrastructure - https://status.python.org/incidents/qy2t9mjjcc7g - Phishing attacks already using the .zip TLD - https://news.netcraft.com/archives/2023/05/17/phishing-attacks-already-using-the-zip-tld.html - KeePass 2.X Master Password Dumper (CVE-2023-32784) - https://github...

[Referências do Episódio] - About the security content of iOS 16.5 and iPadOS 16.5 - https://support.apple.com/en-us/HT213757 - Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices - https://www.trendmicro.com/en_us/research/23/e/lemon-group-cybercriminal-businesses-built-on-preinfected-devices.html - PSA: Attackers Actively Exploiting Critical Vulnerability in Essential Addons for...

[Referências do Episódio] - YouTube do Mente Binária - https://www.youtube.com/@mentebinaria/streams - Playing for the Wrong Team: Dangerous Functionalities in Microsoft Teams Enable Phishing and Malware Delivery by Attackers - https://www.proofpoint.com/us/blog/threat-insight/dangerous-functionalities-in-microsoft-teams-enable-phishing - Cisco Small Business Series Switches Buffer Overflow Vulner...

[Referências do Episódio] - Geacon Brings Cobalt Strike Capabilities to macOS Threat Actors - https://www.sentinelone.com/blog/geacon-brings-cobalt-strike-capabilities-to-macos-threat-actors/ - Infos stealer first trimester 2023 - https://www.bleepingcomputer.com/news/security/the-new-info-stealing-malware-operations-to-watch-out-for/ e https://ke-la.com/emerging-infostealers-2023-report/ - Qilin...

[Referências do Episódio] - Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor - Water Orthrus's New Campaigns Deliver Rootkit and Phishing Modules - https://www.trendmicro.com/en_us/research/23/e/water-orthrus-new-campaigns-deliver-rootkit...

[Referências do Episódio] - CISA Adds Seven Known Exploited Vulnerabilities to Catalog - https://www.cisa.gov/news-events/alerts/2023/05/12/cisa-adds-seven-known-exploited-vulnerabilities-catalog - BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game - https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game  - Securonix Threat Labs Security Ad...

[Referências do Episódio] - TEMPEST TURING DAY 2023 - https://www.even3.com.br/turingday2023/  - Critical Privilege Escalation in Essential Addons for Elementor Plugin Affecting 1+ Million Sites - https://patchstack.com/articles/critical-privilege-escalation-in-essential-addons-for-elementor-plugin-affecting-1-million-sites/  - Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Bab...

[Referências do Episódio] - Deep Dive Into DownEx Espionage Operation in Central Asia - https://www.bitdefender.com/blog/businessinsights/deep-dive-into-downex-espionage-operation-in-central-asia/ - From One Vulnerability to Another: Outlook Patch Analysis Reveals Important Flaw in Windows API - https://www.akamai.com/blog/security-research/important-outlook-vulnerability-bypass-windows-api - New...

[Referências do Episódio] - Patch Tuesday maio - https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2023-patch-tuesday-fixes-3-zero-days-38-flaws/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29336 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29325 - ESET APT Report Q4 2022 - Q...

[Referências do Episódio] - Iran-linked APT groups started exploiting Papercut flaw - https://securityaffairs.com/145952/apt/iranian-apt-papercut-exploitation.html - AndoryuBot – New Botnet Campaign Targets Ruckus Wireless Admin Remote Code Execution Vulnerability (CVE-2023-25717) - https://www.fortinet.com/blog/threat-research/andoryubot-new-botnet-campaign-targets-ruckus-wireless-admin-remote-co...

[Referências do Episódio] - Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution/ - Reflected XSS in Advanced Custom Fields Plugins Affecting 2+ Million Sites - https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affectin...

[Referências do Episódio] - PaperCut Exploitation - A Different Path to Code Execution - https://vulncheck.com/blog/papercut-rce - Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-unauth-upgrade-UqhyTWW - CVE-2023-26876: Vulnerabilidade de injeção de SQL encontrada no software de g...

[Referências do Episódio] - A doubled “Dragon Breath” adds new air to DLL sideloading attacks - https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ - The malware threat landscape: NodeStealer, DuckTail, and more - https://engineering.fb.com/2023/05/03/security/malware-nodestealer-ducktail/ - Attack on Security Titans: Earth Longzhi Returns With New Tricks - https://www....

[Referências do Episódio] - Three New BGP Message Parsing Vulnerabilities Disclosed in FRRouting Software - https://www.forescout.com/blog/three-new-bgp-message-parsing-vulnerabilities-disclosed-in-frrouting-software/ - 288 dark web vendors arrested in major marketplace seizure - https://www.europol.europa.eu/media-press/newsroom/news/288-dark-web-vendors-arrested-in-major-marketplace-seizure - TB...

[Referências do Episódio] - Zyxel security advisory for OS command injection vulnerability of firewalls - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls - Zyxel Firewall Devices Vulnerable to Remote Code Execution Attacks — Patch Now - https://thehackernews.com/2023/04/zyxel-firewall-devices-vulnerable-to....

[Referências do Episódio] - Nomadic Octopus’ Paperbug Campaign - https://www.prodaft.com/m/reports/PAPERBUG_TLPWHITE-1.pdf - Thread da Microsoft no Twitter sobre ataques contra o PaperCut - https://twitter.com/MsftSecIntel/status/1651346653901725696 - Tonto Team Uses Anti-Malware File to Launch Attacks on South Korean Institutions - https://thehackernews.com/2023/04/tonto-team-uses-anti-malware-fi...

[Referências do Episódio] - Evasive Panda APT Group Malware Updates Popular Chinese Software - https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/ - Unpacking Bellacio a Closer Look at Iran’s Latest Malware- https://www.bitdefender.com/blog/businessinsights/unpacking-bellaciao-a-closer-look-at-irans-latest-malware/ - Alloy Taurus - https://un...

[Referências do Episódio] - New high-severity vulnerability (CVE-2023-29552) discovered in the Service Location Protocol (SLP) - https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp - Lazarus Subgroup Targeting Apple Devices with New RustBucket macOS Malware - https://thehackernews.com/2023/04/lazarus-subgroup-targeting-apple.html -...

[Referências do Episódio] - Tomiris called, they want their Turla malware back - https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/ - Thread da Microsoft sobre falhas no sistema de busca do Microsoft 365 - https://twitter.com/MSFT365Status/status/1650458920786247681 - Attackers Abuse Kubernetes RBAC to Deploy Persistent Backdoor - https://www.securityweek.com/attacker...

[Referências do Episódio] - 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible - https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise - X_Trader Supply Chain Attack Affects Critical Infrastructure Organizations in U.S. and Europe - https://symantec-enterprise-blogs.security.com/blogs/threat-in...

[Referências do Episódio] - Jaguar Tooth - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/jaguar-tooth/NCSC-MAR-Jaguar-Tooth.pdf - Play Ransmware Volume Shadow Copy- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/play-ransomware-volume-shadow-copy - Google fixes zero-day in Chrome - https://chromereleases.googleblog.com/2023/04/stable-channel-upd...

[Referências do Episódio] - SimpleHarm: Tracking MuddyWater’s infrastructure - https://www.group-ib.com/blog/muddywater-infrastructure/ - WHAT MAKES INVALID PRINTER LOADER SO STEALTHY? - https://blog.morphisec.com/in2al5d-p3in4er - State-sponsored campaigns target global network infrastructure - https://blog.talosintelligence.com/state-sponsored-campaigns-target-global-network-infrastructure/  - T...

[Referências do Episódio] - QBot banker delivered through business correspondence - https://securelist.com/qbot-banker-business-correspondence/109535/ - New Zaraza Bot Credential-Stealer Sold on Telegram Targeting 38 Web Browsers - https://thehackernews.com/2023/04/new-zaraza-bot-credential-stealer-sold.html - Trigona Ransomware Attacking MS-SQL Servers - https://asec.ahnlab.com/en/51343/  - Threa...