Cyber Morning Call

[Referências do Episódio] - VMware vulnerabilities exploit - https://www.horizon3.ai/vmware-vrealize-cve-2022-31706-iocs/ - Qnap vulnerabiltiy - https://www.qnap.com/en/security-advisory/qsa-23-01 - Phishing campaign amidst tech layoffs - https://www.zscaler.com/blogs/security-research/job-scams-impersonate-companies-still-hiring-following-tech-layoffs - SwiftSlicer New Destructive Wiper Malware U...

[Referências do Episódio] - PlugX Variants in USBs - https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/ - Abrahams Ax Likely to Moses Staff - https://www.secureworks.com/blog/abrahams-ax-likely-linked-to-moses-staff - BitWarden Password Vaults Targeted in Google Ads Phishing Attack- https://www.bleepingcomputer.com/news/security/bitwarden-password-vaults-targeted-in-google-ads-phishing-at...

[Referências do Episódio] - Windows CryptoAPI abuse- https://www.akamai.com/blog/security-research/exploiting-critical-spoofing-vulnerability-microsoft-cryptoapi E https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-34689 - Mimic Ransomware - https://www.trendmicro.com/en_us/research/23/a/new-mimic-ransomware-abuses-everything-apis-for-its-encryption-p.html - 5000 Instances of Dra...

[Referências do Episódio] - PY#RATION malware analysis - https://www.securonix.com/blog/security-advisory-python-based-pyration-attack-campaign/ - TA444 APT Startup Aimed At Your Funds - https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds - WordPress Campaing- https://blog.sucuri.net/2023/01/massive-campaign-uses-hacked-wordpress-sites-as-platform-for-black-hat-...

[Referências do Episódio] - DragonSpark evade detection Golang - https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/ - Emotet Returns With New Methods of Evasion - https://blogs.blackberry.com/en/2023/01/emotet-returns-with-new-methods-of-evasion - Multiple Critical Vulnerabilities Fixed In LearnPress Plugin Version - https://pa...

[Referências do Episódio] - Hackers Now Use Microsoft OneNote Attachments to Spread Malware- https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - Slive C2 Leveraged by Many Threat Actors - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors - Microsoft plans to block XLL - https://www.microsoft.com/en-us/microsoft-3...

[Referências do Episódio] - Hook malware- https://www.threatfabric.com/blogs/hook-a-new-ermac-fork-with-rat-capabilities.html - Exploiting FortiOS Flaw - https://www.mandiant.com/resources/blog/chinese-actors-exploit-fortios-flaw - Gamaredon Ukraine - https://blogs.blackberry.com/en/2023/01/gamaredon-abuses-telegram-to-target-ukrainian-organizations - OneNote malware - https://www.bleepingcomputer...

[Referências do Episódio] - CVE-2022-47966 SAML ShowStopper - https://blog.viettelcybersecurity.com/saml-show-stopper/ - Following the LNK metadata trail - https://blog.talosintelligence.com/following-the-lnk-metadata-trail/ - Roaming Mantis implements new DNS changer in its malicious mobile app in 2022 - https://securelist.com/roaming-mantis-dns-changer-in-malicious-mobile-app/108464/ - PayPal ac...

[Referências do Episódio] - Playful Taurus - https://unit42.paloaltonetworks.com/playful-taurus/ - CISA GE Vulnerabilty - https://claroty.com/team82/research/hacking-ics-historians-the-pivot-point-from-it-to-ot e https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01 - Credit Card Fraud 2022 - https://www.recordedfuture.com/annual-payment-fraud-intelligence-report-2022 e https://go.recordedfutu...

[Referências do Episódio] - Ransomware Diaries: Volume 1 - Unlocking Lockbit, a ransomware story - https://analyst1.com/ransomware-diaries-volume-1/ - Crypto exchanges freeze accounts tied to North Korea’s notorious Lazarus Group - https://www.theregister.com/2023/01/17/crypto_exchanges_freeze_lazarus_group/ - Zoho ManageEngine PoC Exploit to be Released Soon - Patch Before It's Too Late! - https:...

[Referências do Episódio] - Decrypted: BianLian Ransomware - https://decoded.avast.io/threatresearch/decrypted-bianlian-ransomware/ - Supply Chain Attack Using Identical PyPI Packages, “colorslib”, “httpslib”, and “libhttps” - https://www.fortinet.com/blog/threat-research/supply-chain-attack-using-identical-pypi-packages-colorslib-httpslib-libhttps - The Last of Us: cibercriminosos usam hype da no...

[Referências do Episódio] - CircleCI incident report for January 4, 2023 security incident - https://circleci.com/blog/jan-4-2023-incident-report/ - Racing bugs in Windows kernel - https://dannyodler.hashnode.dev/racing-bugs-in-windows-kernel - Android TV box on Amazon came pre-installed with malware - https://www.bleepingcomputer.com/news/security/android-tv-box-on-amazon-came-pre-installed-with-...

[Referências do Episódio] - Gootkit Loader Actively Targets The Australian Healthcare Industry - https://www.trendmicro.com/en_us/research/23/a/gootkit-loader-actively-targets-the-australian-healthcare-indust.html - Noname0516 The Pro Russian Hackativist Group Targeting Nato - https://www.sentinelone.com/labs/noname05716-the-pro-russian-hacktivist-group-targeting-nato/ - MetaMask Address Poisoning...

[Referências do Episódio] - Dark Pink: New APT group targets governmental, military organizations in APAC, Europe - https://www.group-ib.com/media-center/press-releases/dark-pink-apt/ - SSA-482757: Missing Immutable Root of Trust in S7-1500 CPU devices - https://cert-portal.siemens.com/productcert/html/ssa-482757.html - CISA Adds Two Known Exploited Vulnerabilities to Catalog - https://www.cisa.go...

[Referências do Episódio] - Microsoft January 2023 Patch Tuesday fixes 98 flaws, 1 zero-day - https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2023-patch-tuesday-fixes-98-flaws-1-zero-day/ - Security update available for Adobe Acrobat and Reader  | APSB23-01 - https://helpx.adobe.com/security/products/acrobat/apsb23-01.html - Security Update Available for Adobe InCopy | APSB2...

[Referências do Episódio] - Malware Targeting Crypto Wallets Detected In Crypto Trading Forum - https://www.safeguardcyber.com/hubfs/Threat%20Intel%20Reports/Threat%20Report_Echelon%20Malware%20-%20SafeGuard%20Cyber.pdf - Unwrapping Ursnifs Gifts - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/ - 警惕：魔改后的CIA攻击套件Hive进入黑灰产领域 - https://blog.netlab.360.com/warning-hive...

[Referências do Episódio] - Dridex Returns, Targets MacOS Using New Entry Method - https://www.trendmicro.com/en_us/research/23/a/-dridex-targets-macos-using-new-entry-method.html - Bitdefender Partnership with Law Enforcement Yields MegaCortex Decryptor - https://www.bitdefender.com/blog/labs/bitdefender-partnership-with-law-enforcement-yields-megacortex-decryptor/ - Unraveling the techniques of...

[Referências do Episódio] - Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa - BLINDEAGLE TARGETING ECUADOR WITH SHARPENED TOOLS - https://research.checkpoint.com/2023/blindeagle-targeting-ecuador-with-sharpened-tools/ - More Brazil malspam pushing Astaroth (Guildma) in...

[Referências do Episódio] - CircleCI security alert: Rotate any secrets stored in CircleCI - https://circleci.com/blog/january-4-2023-security-alert/ - Shc Linux Malware Installing CoinMiner - https://asec.ahnlab.com/en/45182/ - FG-IR-22-061 - FortiADC - command injection in web interface - https://www.fortiguard.com/psirt/FG-IR-22-061 - FG-IR-22-274 - FortiTester - Multiple command injection vuln...

[Referências do Episódio] - EURASIA GROUP'S TOP RISKS FOR 2023 - https://www.eurasiagroup.net/issues/top-risks-2023 - BitRAT Now Sharing Sensitive Bank Data as a Lure - https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure - Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More - htt...

[Referências do Episódio] Compromised PyTorch-nightly dependency chain between December 25th and December 30th, 2022. - https://pytorch.org/blog/compromised-nightly-dependency/#how-to-check-if-your-python-environment-is-affected RedZei - Chinese-speaking scammers targeting Chinese students in the UK - https://blog.bushidotoken.net/2022/12/redzei-chinese-speaking-scammers.html [Ficha técnica] Apres...

[Referências do Episódio] -FIN7 Unveiled: A deep dive into notorious cybercrime gang - https://www.prodaft.com/m/reports/FIN7_TLPCLEAR.pdf -FIN7 Cybercrime Syndicate Emerges as Major Player in Ransomware Landscape - https://thehackernews.com/2022/12/fin7-cybercrime-syndicate-emerges-as.html -Nitol DDoS Malware Installing Amadey Bot - https://asec.ahnlab.com/en/44504/ -Vidar Stealer Exploiting Vari...

[Referências do Episódio] -Godfather:A banking Trojan that is impossible to refuse - https://blog.group-ib.com/godfather-trojan -Okta's source code stolen after GitHub repositories hacked - https://www.bleepingcomputer.com/news/security/oktas-source-code-stolen-after-github-repositories-hacked/ -I-122122-PSA - Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defra...

[Referências do Episódio] -Nova campanha do Chaes usa o Windows Management Instrumentation Command-Line Utility - https://sidechannel.blog/nova-campanha-do-chaes/ -Russia’s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine - https://unit42.paloaltonetworks.com/trident-ursa/ -OWASSRF: CrowdStrike Identifies New Exploit Method for Exchange Bypassing Prox...

[Referências do Episódio] -Microsoft finds macOS bug that lets malware bypass security checks - https://www.bleepingcomputer.com/news/security/microsoft-finds-macos-bug-that-lets-malware-bypass-security-checks/ -MeshyJSON: A TP-Link tdpServer JSON Stack Overflow - https://research.nccgroup.com/2022/12/19/meshyjson-a-tp-link-tdpserver-json-stack-overflow/#json-array-stack-overflow -You might receiv...