Cyber Morning Call

[Referências do Episódio] - Bitwarden Password Pilfering - https://flashpoint.io/blog/bitwarden-password-pilfering/ - Microsoft investigates BEC incident- https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/xdr-attack-disruption-in-action-defending-against-a-recent-bec/ba-p/3749822 e https://twitter.com/MsftSecIntel/status/1633515412142034944 - IceFire Ransomware Returns Now Targeti...

[Referências do Episódio] - CorePlague: Severe Vulnerabilities in Jenkins Server Lead to RCE - https://blog.aquasec.com/jenkins-server-vulnerabilities - Jenkins Security Advisory 2023-03-08 - https://www.jenkins.io/security/advisory/2023-03-08/ - FG-IR-23-001 - FortiOS / FortiProxy - Heap buffer underflow in administrative interface - https://www.fortiguard.com/psirt/FG-IR-23-001 - Overflow and un...

[Referências do Episódio] - Fresh Phishing Campaign that Uses Copycat ChatGPT Platform - https://www.bitdefender.com/blog/hotforsecurity/bitdefender-labs-warns-of-fresh-phishing-campaign-that-uses-copycat-chatgpt-platform-to-swindle-eager-investors/ - DBatLoader and Remcos RAT Sweep Eastern Europe- https://www.sentinelone.com/blog/dbatloader-and-remcos-rat-sweep-eastern-europe/ - VMWare NSX Manage...

[Referências do Episódio] - New HiatusRAT Router Malware Covertly Spies On Victims - https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/ - Germany and Ukraine hit two high-value ransomware targets - https://www.europol.europa.eu/media-press/newsroom/news/germany-and-ukraine-hit-two-high-value-ransomware-targets - 2022 Year in Review - https://thedfirreport.com/2023/03/06...

[Referências do Episódio] - TPM 2.0 library memory corruption vulnerabilities - https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT0007-Advisory-FINAL.pdf - Over 2 Million Cards Leaked By BidenCash - https://blog.cyble.com/2023/03/01/over-2-million-cards-leaked-by-bidencash/ - Microsoft releases Windows security updates for Intel CPU flaws - https://www.bleepingcomputer.com/news/microsoft/...

[Referências do Episódio] - Redis Miner Leverages Command Line File Hosting Service - https://www.cadosecurity.com/redis-miner-leverages-command-line-file-hosting-service - FACT SHEET: Biden-⁠Harris Administration Announces National Cybersecurity Strategy - https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/02/fact-sheet-biden-harris-administration-announces-national-cybersecurit...

[Referências do Episódio] - IronTiger SysUpdate - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html - Parallax RAT Infiltration - https://www.uptycs.com/blog/cryptocurrency-entities-at-risk-threat-actor-uses-parallax-rat-for-infiltration - BlackLotus UEFI Bootkit Myth Confirmed- https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confi...

[Referências do Episódio] - Blind Eagle Deploys Fake UUE Files and Fsociety to Target Colombia's Judiciary, Financial, Public, and Law Enforcement Entities - https://blogs.blackberry.com/en/2023/02/blind-eagle-apt-c-36-targets-colombia - Incident 2 – Additional details of the attack - https://support.lastpass.com/help/incident-2-additional-details-of-the-attack - Can You See It Now? An Emerging Lo...

[Referências do Episódio] - RIG Exploit Kit: In-Depth Analysis - https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf - PureCrypter targets government entities through Discord - https://www.menlosecurity.com/blog/purecrypter-targets-government-entities-through-discord/ - TA569: SocGholish and Beyond - https://www.proofpoint.com/us/blog/threat-insight/ta569-socgholish-and-beyond - Exfiltrator-22...

[Referências do Episódio] - Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool - https://www.trendmicro.com/en_us/research/23/b/investigating-the-plugx-trojan-disguised-as-a-legitimate-windows.html - Ukraine says Russian hackers backdoored govt websites in 2021 - https://www.bleepingcomputer.com/news/security/ukraine-says-russian-hackers-backdoored-govt-websites-in-2021...

[Referências do Episódio] - WinorDLL64: A backdoor from the vast Lazarus arsenal? - https://www.welivesecurity.com/2023/02/23/winordll64-backdoor-vast-lazarus-arsenal/ - How I Broke Into a Bank Account With an AI-Generated Voice - https://www.vice.com/en/article/dy7axa/how-i-broke-into-a-bank-account-with-an-ai-generated-voice - Clasiopa: New Group Targets Materials Research - https://symantec-ent...

[Referências do Episódio] - About the security content of macOS Ventura 13.2 - https://support.apple.com/en-gu/HT213605 - Trellix Advanced Research Center Discovers a New Privilege Escalation Bug Class on macOS and iOS - https://www.trellix.com/en-us/about/newsroom/stories/research/trellix-advanced-research-center-discovers-a-new-privilege-escalation-bug-class-on-macos-and-ios.html - Fortinet Fort...

[Referências do Episódio] - Frebniis: New Malware Abuses Microsoft IIS Feature to Establish Backdoor - https://symantec-enterprise-blogs.security.com/threat-intelligence/frebniis-malware-iis - OPERATION SILENT WATCH: DESKTOP SURVEILLANCE IN AZERBAIJAN AND ARMENIA - https://research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/ - Citrix Workspace app for...

[Referências do Episódio] - Google Ads e SEO Poisoning: como os adversários empregam malvertising em campanhas de disseminação de malware - https://sidechannel.blog/google-ads-e-seo-poisoning/ - 스테가노그래피 기법 사용한 한글(HWP) 악성코드 : RedEyes(ScarCruft) - https://asec.ahnlab.com/ko/47622/ - Molted skin: APT SideWinder 2021 campaign that targeted over 60 companies in the Asia-Pacific - http...

[Referências do Episódio] - New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign - https://blog.talosintelligence.com/new-mortalkombat-ransomware-and-laplas-clipper-malware-threats/ - Microsoft February 2023 Patch Tuesday fixes 3 exploited zero-days, 77 flaws - https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2023-patch-tuesday...

[Referências do Episódio] - Nice Try Tonto Team - https://www.group-ib.com/blog/tonto-team/ - About the security content of iOS 16.3.1 and iPadOS 16.3.1 - https://support.apple.com/en-us/HT213635 - Patch Now: Apple's iOS, iPadOS, macOS, and Safari Under Attack with New Zero-Day Flaw - https://thehackernews.com/2023/02/patch-now-apples-ios-ipados-macos-and.html - Iranian State TV Hacked During Pres...

[Referências do Episódio] - Uncle Sow: Dark Caracal in Latin America - https://www.eff.org/deeplinks/2023/02/uncle-sow-dark-caracal-latin-america - Clop ransomware claims it breached 130 orgs using GoAnywhere zero-day - https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-it-breached-130-orgs-using-goanywhere-zero-day/ - We had a security incident. Here’s what we know. - https://w...

[Referências do Episódio] - Cloud Credentials Phishing Malicious Google Ads Target AWS Logins - https://www.sentinelone.com/blog/cloud-credentials-phishing-malicious-google-ads-target-aws-logins/ - GootLoader SEO Poisoning - https://www.cybereason.com/blog/threat-alert-gootloader-seo-poisoning-and-large-payloads-leading-to-compromise - ESXiArgs new Cypher Method - https://www.bleepingcomputer.com/...

[Referências do Episódio] - Cybercriminals Bypass ChatGPT Restrictions to Generate Malicious Content - https://blog.checkpoint.com/2023/02/07/cybercriminals-bypass-chatgpt-restrictions-to-generate-malicious-content/ - Nodaria Ukraine Infostealer - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer - Remcos being Used Against Ukraine- https://thehac...

[Referências do Episódio] - GoAnywhere MFT vuln correction and PoC - https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/, https://www.bleepingcomputer.com/news/security/exploit-released-for-actively-exploited-goanywhere-mft-zero-day/, https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html E https://my.goanywhere.com/webc...

[Referências do Episódio] - QakBot OneNote Attacks - https://news.sophos.com/en-us/2023/02/06/qakbot-onenote-attacks/ - Collect Exfiltrate Sleep Repeat - https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/ - OpenSSH Vulnerability- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946, https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017...

[Referências do Episódio] - Active ransomware campaign targeting ESXi servers- https://blog.ovhcloud.com/ransomware-targeting-vmware-esxi/, https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-015/ E https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/ - Pixpirate banking trojan- https://www.cleafy.com/cleafy-labs/pixpirate-a-new-b...

[Referências do Episódio] - No Pineapple DPRK Targeting of Medical Research and Technology Sector - https://labs.withsecure.com/publications/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector - InTheBox Web Injects Targeting Android Banking Applications - https://blog.cyble.com/2023/01/31/inthebox-web-injects-targeting-android-banking-applications-worldwide/ - HeadCrab Attacks S...

[Referências do Episódio] - Fraudulent Cryptorom Trading Apps Sneak Into Apple and Google App Stores - https://news.sophos.com/en-us/2023/02/01/fraudulent-cryptorom-trading-apps-sneak-into-apple-and-google-app-stores/ - Sh1mmer Exploit - https://www.bleepingcomputer.com/news/security/new-sh1mmer-chromebook-exploit-unenrolls-managed-devices/ - Operation IceBreaker - https://www.securityjoes.com/pos...

[Referências do Episódio] - Sandworm NikoWiper - https://www.welivesecurity.com/wp-content/uploads/2023/01/eset_apt_activity_report_t32022.pdf - Prilex Modification Now Targeting Contacles Credit Card Transactions - https://securelist.com/prilex-modification-now-targeting-contactless-credit-card-transactions/108569/ - 6 Year Old Packer Being Actively Used By Several Malwara Families - https://rese...