Cyber Morning Call

[Referências do Episódio] Prilex: the pricey prickle credit card complex - https://securelist.com/prilex-atm-pos-malware-evolution/107551/ L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers- https://kb.cert.org/vuls/id/855201 LockBit 3.0 Ransomware Distributed via Word Documents - https://asec.ahnlab.com/en/39242/ Chaos Is A Go-Based Swiss Army Knife Of Malware...

[Referências do Episódio] - Agent Tesla RAT Delivered by Quantum Builder With New TTPs - https://www.zscaler.com/blogs/security-research/agent-tesla-rat-delivered-quantum-builder-new-ttps?&web_view=true - Taking down coordinated inauthentic behavior from Russia and China - https://about.fb.com/wp-content/uploads/2022/09/CIB-Report_-China-Russia_Sept-2022-1.pdf#%5B%7B%22num%22%3A140%2C%22gen%22...

[Referências do Episódio] - BumbleBee: Round Two - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ - Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto - https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto/ - NullMixer: oodles of Trojans in a single dropper - https://securelist.com/nullmixer-oodles-...

[Referências do Episódio] - Resolved RCE in Sophos Firewall (CVE-2022-3236) - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce - UK Police arrests teen believed to be behind Uber, Rockstar hacks - https://www.bleepingcomputer.com/news/security/uk-police-arrests-teen-believed-to-be-behind-uber-rockstar-hacks/ - A Multimillion Dollar Global Online Credit Card Scam Uncover...

[Referências do Episódio] - Furto de Celular - SEU CELULAR É SUA CARTEIRA: CUIDE DA SUA VIDA DIGITAL - https://cartilha.cert.br/fasciculos/furto-de-celular/fasciculo-furto-de-celular.pdf - Malicious OAuth applications used to compromise email servers and spread spam - https://www.microsoft.com/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/ -...

[Referências do Episódio] Vazamento builder Lockbit 3.0  - https://twitter.com/3xp0rtblog/status/1572510793861836802 e https://blog.cyble.com/2022/09/21/alleged-builder-of-lockbit-black-ransomware-leaked/ Tarfile: Exploiting the World With a 15-Year-Old Vulnerability - https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/tarfile-exploiting-the-world.html Threat Actors Continue to...

[Referências do Episódio] Russia-Nexus UAC-0113 Emulating Telecommunication Providers in Ukraine  - https://www.recordedfuture.com/russia-nexus-uac-0113-emulating-telecommunication-providers-in-ukraine AttachMe: critical OCI vulnerability allows unauthorized access to customer cloud storage volumes  - https://www.wiz.io/blog/attachme-oracle-cloud-vulnerability-allows-unauthorized-cross-t...

[Referências do Episódio] - Stopping Vulnerable Driver Attacks - https://www.elastic.co/pt/security-labs/stopping-vulnerable-driver-attacks - Microsoft Warns of Large-Scale Click Fraud Campaign Targeting Gamers - https://thehackernews.com/2022/09/microsoft-warns-of-large-scale-click.html - Pentagon opens sweeping review of clandestine psychological operations - https://www.washingtonpost.com/natio...

[Referências do Episódio] - Uber hacked, internal systems breached and vulnerability reports stolen - https://www.bleepingcomputer.com/news/security/uber-hacked-internal-systems-breached-and-vulnerability-reports-stolen/ - Grand Theft Auto VI Leak Is a Shock to Video Game Studio Rockstar - https://www.bloomberg.com/news/articles/2022-09-19/grand-theft-auto-vi-gta6-leak-is-a-shock-to-rockstar-games...

[Referências do Episódio] Webworm: Espionage Attackers Testing and Using Older Modified RATs  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats Self-spreading stealer attacks gamers via YouTube  - https://securelist.com/self-spreading-stealer-attacks-gamers-via-youtube/107407/ Referências sanções à indivíduos do Irã- https://home.treasury.g...

[Referências do Episódio] You never walk alone: The SideWalk backdoor gets a Linux variant - https://www.welivesecurity.com/2022/09/14/you-never-walk-alone-sidewalk-backdoor-linux-variant/ Security Breaks: TeamTNT’s DockerHub Credentials Leak - https://www.trendmicro.com/en_us/research/22/i/security-breaks-teamtnts-dockerhub-credentials-leak.html August’s Top Malware: Emotet Knocked off Top Spot b...

[Referências do Episódio] Azure Active Directory Pass-Through Authentication Flaw - https://www.secureworks.com/research/azure-active-directory-pass-through-authentication-flaws  Microsoft Patch Tuesday - https://heimdalsecurity.com/blog/patch-tuesday-september-2022/ e https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2022-patch-tuesday-fixes-zero-day-used-in-attacks-63-flaw...

[Referências do Episódio] Referências GIFShell - https://medium.com/@bobbyrsec/gifshell-covert-attack-chain-and-c2-utilizing-microsoft-teams-gifs-1618c4e64ed7, https://www.bleepingcomputer.com/news/security/gifshell-attack-creates-reverse-shell-using-microsoft-teams-gifs/ e https://www.hackread.com/scammers-microsoft-team-gifs-phishing-attacks/  Chiseling In: Lorenz Ransomware Group Cracks Mi...

[Referências do Episódio] Microsoft investigates Iranian attacks against the Albanian government - https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/ Lampion Trojan Utilizes New Delivery through Cloud-Based Sharing - https://cofense.com/blog/lampion-trojan-utilizes-new-delivery-through-cloud-based-sharing Crimeware Trends | Ra...

[Referências do Episódio] - BRONZE PRESIDENT Targets Government Officials - https://www.secureworks.com/blog/bronze-president-targets-government-officials - Threat de Felipe Payão sobre vazamento em operadoras de telefonia - https://twitter.com/felipepayao/status/1567547478211280902  - How Malicious Actors Abuse Native Linux Tools in Attacks - https://www.trendmicro.com/en_us/research/22/i/ho...

[Referências do Episódio] - Initial access broker repurposing techniques in targeted attacks against Ukraine - https://blog.google/threat-analysis-group/initial-access-broker-repurposing-techniques-in-targeted-attacks-against-ukraine/ - MagicRAT: Lazarus’ latest gateway into victim networks - https://blog.talosintelligence.com/2022/09/lazarus-magicrat.html - Cisco Small Business RV110W, RV130, RV1...

[Referências do Episódio] - EvilProxy Phishing-As-A-Service With MFA Bypass Emerged In Dark Web - https://resecurity.com/blog/article/evilproxy-phishing-as-a-service-with-mfa-bypass-emerged-in-dark-web - Asia: Sextortion ring dismantled by police - https://www.interpol.int/News-and-Events/News/2022/Asia-Sextortion-ring-dismantled-by-police - QNAP - QSA-22-24 -  https://www.qnap.com/en/securit...

[Referências do Episódio] - Blocking Kiwifarms - https://blog.cloudflare.com/kiwifarms-blocked/ - Cloudflare reverses decision and drops trans trolling website Kiwi Farms - https://www.theguardian.com/technology/2022/sep/04/cloudflare-reverses-decision-and-drops-trans-trolling-website-kiwi-farms - Google rolled out emergency fixes to address actively exploited Chrome zero-day - https://securityaff...

[Referências do Episódio] - Instagram Phishing Campaign: Hackers Exploit Social Verification - https://www.vadesecure.com/en/blog/instagram-phishing-campaign-hackers-exploit-social-verification - Securing the Software Supply Chain: Recommended Practices for Developers - https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3146465/nsa-cisa-odni-release-software-supply...

[Referências do Episódio] - Vulnerability in TikTok Android app could lead to one-click account hijacking - https://www.microsoft.com/security/blog/2022/08/31/vulnerability-in-tiktok-android-app-could-lead-to-one-click-account-hijacking/ - FBI’s team to investigate massive cyberattack in Montenegro - https://apnews.com/article/russia-ukraine-technology-hacking-montenegro-2a8eb2df87f657b6d7b9971b74...

[Referências do Episódio] - Rising Tide: Chasing the Currents of Espionage in the South China Sea - https://www.proofpoint.com/us/blog/threat-insight/chasing-currents-espionage-south-china-sea - ModernLoader delivers multiple stealers, cryptominers and RATs - https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html - ALERTA DE SEGURIDAD CIBERNÉTICA: INCIDENTE EN SERV...

[Referências do Episódio] - Check Point Research detects Crypto Miner malware disguised as Google translate desktop and other legitimate applications - https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/ - What is behind Montenegro‘s political instability? - https://www.aljazeera.com/news/20...

[Referências do Episódio] - Kimsuky’s GoldDragon cluster and its C2 operations - https://securelist.com/kimsukys-golddragon-cluster-and-its-c2-operations/107258/ - MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organ...

[Referências do Episódio] - Roasting 0ktapus: The phishing campaign going after Okta identity redentials - https://blog.group-ib.com/0ktapus - Notice of Recent Security Incident - https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/?utm_campaign=social-digest&utm_medium=email&utm_source=newslit - Akamai’s Insights on DNS in Q2 2022 - https://www.akamai.com/blog/security-re...

[Referências do Episódio] Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html Pacotes maliciosos no PyPI - https://twitter.com/pypi/status/1562442188285308929?s=20&t=kEq_E47UqoKVMW9e8VUQeA E https://develop.secure.software/new-malicious-package...