Cyber Morning Call

[Referências do Episódio] - DDoS attacks in Q3 2022 - https://securelist.com/ddos-report-q3-2022/107860/ - U.S. Attorney Announces Historic $3.36 Billion Cryptocurrency Seizure And Conviction In Connection With Silk Road Dark Web Fraud - https://www.justice.gov/usao-sdny/pr/us-attorney-announces-historic-336-billion-cryptocurrency-seizure-and-conviction - Presos suspeitos de DDoS contra provedores...

[Referências do Episódio] - Nation-state cyberattacks become more brazen as authoritarian leaders ramp up aggression - https://blogs.microsoft.com/on-the-issues/2022/11/04/microsoft-digital-defense-report-2022-ukraine/ - A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain - https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-c...

[Referências do Episódio] Black Basta Ransomware Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor -  https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/ Emotet Botnet Starts Blasting Malware Again After 5 Months Break - https://www.bleepingcomputer.com/news/security/emotet-botnet-starts-blasting-malware-ag...

[Referências do Episódio] - CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows - https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/ - CosMiss: Azure Cosmos DB Notebook Remote Code Execution Vulnerability - https://orca.security/resources/blog/cosmiss-vulnerability-azure-cosmos-db/ - Amadey Bot을 이용한 LockBit 3.0 랜섬웨어 유포 중 - https://asec.ahnlab.com/ko/...

[Referências do Episódio] - Follina Exploit Leads to Domain Compromise - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/ - Critical Vulnerability Disclosure: ConnectWise/R1Soft Server Backup Manager Remote Code Execution & Supply Chain Risks - https://www.huntress.com/blog/critical-vulnerability-disclosure-connectwise/r1soft-server-backup-manager-remote-code-ex...

[Referências do Episódio] - Cranefly: Threat Actor Uses Previously Unseen Techniques and Tools in Stealthy Campaign - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cranefly-new-tools-technique-geppei-danfuan - Exploit released for critical VMware RCE vulnerability, patch now - https://www.bleepingcomputer.com/news/security/exploit-released-for-critical-vmware-rce-vulnera...

[Referências do Episódio] - Drinik Malware Returns With Advanced Capabilities Targeting Indian Taxpayers - https://blog.cyble.com/2022/10/27/drinik-malware-returns-with-advanced-capabilities-targeting-indian-taxpayers/ - Fodcha DDoS botnet reaches 1Tbps in power, injects ransoms in packets - https://www.bleepingcomputer.com/news/security/fodcha-ddos-botnet-reaches-1tbps-in-power-injects-ransoms-in...

[Referências do Episódio] Prisão suspeito Raccoon Stealer -  https://www.justice.gov/usao-wdtx/pr/newly-unsealed-indictment-charges-ukrainian-national-international-cybercrime-operation E https://raccoon.ic3.gov/home PRC Dragonbridge Influence Elections - https://www.mandiant.com/resources/blog/prc-dragonbridge-influence-elections Threat Actor Target AWS EC2 Workloads to Steal Credentials- &n...

[Referências do Episódio] - TEMPEST TALKS - https://www.tempest.com.br/tempest_talk/tempest-talks-2022/ - Forthcoming OpenSSL Releases - https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html - VMware advisories - VMSA-2022-0027 - https://www.vmware.com/security/advisories/VMSA-2022-0027.html - Sysdig TRT uncovers massive cryptomining operation leveraging GitHub Actions - http...

[Referências do Episódio] - Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware - https://medium.com/s2wblog/unveil-the-evolution-of-kimsuky-targeting-android-devices-with-newly-discovered-mobile-malware-280dae5a650f - Iran says ‘specific foreign country’ behind hacktivist leak of atomic energy emails - https://therecord.media/iran-says-specific-foreign-c...

[Referências do Episódio] - Vaga Analista de Threat Intelligence 1 (junior) - https://tempest.gupy.io/job/eyJzb3VyY2UiOiJndXB5X3B1YmxpY19wYWdlIiwiam9iSWQiOjMyMDA5MzZ9?jobBoardSource=gupy_public_page - Tempest Talks 2022 - https://www.tempest.com.br/tempest_talk/tempest-talks-2022/ - Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool - https://symantec-enterprise-blogs.security.com...

[Referências do Episódio] - Gremlins’ prey, secrets, and dirty tricks: the ransomware gang OldGremlin set new records - https://www.group-ib.com/media-center/press-releases/oldgremlin-2022/ - Damaged cable leaves Shetland cut off from mainland - https://www.bbc.com/news/uk-scotland-north-east-orkney-shetland-63326102 - European cable cut may impact transoceanic routes - https://trust.zscaler.com/z...

[Referências do Episódio] PF prende brasileiro suspeito de integrar organização criminosa internacional -  https://www.gov.br/pf/pt-br/assuntos/noticias/2022/10/pf-prende-brasileiro-suspeito-de-integrar-organizacao-criminosa-internacional New fully undetectable powershell backdoor - https://www.safebreach.com/resources/blog/safebreach-labs-researchers-uncover-new-fully-undetectable-powershell...

[Referências do Episódio] - Spyder Loader: Malware Seen in Recent Campaign Targeting Organizations in Hong Kong - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/spyder-loader-cuckoobees-hong-kong - 31 arrested for stealing cars by hacking keyless tech - https://www.europol.europa.eu/media-press/newsroom/news/31-arrested-for-stealing-cars-hacking-keyless-tech - I feel a dr...

[Referências do Episódio] - CVE-2022-42889 Text4Shell : une vulnérabilité de type exécution de code à distance qui affecte le logiciel Apache Commons Text - https://cyberwatch.fr/cve/cve-2022-42889-text4shell-comment-detecter-et-corriger-cette-vulnerabilite-sur-apache-commons-text/ - New UEFI rootkit Black Lotus offered for sale at $5,000 - https://securityaffairs.co/wordpress/137252/malware/black...

[Referências do Episódio] - Ransom Cartel Ransomware: A Possible Connection With REvil - https://unit42.paloaltonetworks.com/ransom-cartel-ransomware/?web_view=true - New “Prestige” ransomware impacts organizations in Ukraine and Poland - https://www.microsoft.com/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ - RedEye - Red Team C2 Log Visualization...

[Referências do Episódio] - Alchimist: A new attack framework in Chinese for Mac, Linux and Windows - https://blog.talosintelligence.com/2022/10/alchimist-offensive-framework.html - Budworm: Espionage Group Returns to Targeting U.S. Organizations - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state - Magniber Ransomware Adopts JavaScript, Targeting...

[Referências do Episódio] - TEMPEST TALKS 2022 - https://www.tempest.com.br/tempest_talk/tempest-talks-2022 - October 2022 Microsoft Patch Tuesday - https://isc.sans.edu/forums/diary/October%202022%20Microsoft%20Patch%20Tuesday/29138/ - SAP Security Patch Day –October 2022 - https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10 - Aruba Product Security Advisory - Advisory ID: ARU...

[Referências do Episódio] - Intel confirms leaked Alder Lake BIOS Source Code is authentic - https://www.bleepingcomputer.com/news/security/intel-confirms-leaked-alder-lake-bios-source-code-is-authentic/ - US airports' sites taken down in DDoS attacks by pro-Russian hackers - https://www.bleepingcomputer.com/news/security/us-airports-sites-taken-down-in-ddos-attacks-by-pro-russian-hackers/ - Iran...

- Fortinet warns admins to patch critical auth bypass bug immediately - https://www.bleepingcomputer.com/news/security/fortinet-warns-admins-to-patch-critical-auth-bypass-bug-immediately/ - LOFYGANG – SOFTWARE SUPPLY CHAIN ATTACKERS; ORGANIZED, PERSISTENT, AND OPERATING FOR OVER A YEAR - https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organized-persistent-and-operating-for-over...

[Referências do Episódio] - Exploitation of Unpatched Zero-Day Remote Code Execution Vulnerability in Zimbra Collaboration Suite (CVE-2022-41352) - https://www.rapid7.com/blog/post/2022/10/06/exploitation-of-unpatched-zero-day-remote-code-execution-vulnerability-in-zimbra-collaboration-suite-cve-2022-41352/ - Cisco Enterprise NFV Infrastructure Software Improper Signature Verification Vulnerabilit...

[Referências do Episódio] Remove All The Callbacks – BlackByte Ransomware Disables EDR Via RTCore64.sys Abuse -  https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/ Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server - https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-ser...

[Referências do Episódio] Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization -  https://www.cisa.gov/uscert/ncas/alerts/aa22-277a Fake Microsoft Exchange ProxyNotShell exploits for sale on GitHub- https://www.bleepingcomputer.com/news/security/fake-microsoft-exchange-proxynotshell-exploits-for-sale-on-github/ Cryptocurrency Investment...

[Referências do Episódio] - Microsoft Exchange server zero-day mitigation can be bypassed - https://www.bleepingcomputer.com/news/security/microsoft-exchange-server-zero-day-mitigation-can-be-bypassed/ - New Pegasus Spyware Abuses Identified in Mexico - https://citizenlab.ca/2022/10/new-pegasus-spyware-abuses-identified-in-mexico/ - Phishing With Chromium's Application Mode - https://mrd0x.com/phi...

[Referências do Episódio] - CrowdStrike Falcon Platform Identifies Supply Chain Attack via a Trojanized Comm100 Chat Installer - https://www.crowdstrike.com/blog/new-supply-chain-attack-leverages-comm100-chat-installer/ - Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server - https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerab...