Cyber Morning Call

[Referências do Episódio] - Stable Channel Update for Desktop - https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html - Read The Manual Locker: A Private RaaS Provider - https://www.trellix.com/en-us/about/newsroom/stories/research/read-the-manual-locker-a-private-raas-provider.html - Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor - https://security...

[Referências do Episódio] - Espionage Campaign Linked to Russian Intelligence Services - https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services - Vulnerabilidades do Jupiter Networks- https://supportportal.juniper.net/s/article/2023-04-Security-Bulletin-JSA-Series-Apache-Commons-Text-prior-to-1-10-0-allows-RCE-when-applied-to-untrusted-input-due-to-insecure-i...

[Referências do Episódio] - Nokoyama Ransomware abusando de zero-day no Windows - https://securelist.com/nokoyawa-ransomware-attacks-with-windows-zero-day/109483/ - Nova vulnerabilidade no JavaScript VM2- https://github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985, https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c e https://www.npmjs.com/package/vm2 -Sites maliciosa...

[Referências do Episódio] - CVE-2023-28252 -    Windows Common Log File System Driver Elevation of Privilege Vulnerability - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252 - CVE-2023-28285 -    Microsoft Office Remote Code Execution Vulnerability - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28285 - CVE-2023-28295 -    Microsoft Publisher Remote Code Execut...

[Referências do Episódio] - Analyzing Impala Stealer – Payload of the first NuGet attack campaign - https://jfrog.com/blog/impala-stealer-malicious-nuget-package-payload/ - ARES Leaks – Emerging Cyber Crime Cartel - https://www.cyfirma.com/outofband/ares-leaks-emerging-cyber-crime-cartel/ - MERCURY and DEV-1084: Destructive attack on hybrid environment - https://www.microsoft.com/en-us/security/bl...

[Referências do Episódio] - Exploit available for critical bug in VM2 JavaScript sandbox library - https://www.bleepingcomputer.com/news/security/exploit-available-for-critical-bug-in-vm2-javascript-sandbox-library/ - About the security content of iOS 16.4.1 and iPadOS 16.4.1 - https://support.apple.com/en-il/HT213720 - Balada Injector: Synopsis of a Massive Ongoing WordPress Malware Campaign - ht...

[Referências do Episódio] - CryptoClippy Speaks Portuguese - https://unit42.paloaltonetworks.com/crypto-clipper-targets-portuguese-speakers/ - Typhon Reborn Stealer Malware Resurfaces with Advanced Evasion Techniques - https://thehackernews.com/2023/04/typhon-reborn-stealer-malware.html - How we’re protecting users from government-backed attacks from North Korea - https://blog.google/threat-analys...

[Referências do Episódio] - RORSCHACH – A NEW SOPHISTICATED AND FAST RANSOMWARE - https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ - Genesis Market, one of world’s largest platforms for cyber fraud, seized by police - https://therecord.media/genesis-market-takedown-cybercrime - Mantis: New Tooling Used in Attacks Against Palestinian Targets - https://symantec...

[Referências do Episódio] - Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack - https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/ - How Falcon OverWatch Investigates Malicious Self-Extracting Archives, Decoy Files and Their Hidden Payloads - https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden...

[Referências do Episódio] - Microsoft OneNote will block 120 dangerous file extensions - https://www.bleepingcomputer.com/news/security/microsoft-onenote-will-block-120-dangerous-file-extensions/ - ‘Vulkan files’ leak reveals Putin’s global and domestic cyberwarfare tactics - https://www.theguardian.com/technology/2023/mar/30/vulkan-files-leak-reveals-putins-global-and-domestic-cyberwarfare-tactic...

[Referências do Episódio] - 3CX DesktopApp Security Alert - https://www.3cx.com/blog/news/desktopapp-security-alert/ - 3CX DesktopApp Security Alert - Mandiant Appointed to Investigate - https://www.3cx.com/blog/news/desktopapp-security-alert-updates/ - 3CX Supply Chain Compromise Leads to ICONIC Incident - https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incide...

[Referências do Episódio] - 2023-03-29 // SITUATIONAL AWARENESS // CrowdStrike Tracking Active Intrusion Campaign Targeting 3CX Customers - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/ - Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts - https://blog.exatrack.com/melofee/ - Copy-paste heist or clipboard-injector atta...

[Referências do Episódio] - APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations - https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - DBatLoader: Actively Distributing Malwares Targeting European Businesses - https://www.zscaler.com/blogs/security-research/dbatloader-actively-distributing-malwares-targeting-european-businesses - RHADAMANTHYS: THE “EVERYTHING BAGEL” INFOSTEALE...

[Referências do Episódio] - Fork in the Ice: The New Era of IcedID - https://www.proofpoint.com/us/blog/threat-insight/fork-ice-new-era-icedid - Twitter Says Parts of Its Source Code Were Leaked Online - https://www.nytimes.com/2023/03/26/technology/twitter-source-code-leak.html - Twitter takes down source code leaked online, hunts for downloaders - https://www.bleepingcomputer.com/news/security/t...

[Referências do Episódio] - Guidance for investigating attacks using CVE-2023-23397 - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/ - CVE-2023-23397 - Microsoft Outlook Elevation of Privilege Vulnerability - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397 - We updated our RSA SSH host key - https://github.blog...

[Referências do Episódio] - Exploit released for Veeam bug allowing cleartext credential theft - https://www.bleepingcomputer.com/news/security/exploit-released-for-veeam-bug-allowing-cleartext-credential-theft/ - Nexus: a new Android botnet? - https://www.cleafy.com/cleafy-labs/nexus-a-new-android-botnet - Operation Tainted Love | Chinese APTs Target Telcos in New Attacks - https://www.sentinelon...

[Referências do Episódio] - Beloved hacking veteran Kelly ‘Aloria’ Lum passes away at 41 - https://techcrunch.com/2023/03/22/kelly-aloria-lum-passes-away-at-41-obituary - “FakeGPT” #2: Open-Source Turned Malicious in Another Variant of the Facebook Account-Stealer Chrome Extension - https://labs.guard.io/fakegpt-2-open-source-turned-malicious-in-another-variant-of-the-facebook-account-stealer-d00e...

[Referências do Episódio] - Bad magic: new APT found in the area of Russo-Ukrainian conflict - https://securelist.com/bad-magic-apt/109087/ - Journalist opens USB letter bomb in newsroom. - https://www.bbc.com/news/world-latin-america-65026522 - After BreachForums arrest, new site administrator says the platform will live on - https://therecord.media/breachforums-arrest-new-administrator - CISA Re...

[Referências do Episódio] - Tempest Security Warning - https://www.tempest.com.br/gerenciamento/security-monitoring/security-warning/ - Move, Patch, Get Out the Way: 2022 Zero-Day Exploitation Continues at an Elevated Pace - https://www.mandiant.com/resources/blog/zero-days-exploited-2022 - Inside Mispadu massive infection campaign in LATAM - https://www.metabaseq.com/mispadu-banking-trojan/ [Fich...

[Referências do Episódio] - Dark Web ‘BreachForums’ Operator Charged With Computer Crime - https://news.bloomberglaw.com/privacy-and-data-security/dark-web-breachforums-operator-charged-with-computer-crime - United States v. Fitzpatrick - https://www.courtlistener.com/docket/67027377/1/united-states-v-fitzpatrick/ - Кіберполіція викрила жителя Хмельниччини у створенні «вірусу» для викрадення даних...

[Referências do Episódio] - Winter Vivern | Uncovering a Wave of Global Espionage - https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/ - Threat Spotlight: 3 novel phishing tactics - https://blog.barracuda.com/2023/03/16/threat-spotlight-novel-phishing-tactics/ - Kaspersky releases tool for decrypting Conti-based ransomware - https://usa.kaspersky.com/about/press-...

[Referências do Episódio] - Microsoft Mitigates Outlook Elevation of Privilege Vulnerability - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/ - Exploiting CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/...

[Referências do Episódio] - Security Update Guide - https://msrc.microsoft.com/update-guide/vulnerability - Magniber ransomware actors used a variant of Microsoft SmartScreen bypass - https://blog.google/threat-analysis-group/magniber-ransomware-actors-used-a-variant-of-microsoft-smartscreen-bypass/ - SAP Security Patch Day – March 2023 - https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr...

[Referências do Episódio] - Fortinet FortiOS Flaw Exploited in Targeted Cyberattacks on Government Entities - https://thehackernews.com/2023/03/fortinet-fortios-flaw-exploited-in.html - DEV-1101 enables high-volume AiTM campaigns with open-source phishing kit - https://www.microsoft.com/en-us/security/blog/2023/03/13/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit/ - Inco...

[Referências do Episódio] - GoBruteforcer: Golang-Based Botnet Actively Harvests Web Servers - https://unit42.paloaltonetworks.com/gobruteforcer-golang-botnet/ - Tweet da CISA sobre a falha CVE-2021-39144 - https://twitter.com/CISACyber/status/1634227134930595840 - CISA warns of actively exploited Plex bug after LastPass breach - https://www.bleepingcomputer.com/news/security/cisa-warns-of-activel...