Cyber Morning Call

[Referências do Episódio] - Apple, Google e Microsoft adotarão mesmo padrão logins sem senha - https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/ - CVE-2022-26522 e CVE-2022-26523 no Avast e AVG - https://www.sentinelone.com/labs/vulnerabilities-in-avast-and-avg-put-millions-at-risk/ - NetDooka Frame...

[Referências do Episódio] - CVE-2022-1388 No BIG-IP - https://support.f5.com/csp/article/K23605346 - Operation CuckooBees - https://www.cybereason.com/blog/operation-cuckoobees-a-winnti-malware-arsenal-deep-dive - Outra campanha que abusava do CLFS - https://www.mandiant.com/resources/unknown-actor-using-clfs-log-files-for-stealth - Relatório do FBI sobre BEC - https://www.ic3.gov/Media/Y2022/PSA2...

[Referências do Episódio] - TLStorm 2.0  - https://www.armis.com/blog/tlstorm-2-nanossl-tls-library-misuse-leads-to-vulnerabilities-in-common-switches/ - C6 é vítima de fraude - https://veja.abril.com.br/coluna/radar-economico/brecha-no-c6-bank-leva-correntistas-a-desviarem-23-milhoes/ - Boletim de segurança da Mozilla para o Firefox - https://www.mozilla.org/en-US/security/advisories/mfsa202...

[Referências do Episódio] - UNC3524 - https://www.mandiant.com/resources/unc3524-eye-spy-email - Pegasus foi usado contra o governo da Espanha - https://www.theguardian.com/world/2022/may/02/spain-prime-minister-pedro-sanchez-phone-pegasus-spyware - Programa de bug bounty da HackerOne com o DoD - https://www.hackerone.com/press-release/12-month-dib-vdp-pilot-concludes - Campanha do Moshen Dragon a...

[Referências do Episódio] - Ataque contra a Rari Capital e Fei Protocol - https://securityaffairs.co/wordpress/130768/hacking/80m-hack-defi-rari-capital-fei-protocol.html - Sobre Reentrancy Attacks - https://hackernoon.com/hack-solidity-reentrancy-attack - Volta do REvil foi confirmada - https://www.bleepingcomputer.com/news/security/revil-ransomware-returns-new-malware-sample-confirms-gang-is-bac...

[Referências do Episódio] - Bumblebee Loader - https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming - As 12 técnicas de Process Injection - https://attack.mitre.org/techniques/T1055/ - Vulnerabilidades no Azure Database for PostgreSQL Flexible Server - https://www.wiz.io/blog/wiz-research-discovers-extrareplica-cross-account-database-vulnerability-in-azure-postgresql/...

[Referências do Episódio] - Documento da Microsoft sobre a guerra híbrida na Ucrânia - https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd - TA410 é decomposto  - https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ - Nova campanha do Mustang Panda com o Plugx - https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-...

[Referências do Episódio] - Vulnerabilidades Nimbuspwn - https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/ - Emotet está testando novo vetor via add-ins do Office - https://www.proofpoint.com/us/blog/threat-insight/emotet-tests-new-delivery-techniques - Como desativar a execução de add-ins do Office - https://docs.microsoft...

[Referências do Episódio] - Bored Ape Yacht Club é atacado e NFTs são roubados - https://www.vice.com/en/article/88gpxg/bored-ape-yacht-club-instagram-hacked-nfts-worth-millions-stolen - Prynt Stealer - https://www.bleepingcomputer.com/news/security/new-powerful-prynt-stealer-malware-sells-for-just-100-per-month/ - Novos sinais de exploração da CVE-2022-22954 - https://blog.morphisec.com/vmware-id...

[Referências do Episódio] - CVE-2022-0540 No Jira - https://confluence.atlassian.com/jira/jira-security-advisory-2022-04-20-1115127899.html - LAPSUS$ atacou a T-Mobile - https://krebsonsecurity.com/2022/04/leaked-chats-show-lapsus-stole-t-mobile-source-code/ - Nova campanha do criptomalware LemonDuck tem como alvo APIs Docker mal configuradas - https://www.crowdstrike.com/blog/lemonduck-botnet-tar...

[Referências do Episódio] - Trojan bancário Mekotio é identificado em nova campanha contra correntistas brasileiros - https://sidechannel.blog/trojan-bancario-mekotio-e-identificado-em-nova-campanha-contra-correntistas-brasileiros/ - Correção da AWS para o Log4Shell com problemas - https://thehackernews.com/2022/04/amazons-hotpatch-for-log4j-flaw-found.html - A volta do REvil - https://www.bleepin...

[Referências do Episódio] - Fim do SMBv1 - https://techcommunity.microsoft.com/t5/storage-at-microsoft/smb1-now-disabled-by-default-for-windows-11-home-insiders-builds/ba-p/3289473 - Vulnerabilidades no Firmware UEFI da Lenovo - https://www.welivesecurity.com/2022/04/19/when-secure-isnt-secure-uefi-vulnerabilities-lenovo-consumer-laptops/ e https://support.lenovo.com/br/en/product_security/len-734...

[Referências do Episódio] - CatalanGate - https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/ - Ataques usando VSTO e Add-ins do Office - https://medium.com/@airlockdigital/make-phishing-great-again-vsto-office-files-are-the-new-macro-nightmare-e09fcadef010 - Decifrador para o Yanluowang - https://securelist.com/how-to-recover-fil...

[Referências do Episódio] - Roubo de tokens Oauth - https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/ - Lazarus responsabilizado pelo ataque à Ronin Network - https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-attribution-of-malicious-cyber-activity-posed-by-the-democratic-peoples-republic-of-korea e https://home.treasury.gov/policy-issues/financial-sanctions/r...

[Referências do Episódio] - Takedown da Zloader - https://blogs.microsoft.com/on-the-issues/2022/04/13/zloader-botnet-disrupted-malware-ukraine/ - CVE-2021-31805 no Apache Struts -   https://www.cisa.gov/uscert/ncas/current-activity/2022/04/12/apache-releases-security-advisory-struts-2 - Exploit para VMware - https://www.bleepingcomputer.com/news/security/hackers-exploiting-vmware-server...

[Referências do Episódio] - Fim da linha para o RaidForums - https://www.reuters.com/legal/government/us-european-partners-announce-takedown-hacker-website-raidforums-2022-04-12/ - Fim do mistério sobre a falha no Nginx - https://www.nginx.com/blog/addressing-security-weaknesses-nginx-ldap-reference-implementation/ - JekyllBot:5 - https://assets.website-files.com/5d2ad783e06f4c19469d363a/625551dd4...

[Referências do Episódio] - Alerta do CERT da Ucrânia - https://cert.gov.ua/article/39518 - Fakecalls banking trojan - https://www.kaspersky.com/blog/fakecalls-banking-trojan/44072/ - Scans em busca da vuln CVE-2022-22947 no Spring Cloud - https://isc.sans.edu/forums/diary/Spring+It+isnt+just+about+Spring4Shell+Spring+Cloud+Function+Vulnerabilities+are+being+probed+too/28538/ - CVE-2022-24814 no D...

[Referências do Episódio] - RCE no Nginx (Será?) - https://github.com/AgainstTheWest/NginxDay#readme e https://twitter.com/Gi7w0rm/status/1512789855197093891 - Sobre o uso do conti contra empresas rusas - https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/ - Um bom panorama histórico sobre o vazamento do Conti - https://www.wired.com/sto...

[Referências do Episódio] - Parrot TDS - https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/ - Estudo sobre o Sharkbot - https://research.checkpoint.com/2022/google-is-on-guard-sharks-shall-not-pass/ - FFDroider - https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users - [Palestra] - Making Order out of Chaos:...

[Referências do Episódio] - 8 novas vulnerabilidades em produtos VMware - https://core.vmware.com/vmsa-2022-0011-questions-answers-faq#sec19795-sub2 - Análise do malware Denonia - https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/ - Apps falsos para a coleta de dados de correntistas na Malasia - https://www.welivesecurity.com/2022/04/06/fake-eshops...

[Referências do Episódio] - Nova campanha do APT10 - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-china-ngo-government-attacks - Tentativas de exploração da Spring4Shell detectadas pela Microsoft -https://www.bleepingcomputer.com/news/security/microsoft-detects-spring4shell-attacks-across-its-cloud-services/ - Nova versão do crypter 3LOSH ganha popularidade...

[Referências do Episódio] - Novo estudo sobre o FIN7 - https://www.mandiant.com/resources/evolution-of-fin7 - Incidente na MailChimp esteve no contexto do ataque contra a Trezor - https://www.bleepingcomputer.com/news/security/hackers-breach-mailchimps-internal-tools-to-target-crypto-customers/ - CVE-2022-22965 em produtos da VMware - https://www.vmware.com/security/advisories/VMSA-2022-0010.html...

[Referências do Episódio] - Ataque contra clientes da Trezor - https://www.bleepingcomputer.com/news/security/fake-trezor-data-breach-emails-used-to-steal-cryptocurrency-wallets/ - CVE-2022-1015 e CVE-2022-1016 no netfilter - https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/ - Indiciamentos ligados ao LAPSUS$ - https://www.bbc.com/news/technology-60953527 - Borat RA...

[Referências do Episódio] - Wiper AcidRain - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ - CVE-2022-22965 no Spring Framework  - https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement e https://isc.sans.edu/forums/diary/Spring+Vulnerability+Update+Exploitation+Attempts+CVE202222965/28504/ - Ransomware para o Jupyter Notebook - https://theha...

[Referências do Episódio] - CVE-2022-22963 no Spring Cloud - https://tanzu.vmware.com/security/cve-2022-22963 - Spring4Shell - https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html - Condições para a exploraçÃo da Spring4Shell - https://twitter.com/wdormann/status/1509280535071309827?s=20&t=0m7R1YTB4HjykU9mxhpMSg - Um panorama sobre as duas falhas no Spring - https://isc...