Cyber Morning Call

[Referências do Episódio] I see what you did there: A look at the CloudMensis macOS spyware - https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/ Authomize Discovers PassBleed Password Stealing and Impersonation Risks in Okta - https://www.authomize.com/blog/authomize-discovers-password-stealing-and-impersonation-risks-to-in-okta/ New Variant of QakBo...

[Referências do Episódio] PREMINT NFT Incident Analysis - https://www.certik.com/resources/blog/77oaazrsx1mewnraJePYQI-premint-nft-incident-analysis Shortcut-Based (LNK) Attacks Delivering Malicious Code On The Rise - https://resecurity.com/blog/article/shortcut-based-lnk-attacks-delivering-malicious-code-on-the-rise  Ongoing Roaming Mantis smishing campaign targeting France - https://blog.se...

[Referências do Episódio] - Digium Phones Under Attack: Insight Into the Web Shell Implant - https://unit42.paloaltonetworks.com/digium-phones-web-shell/ - Cache-based Targeted Deanonymization Attacks -  https://leakuidatorplusteam.github.io/ - STOP/DJVU Employs Vidar Stealer Before Encrypting Files - https://labs.k7computing.com/index.php/stop-djvu-employs-vidar-stealer-before-encrypting-fil...

[Referências do Episódio] Mantis - the most powerful botnet to date - https://blog.cloudflare.com/mantis-botnet/ “BlackCat ransomware attacks not merely a byproduct of badluck - https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/ New Wine, Old Bottle: Abused QuickBooks Site Sends Phone Scam Emails - https://www.inky.com/en/blog/abused-quickbooks...

[Referências do Episódio] - Lenovo Security Advisory: LEN-91369 - https://support.lenovo.com/sk/en/product_security/len-91369 - Autolycos: Discover the latest malware family that subscribes users to premium services. - https://www.evina.com/wp-content/uploads/2022/07/Autolycos-New-Malware-Family.pdf - X.Org Security Advisory: July 12, 2022 - https://lists.x.org/archives/xorg/2022-July/061035.html...

[Referências do Episódio] - Microsoft July 2022 Patch Tuesday - https://isc.sans.edu/diary/rss/28838 - Siemens Security Advisories - https://new.siemens.com/global/en/products/services/cert.html?s=CVE-2022#SecurityPublications - Schneider Electric Security Advisories - https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp - VMware VMSA-2022-0018 - https://www.vmware.com/se...

[Referências do Episódio] - Anubis Network is back with new C2 server - https://seguranca-informatica.pt/anubis-networks-is-back-with-new-c2-server/#.Ysv53XZBy5d - PyPI 2FA Security Key Giveaway - https://pypi.org/security-key-giveaway/ - SELECT XMRig FROM SQLServer - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ - Microsoft still plans to block Office macros by default after t...

[Referências do Episódio] - 3a Pesquisa Tempest de cibersegurança - https://www.tempest.com.br/editorias/ - Equipes de cibersegurança no Brasil ainda são pequenas, aponta pesquisa - https://www1.folha.uol.com.br/tec/2022/07/equipes-de-ciberseguranca-no-brasil-ainda-sao-pequenas-aponta-pesquisa.shtml - Ciberataques: 4 em cada 10 empresas sofreram ataques hackers graves no país - https://g1.globo.co...

[Referências do Episódio] Unprecedented Shift: The Trickbot Group is Systematically Attacking Ukraine - https://securityintelligence.com/posts/trickbot-group-systematically-attacking-ukraine/ “CuteBoi” Detected Preparing A Large Scale Crypto Mining Campaign On NPM Users - https://checkmarx.com/blog/cuteboi-detected-preparing-a-large-scale-crypto-mining-campaign-on-npm-users/ NoMercy Stealer Adding...

[Referências do Episódio] - Stealers, vendas de acesso e ransomware: cadeia de suprimentos e modelos de negócio no cibercrime - https://sidechannel.blog/stealers-vendas-de-acesso-e-ransomware-cadeia-de-suprimentos-e-modelos-de-negocio-no-cibercrime/ - Alert (AA22-187A): North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector - https://www.cis...

[Referências do Episódio] - Hive ransomware gets upgrades in Rust - https://www.microsoft.com/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/ - Microsoft quietly fixes ShadowCoerce Windows NTLM Relay bug - https://www.bleepingcomputer.com/news/microsoft/microsoft-quietly-fixes-shadowcoerce-windows-ntlm-relay-bug/ - IconBurst: NPM software supply chain attack grabs data from apps, w...

[Referências do Episódio] - Lista de Alto Risco da Administração Pública Federal 2022 - Segurança da informação e segurança cibernética - https://sites.tcu.gov.br/listadealtorisco/seguranca_da_informacao_e_seguranca_cibernetica.html - Django security releases issued: 4.0.6 and 3.2.14 - https://www.djangoproject.com/weblog/2022/jul/04/security-releases/ - Issue 2268: Windows: Windows Defender Remot...

[Referências do Episódio] - Microsoft finds Raspberry Robin worm in hundreds of Windows networks - https://www.bleepingcomputer.com/news/security/microsoft-finds-raspberry-robin-worm-in-hundreds-of-windows-networks/ - CISA Adds One Known Exploited Vulnerability to Catalog - https://www.cisa.gov/uscert/ncas/current-activity/2022/07/01/cisa-adds-one-known-exploited-vulnerability-catalog - GUIDANCE O...

[Referências do Episódio] - Countering hack-for-hire groups - https://blog.google/threat-analysis-group/countering-hack-for-hire-groups/ - Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit - https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html - Alert (AA22-181A) - #StopRansomwa...

[Referências do Episódio] - YTStealer Malware: “YouTube Cookies! Om Nom Nom Nom” - https://www.intezer.com/blog/research/ytstealer-malware-youtube-cookies/ - Unrar Path Traversal Vulnerability affects Zimbra Mail - https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/ - Mozilla Foundation Security Advisory 2022-24 - https://www.mozilla.org/en-US/security/advisories/mfsa2022-24/ - Smash-...

[Referências do Episódio] - Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - Raccoon Stealer v2 – Part 1: The return of the dead - https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/ - AMD investigates RansomHouse hack claims, theft of 450GB...

[Referências do Episódio] - Attacks on industrial control systems using ShadowPad - https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/ - LockBit 3.0 introduces the first ransomware bug bounty program - https://www.bleepingcomputer.com/news/security/lockbit-30-introduces-the-first-ransomware-bug-bounty-program/ - Russian group claim...

[Referências do Episódio] - Hacker selling access to 50 vulnerable networks through Atlassian vulnerability - https://therecord.media/hacker-selling-access-to-50-vulnerable-networks-through-atlassian-vulnerability/ - Citrix Hypervisor Security Update - https://support.citrix.com/article/CTX460064/citrix-hypervisor-security-update - Python packages upload your AWS keys, env vars, secrets to the web...

[Referências do Episódio] - Kaspersky Crimeware Reports: Common TTPs of modern ransomware groups - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - Fast Shop diz ter recuperado conta no Twitter após 'acesso não autorizado' - https://g1.globo.com/economia/noticia/2022/06/23/fast-shop-diz-ter-recuperado-conta-no-twi...

[Referências do Episódio] - Mega: Malleable Encryption Goes Awry - https://mega-awry.io/ - Fotos: PF apreende carros de luxo, relógios e joias em operação contra hackers - https://g1.globo.com/es/espirito-santo/noticia/2022/06/22/fotos-pf-apreende-carros-de-luxo-relogios-e-joias-em-operacao-contra-hackers.ghtml - Avos ransomware group expands with new attack arsenal - https://blog.talosintelligenc...

[Referências do Episódio] - OT:ICEFALL - The legacy of “insecure by design” and its implications for certifications and risk management - https://www.forescout.com/resources/ot-icefall-report/ - Unveiling an unknown APT actor attacking high-profile entities in Europe and Asia - https://securelist.com/toddycat/106799/ - Russia’s APT28 uses fear of nuclear war to spread Follina docs in Ukraine - htt...

[Referências do Episódio] - DFSCoerce - https://github.com/Wh04m1001/DFSCoerce - Recent Windows Server updates break VPN, RDP, RRAS connections - https://www.bleepingcomputer.com/news/microsoft/recent-windows-server-updates-break-vpn-rdp-rras-connections/ - Windows emergency update fixes Microsoft 365 issues on Arm devices - https://www.bleepingcomputer.com/news/microsoft/windows-emergency-update-...

[Referências do Episódio] - INSCRIÇÕES PARA O TURING DAY - https://www.even3.com.br/turingday2022/ - Investigating - DeadBolt Ransomware - https://www.qnap.com/en/security-advisory/QSA-22-19    - QNAP NAS devices targeted by surge of eCh0raix ransomware attacks - https://www.bleepingcomputer.com/news/security/qnap-nas-devices-targeted-by-surge-of-ech0raix-ransomware-attacks/ - BRATA is e...

[Referências do Episódio] - Thousands of IDs exposed in yet another data breach in Brazil - https://blog.group-ib.com/brazil-exposed-db - DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach - https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/ - F5 Labs Investigates MaliBot - https://www.f5.com/labs/articles...

[Referências do Episódio] - Cloudflare mitigates 26 million request per second DDoS attack - https://blog.cloudflare.com/26m-rps-ddos/ - Microsoft June 2022 Patch Tuesday fixes 1 zero-day, 55 flaws - https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2022-patch-tuesday-fixes-1-zero-day-55-flaws/ - Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access T...