Cyber Morning Call

[Referências do Episódio] Hikvision Surveillance Cameras Vulnerabilities - CYFIRMA - https://www.cyfirma.com/hikvision-surveillance-cameras-vulnerabilities/ XCSSET Malware Update | macOS Threat Actors Prepare for Life Without Python - SentinelOne - https://www.sentinelone.com/blog/xcsset-malware-update-macos-threat-actors-prepare-for-life-without-python/ New Iranian APT data extraction tool  ...

[Referências do Episódio] - A Tale of PivNoxy and Chinoxy Puppeteer - https://www.fortinet.com/blog/threat-research/pivnoxy-and-chinoxy-puppeteer-analysis - Escanor Malware Delivered In Weaponized Microsoft Office Documents - https://resecurity.com/blog/article/escanor-malware-delivered-in-weaponized-microsoft-office-documents - Known Exploited Vulnerabilities Catalog - https://www.cisa.gov/known-...

[Referências do Episódio] Golpistas usam dados roubados para fraudar Auxílio Caminhoneiro  - https://www.uol.com.br/tilt/noticias/redacao/2022/08/18/golpistas-usam-dados-roubados-para-fraudar-auxilio-caminhoneiro.html You Can’t Audit Me: APT29 Continues Targeting Microsoft 365 - https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft Reservations Requested: TA558 Targets H...

[Referências do Episódio] - APT41 World Tour 2021 on a tight schedule - https://blog.group-ib.com/apt41-world-tour-2021 - THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control - Grandoreiro Banking Trojan with New TTPs Targeting Various Industry Verti...

[Referências do Episódio] - New Google Chrome Zero-Day Vulnerability Being Exploited in the Wild - https://thehackernews.com/2022/08/new-google-chrome-zero-day.html - Thread da ESET sobre campanha do Lazarus - https://twitter.com/ESETresearch/status/1559553324998955010 - Cisco Secure Web Appliance Privilege Escalation Vulnerability - https://tools.cisco.com/security/center/content/CiscoSecurityAdv...

[Referências do Episódio] - RedAlpha Conducts Multi-Year Credential Theft Campaign Targeting Global Humanitarian, Think Tank, and Government Organizations - https://go.recordedfuture.com/hubfs/reports/ta-2022-0816.pdf - PF realiza operação para apurar ataques a sites do Governo Federal - https://www.gov.br/pf/pt-br/assuntos/noticias/2022/08/pf-realiza-operacao-para-apurar-ataques-a-sites-do-govern...

[Referências do Episódio] Evil PLC Attack - Using a Controller as a Predator Rather than Prey- https://claroty.com/team82/blog/evil-plc-attack-using-a-controller-as-predator-rather-than-prey Análise sobre as características sobre as atividades do Patchwork APT no sul da Ásia - https://mp.weixin.qq.com/s/egG0nORZFvo_rCY_zmTgVQ?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=zh-CN&_x_tr_pto=wapp Iron...

[Referências do Episódio] - ONE BOOTLOADER TO LOAD THEM ALL - https://eclypsium.com/2022/08/11/vulnerable-bootloaders-2022/ - Aanhouding verdachte ontwikkelaar van Tornado Cash - https://www.fiod.nl/aanhouding-verdachte-ontwikkelaar-van-tornado-cash/ - Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users - https://www.trendmicro.com/en_us/research/22/h/irontiger-comp...

[Referências do Episódio] - Rapid7 Discovered Vulnerabilities in Cisco ASA, ASDM, and FirePOWER Services Software - https://www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software/ - Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software RSA Private Key Leak Vulnerability - https://tools.cisco.com/security/ce...

[Referências do Episódio] - Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925 - https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/ - Cisco Talos shares insights related to recent cyber attack on Cisco - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html - Andariel deploys DTrack and Maui ransomware - https://sec...

[Referências do Episódio] - Indicadores de Comprometimento na detecção de incidentes e redução de falsos positivos na prática - https://sidechannel.blog/indicadores-de-comprometimento-na-deteccao-de-incidentes-e-reducao-de-falsos-positivos-na-pratica/ - Microsoft August 2022 Patch Tuesday fixes exploited zero-day, 121 flaws - https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2022-pa...

[Referências do Episódio] - Targeted attack on industrial enterprises and public institutions - https://ics-cert.kaspersky.com/publications/reports/2022/08/08/targeted-attack-on-industrial-enterprises-and-public-institutions/ - Global scam operation "Classiscam" expanded to Singapore - https://www.group-ib.com/media/classiscam-singapore-global-scam-operation/ - SSD Advisory – Apple Safari ICU Out-...

[Referências do Episódio] - DGA家族Orchard持续变化，新版本用比特币交易信息生成DGA域名 - https://blog.netlab.360.com/orchard-dga/ - Aviso sobre redefinições de senha no Slack - https://slack.com/intl/pt-br/blog/news/notice-about-slack-password-resets - An incident impacting some accounts and private information on Twitter - https://privacy.twitter.com/en/blog/2022/an-issue-affecting-some-anonymous-...

[Referências do Episódio] - Cisco Small Business RV Series Routers Vulnerabilities - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR - Kaspersky statement on CVE-2022-27535 - https://forum.kaspersky.com/topic/kaspersky-statement-on-cve-2022-27535-26742/ - Coinbase Attacks Bypass 2FA - https://pixmsecurity.com/blog/phish/coinbase-attacks-bypass-2...

[Referências do Episódio] - GUACAMAYA-¡No somos defensoras de la naturaleza, somos la naturaleza! - https://enlacehacktivista.org/comunicado_guacamaya2.txt - 35,000 code repos not hacked—but clones flood GitHub to serve malware - https://www.bleepingcomputer.com/news/security/35-000-code-repos-not-hacked-but-clones-flood-github-to-serve-malware/ - Ongoing solana attack targets thousands of crypto...

[Referências do Episódio] - VMware - VMSA-2022-0021 - https://www.vmware.com/security/advisories/VMSA-2022-0021.html - PF faz operação no DF e em 13 estados contra 'laranjas' que cedem contas bancárias para criminosos; desvios somam R$ 18 milhões - https://g1.globo.com/df/distrito-federal/noticia/2022/08/02/pf-faz-operacao-no-df-e-em-13-estados-contra-laranjas-que-cedem-contas-bancarias-para-crimi...

[Referências do Episódio] - How Leaked Twitter API Keys Can be Used to Build a Bot Army - https://cloudsek.com/whitepapers_reports/how-leaked-twitter-api-keys-can-be-used-to-build-a-bot-army/ - Cyberactivist Group Killnet Declares War on Lockheed Martin - https://sputniknews.com/20220801/cyberactivist-group-killnet-declares-war-on-lockheed-martin-1097998322.html - Space Invaders: Cyber Threats Tha...

[Referências do Episódio] - [CVE-2022-36123] Publish CVE-2022-36123 - https://github.com/sickcodes/security/blob/master/advisories/SICK-2022-128.md - KNOWN EXPLOITED VULNERABILITIES CATALOG - https://www.cisa.gov/known-exploited-vulnerabilities-catalog - Countdown Timer: Ransomware Themed Phishing Attack - https://cofense.com/blog/countdown-timer-ransomware-themed-phishing-attack - Examining New D...

[Referências do Episódio] Exploit of Log4Shell Vulnerability Leads to Compromise of Major South American Vaccine Distributor- https://securityscorecard.com/blog/exploit-of-log4shell-vulnerability-leads-to-compromise-of-major-south-american-vaccine-distributor Pauta interna. How Threat Actors Are Adapting to a Post-Macro World - https://www.proofpoint.com/us/blog/threat-insight/how-threat-actors-ar...

[Referências do Episódio] Robin Banks might be robbing your bank- https://www.ironnet.com/blog/robin-banks-a-new-phishing-as-a-service-platform How cybercriminals are using messaging app to launch malware schemes - https://intel471.com/blog/cybercrime-telegram-discord-automation-chatbots Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Response Repo...

[Referências do Episódio] - Entrevista de Cristiano Lincoln ao Mente Binária -    https://www.youtube.com/watch?v=4UGP5pRS8rQ&t=1s - Malicious IIS extensions quietly open persistent backdoors into servers - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ - Ducktail: an infostealer malware yargeting Faceb...

[Referências do Episódio] - CosmicStrand: the discovery of a sophisticated UEFI firmware rootkit - https://securelist.com/cosmicstrand-uefi-firmware-rootkit/106973/ - Questions For Confluence Security Advisory 2022-07-20 - https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html - WITH MANAGEMENT COMES RISK: FINDING FLAWS IN FILEWAVE MDM - https://...

[Referências do Episódio] - A Hacker Is Selling Twitter Data Of 5.4 Million People For $30,000: All Details - https://www.news18.com/news/tech/a-hacker-is-selling-twitter-data-of-5-4-million-people-for-30000-all-details-5617819.html - Twitter:Discoverability by phone number/email restriction bypass - https://hackerone.com/reports/1439026 - North Korean hackers attack EU targets with Konni RAT malw...

[Referências do Episódio] - The Return of Candiru: Zero-days in the Middle East - https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/ - Attackers target Ukraine using GoMet backdoor - https://blog.talosintelligence.com/2022/07/attackers-target-ukraine-using-gomet.html - Atlas Intelligence Group (A.I.G) – The Wrath of a Titan - https://cyberint.com/blog/research...

[Referências do Episódio] - July 2022: Atlassian Security Advisories Overview - https://confluence.atlassian.com/security/july-2022-atlassian-security-advisories-overview-1142446703.html - LockBit: Ransomware Puts Servers in the Crosshairs - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockbit-targets-servers - Luna and Black Basta — new ransomware for Windows, Linux an...