/ Cl0p Ransomware Targets Linux Systems with Flawed Encryption | Decryptor Available

https://www.sentinelone.com/labs/cl0p-ransomware-targets-linux-systems-with-flawed-encryption-decryptor-available/

/ OpenSSL Security Advisory [7th February]

Severity: High

There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName.

https://www.openssl.org/news/secadv/20230207.txt

ESXiArgs-Recover is a tool to allow organizations to attempt recovery of virtual machines affected by the ESXiArgs ransomware attacks:

https://github.com/cisagov/ESXiArgs-Recover

/ THREAT ALERT: GootLoader - SEO Poisoning and Large Payloads Leading to Compromise

Full deep dive analyses

Bash noscripting - DNS Tester Tool

DNS Tester Tool can test speed response for IP addresses from list and collect and show speed statistics in terminal:

— IP address
— Average response
— Minimal time of response
— Maximum time of response

• [en] - https://lab.sys-adm.in/blog/tool-dns-tester
• [ru] - https://lab.sys-adm.in/ru/blog/tool-dns-tester

/ High Vulnerability – Dahua – CVE-2022-30564

Redinent Researchers discovered unauthorised device timestamp modification vulnerability in Dahua products.

— https://www.redinent.com/blog/dahua-cve-2022-30564/

/ Reddit was hacked

Reddit systems were hacked as a result of a sophisticated and highly-targeted phishing attack. They gained access to some internal documents, code, and some internal business systems..:

https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_security_incident_heres_what_we_know/

/ Globalping CLI

This CLI tool provide access a global network of probes without leaving console. In short: this tool allow use ping from different regions from the world, example:

globalping ping lab.sys-adm.in --from "Paris"

Tool supplied in docker, or pre-builded packages, or own build binary which can build with Go. Repo:

— https://github.com/jsdelivr/globalping-cli

Tis project has API, which can try on link: https://api.globalping.io/demo/

/ Fool’s Gold: dissecting a fake gold market pig-butchering scam

Scammers use counterfeit bank website, hijacked legitimate app to defraud and steal identifying information:

https://news.sophos.com/en-us/2023/02/13/fools-gold-dissecting-a-fake-gold-market-pig-butchering-scam/

/ iOS, iPadOS, macOS, and Safari Under Attack with New Zero-Day

CVE-2023-23529 - bug in the WebKit browser engine that could be activated when processing maliciously crafted web content, culminating in arbitrary code execution:

— macOS: https://support.apple.com/en-us/HT213633
— iOS: https://support.apple.com/en-us/HT213635
— Safari: https://support.apple.com/en-us/HT213638

/ Crypto Wallet Address Replacement Attack

https://blog.phylum.io/phylum-discovers-revived-crypto-wallet-address-replacement-attack

Network Pentesting MindMap

— https://github.com/c4s73r/NetworkNightmare

/ Windows Graphics Component Remote Code Execution Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21823

/ VMware ESXi 8.0b Release Notes

https://docs.vmware.com/en/VMware-vSphere/8.0/rn/vsphere-esxi-80b-release-notes/index.html

/ Android launches yet another way to spy on users with “Privacy Sandbox” beta

https://arstechnica.com/gadgets/2023/02/googles-privacy-sandbox-advertising-system-arrives-on-android-in-beta/

/ Citrix Releases Security Updates for Workspace Apps, Virtual Apps and Desktops

Emergency note from CISA:

https://www.cisa.gov/uscert/ncas/current-activity/2023/02/14/citrix-releases-security-updates-workspace-apps-virtual-apps-and

/ Remote code execution flaw patched in Apache Kafka

https://portswigger.net/daily-swig/remote-code-execution-flaw-patched-in-apache-kafka

/ ClamAV fixed a possible remote code execution vulnerability

https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html

/ Hijack Explorer Context Menu for Persistence & Fun

Learn how I hijacked the explorer context menu to execute my beacon at each right click on a file/folder:

— https://ristbs.github.io/2023/02/15/hijack-explorer-context-menu-for-persistence-and-fun.html

/ Atlassian Data Leak 🤦

Atlassian has confirmed that a breach at a "third-party vendor" caused a recent leak of company data and that their network and customer information..:

https://www.bleepingcomputer.com/news/security/atlassian-says-recent-data-leak-stems-from-third-party-vendor-hack/

/ Mirai Variant V3G4 Targets IoT Devices

https://unit42.paloaltonetworks.com/mirai-variant-v3g4/