Cyber Morning Call

[Referências do Episódio] - GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool - https://unit42.paloaltonetworks.com/pingpull-gallium/ - Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found under development in the wild - https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/...

[Referências do Episódio] - Symbiote  - https:---blogs.blackberry.com/en/2022/06/symbiote-a-new-nearly-impossible-to-detect-linux-threat - Aoqin Dragon - https:---www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/ - Instagram credentials Stealers - https:---www.mcafee.com/blogs/other-blogs/mcafee-labs/instagram-cred...

[Referências do Episódio] - Permissões indesejadas que podem causar impacto na segurança ao usar a política de ReadOnlyAccess na AWS - https://sidechannel.blog/permissoes-indesejadas-que-podem-causar-impacto-na-seguranca-ao-usar-a-politica-de-readonlyaccess-na-aws/ - CISA aponta as vulnerabilidades mais usadas pela China -  https://www.cisa.gov/uscert/ncas/alerts/aa22-158a - Cuba Ransomware r...

[Referências do Episódio] - Sobre a bagunça causada pelo Lockbit contra a Mandiant - https://www.vice.com/en/article/7k8z4x/lockbit-ransomware-group-evil-corp-beef-alert - Kinsing, Hezb e a botnet dark.iot explorando a CVE-2022-26134 - https://malware.news/t/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/60803 - Pesquisa da cybereason sobre os efeitos do ransomware nas empresas - h...

[Referências do Episódio] - Rússia eleva o tom com os Estados Unidos - https://mid.ru/ru/foreign_policy/news/1816353/ - Black Basta - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ - Suposto ataque do Lockbit contra a Mandiant - https://www.bleepingcomputer.com/news/security/mandiant-no-evidence-we-were-hacked-by-lockbit-ransomware/ - Vulnerabilidades em firewalls Zyxel...

[Referências do Episódio] - Indicação de ataques explorando a CVE-2022-26134 no Confluence - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ - Patches e mais detalhes sobre a CVE-2022-26134 no Confluence - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html - Ataques com zero-day follina - https://decoded.avast.io/thr...

[Referências do Episódio] - Conti possui a capacidade de explorar Firmware UEFI - https://eclypsium.com/2022/06/02/conti-targets-critical-firmware/  - CVE-2022-20210 em chips da UNISOC - https://research.checkpoint.com/2022/vulnerability-within-the-unisoc-baseband/ - Evil Corp dribla sanção com malware de prateleira - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - Clip...

[Referências do Episódio] - Alerta sobre o Karakurt - https://www.cisa.gov/uscert/ncas/alerts/aa22-152a - Extorsão contra donos de repositórios Elasticsearch vulneráveis - https://www.secureworks.com/blog/unsecured-elasticsearch-data-replaced-with-ransom-note - Estudo sobre ataques de DDoS em 2021 - https://www.helpnetsecurity.com/2022/06/01/ddos-attacks-trends/    - Takedown da Flubot -...

[Referências do Episódio] - FÓRUM DA INTERNET DO BRASIL (FIB) TRANSMISSÃO - https://forumdainternet.cgi.br/programacao/detalhe/2/2298/ - Novidades sobre a CVE-2022-30190 (Follina) - https://twitter.com/GossiTheDog/status/1531608245009367040?cxt=HHwWgIC-rbDlrsEqAAAA   - Medidas de mitigação da Microsoft para a Follina (CVE-2022-30190) - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-c...

[Referências do Episódio] - Follina - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e  - Script que gera documentos prontos para explorar a Follina - https://github.com/chvancooten/follina.py - Medidas de mitigação para a Follina (CVE-2022-30190) - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-...

[Referências do Episódio] - Ataque iminente contra organizações italianas - https://www.csirt.gov.it/contenuti/rilevato-potenziale-rischio-di-attacco-informatico-ai-danni-di-enti-ed-organizzazioni-nazionali-al01-220529-csirt-ita - Falhas no framework para Android da mce Systems - https://www.microsoft.com/security/blog/2022/05/27/android-apps-with-millions-of-downloads-exposed-to-high-severity-vul...

[Referências do Episódio] - CVE-2021-46426 no phpIPAM - https://sidechannel.blog/cve-2021-46426-phpipam-1-4-4-permite-xss-refletido-e-csrf-via-funcionalidade-de-sub-redes/ - Detalhes sobre a CVE-2022-22972 - https://www.horizon3.ai/vmware-authentication-bypass-vulnerability-cve-2022-22972-technical-deep-dive/ - Pantsdown em servidores da QTC - https://eclypsium.com/2022/05/26/quanta-servers-still-...

[Referências do Episódio] - Novidades sobre o BPFDoor - https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/ - "Hacker says hijacking libraries, stealing AWS keys was ethical research" - https://www.bleepingcomputer.com/news/security/hacker-says-hijacking-libraries-stealing-aws-keys-was-ethical-research/?utm_source=pocket_mylist - Cheerscrypt - https://www.tre...

[Referências do Episódio] - Verizon's Data Breach Investigations Report - https://www.verizon.com/business/resources/reports/dbir/ - Horizon3 dizendo que reproduziu a exploração da CVE-2022-22972 - https://twitter.com/Horizon3Attack/status/1528935531333177344 - Mais sobre a CVE-2022-22972 - https://www.vmware.com/security/advisories/VMSA-2022-0014.html - Chaos Yashma - https://blogs.blackberry.com...

[Referências do Episódio] - Nova campanha do Turla - https://blog.sekoia.io/turla-new-phishing-campaign-eastern-europe/ - DeepFake em golpe de falsa empresa de criptoativos - https://www.bleepingcomputer.com/news/security/elon-musk-deep-fakes-promote-new-bitvex-cryptocurrency-scam/ - RansomHouse - https://cyberint.com/blog/research/ransomhouse/ - Falha no PayPal - https://fr.techtribune.net/securi...

[Referências do Episódio] - CVE-2022-20821 no Cisco IOS XR - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK - Metastealer - https://research.nccgroup.com/2022/05/20/metastealer-filling-the-racoon-void/ - CVE-2022-1529 e CVE-2022-1802 no Firefox e Thunderbird - https://www.mozilla.org/en-US/security/advisories/mfsa2022-19/ - Mais sobre prototype...

[Referências do Episódio] - Fronton Botnet - https://6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/fronton-report.pdf - Chatbot em página de phishing - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-using-chatbot-like-web-applications-to-harvest-information/ - Pwn2Own Vancouver 2022 - https://www.bleepingcomputer.com/news/security/microsoft-teams-window...

[Referências do Episódio] - CVE-2022-22972 e CVE-2022-22973 no VMWare - https://www.vmware.com/security/advisories/VMSA-2022-0014.html - Mudanças nos acessos de revendedores da Microsoft - https://docs.microsoft.com/en-gb/partner-center/announcements/2022-may#13 - CVE-2022-20759 no Cisco ASA e FTD - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgmt-privesc-...

[Referências do Episódio] - Apple atualiza tudo - https://support.apple.com/en-gb/HT213256  - Mais detalhes sobre a CVE-2022-22675 - https://vuldb.com/?id.196277 - Pesquisa sobre ataques contra Iphones desligados - https://dl.acm.org/doi/pdf/10.1145/3507657.3528547 - Sistemas do Ministério da Saúde estão fora do ar sob suspeita de ataque - https://oglobo.globo.com/saude/noticia/2022/05/sistem...

[Referências do Episódio] - CVE-2022-22282, CVE-2022-1701 e CVE-2022-1702 no SonicWall SMA1000 - https://www.bleepingcomputer.com/news/security/sonicwall-strongly-urges-admins-to-patch-sslvpn-sma1000-bugs/ - Nova variante da botnet Sysrv - https://twitter.com/MsftSecIntel/status/1525158219206860801 - Estão explorando a CVE-2022-30525 - https://twitter.com/Shadowserver/status/1525561213115158529?s=...

[Referências do Episódio] - CVE-2022-30525 em Zyxel firewalls - https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/ - Eternity Malware - https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/ - CVE-2022-27662 e CVE-2022-27880 no F5 Traffix SDC - https://securityaffairs.co/wordpress/131196/hacking/f5-traffix-sdc-fla...

[Referências do Episódio] - Ice Apple - https://www.crowdstrike.com/blog/falcon-overwatch-detects-iceapple-framework/ - Possível ataque dependency confusion no npm - https://jfrog.com/blog/npm-supply-chain-attack-targets-german-based-companies/  - Nerbian RAT - https://www.proofpoint.com/us/blog/threat-insight/nerbian-rat-using-covid-19-themes-features-sophisticated-evasion-techniques - Nova...

[Referências do Episódio] - Campanha contra a industria automobilística alemã - https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/  - Conselho da Europa atribui ataque à Rússia - https://www.consilium.europa.eu/en/press/press-releases/2022/05/10/russian-cyber-operations-against-ukraine-declaration-by-the-high-representative-on-behalf-of-the-european-union...

[Referências do Episódio] - CVE-2022-1388 no BIG-IP está sob ataque - https://www.bleepingcomputer.com/news/security/hackers-exploiting-critical-f5-big-ip-flaw-to-drop-backdoors/ - CVE-2022-29972 no Azure Synapse Pipelines e Azure Data Factory - https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factor...

[Referências do Episódio] - BPFdoor - https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896 - Pesquisadores criam exploits para a CVE-2022-1388 - https://www.bleepingcomputer.com/news/security/exploits-created-for-critical-f5-big-ip-flaw-install-patch-immediately/ - CVE-2022-29176 no RybyGems - https://www.bleepingcomputer.com/news/security/check-your-gems-rubyge...