/ EXFILTRATOR-22 – An Emerging Post-Exploitation Framework
Preliminary analysis of a new post- exploitation framework called EXFILTRATOR-22 a.k.a. EX-22.
Research with MITRE mapping:
— https://www.cyfirma.com/outofband/exfiltrator-22-an-emerging-post-exploitation-framework/
Preliminary analysis of a new post- exploitation framework called EXFILTRATOR-22 a.k.a. EX-22.
Research with MITRE mapping:
— https://www.cyfirma.com/outofband/exfiltrator-22-an-emerging-post-exploitation-framework/
CYFIRMA
EXFILTRATOR-22 - An Emerging Post-Exploitation Framework - CYFIRMA
Executive Summary The CYFIRMA Research team has provided a preliminary analysis of a new post- exploitation framework called EXFILTRATOR-22 a.k.a....
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Linux System Checker Script Tool
Linux System Checker Tool Script it is a bash noscript which can show system info, system load info, test disk speed I/O, show free space and more... System Checker can checks and shows Linux system info like as:
▫️ System Information
▫️ CPU and Memory Information
▫️ Boot Information
▫️ Mount and HDD IO Info
▫️ Top 5 memory and CPU usage processes
▫️ Speedtest
▫️ Defined Systemd Units Services State
▫️ Logged/Process users info
▫️ Listen ports
▫️ Running systemd units as list/tree
▫️ Unowned files
- [en]: Linux System Checker
- [ru]: Скрипт проверки Linux
Linux System Checker Tool Script it is a bash noscript which can show system info, system load info, test disk speed I/O, show free space and more... System Checker can checks and shows Linux system info like as:
▫️ System Information
▫️ CPU and Memory Information
▫️ Boot Information
▫️ Mount and HDD IO Info
▫️ Top 5 memory and CPU usage processes
▫️ Speedtest
▫️ Defined Systemd Units Services State
▫️ Logged/Process users info
▫️ Listen ports
▫️ Running systemd units as list/tree
▫️ Unowned files
- [en]: Linux System Checker
- [ru]: Скрипт проверки Linux
Тест на Observability: Мониторинг, Логирование, Трейсинг
Оценить свои навыки в отношении построения систем оповещений, мониторинга и логирования, таких как Prometheus, Grafana, ELK, Apache kafka, etc. можно попробовать при помощи теста к онлайн-курсу "Observability: мониторинг, логирование, трейсинг"
Админ Linux, DevOps или разработчик должен грамотно управлять бесчисленным множеством серверов, при помощи теста можно проверить себя и посмотреть какие observability тематики предлагает курс.
Как результат можно будет:
— оценить свои навыки
— занять место по спец. цене
— получить доступ к демо-занятиям курса
Детали здесь: https://otus.pw/I3On/
Оценить свои навыки в отношении построения систем оповещений, мониторинга и логирования, таких как Prometheus, Grafana, ELK, Apache kafka, etc. можно попробовать при помощи теста к онлайн-курсу "Observability: мониторинг, логирование, трейсинг"
Админ Linux, DevOps или разработчик должен грамотно управлять бесчисленным множеством серверов, при помощи теста можно проверить себя и посмотреть какие observability тематики предлагает курс.
Как результат можно будет:
— оценить свои навыки
— занять место по спец. цене
— получить доступ к демо-занятиям курса
Детали здесь: https://otus.pw/I3On/
/ Introducing a big update to Windows 11 making the everyday easier including bringing the new AI-powered Bing to the taskbar
— MS Blog Article
— MS Blog Article
Windows Experience Blog
Introducing a big update to Windows 11 making the everyday easier including bringing the new AI-powered Bing to the taskbar
It’s an exciting time in technology, not just for our industry but for the world. The Windows PC has never been more relevant in our daily lives, and this is increasingly the case as we approach the next wave of computing led by the mass adoption o
/ BlackLotus UEFI bootkit
The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality:
— https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality:
— https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
Welivesecurity
BlackLotus UEFI bootkit: Myth confirmed
The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality
/ Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting
Detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems:
https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
Detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems:
https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
Trend Micro
Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting
We detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems.
/ CI/CD Secrets Extraction, Tips And Tricks
on Azure DevOpes, GitHub examples
https://www.synacktiv.com/en/publications/cicd-secrets-extraction-tips-and-tricks.html
on Azure DevOpes, GitHub examples
https://www.synacktiv.com/en/publications/cicd-secrets-extraction-tips-and-tricks.html
Synacktiv
CI/CD secrets extraction, tips and tricks
/ Operation leveraging Terraform, Kubernetes, and AWS for data theft
The Sysdig Threat Research Team recently discovered a sophisticated cloud operation in a customer environment, dubbed SCARLETEEL, that resulted in stolen proprietary data. The attacker exploited a containerized workload and then leveraged it to perform privilege escalation into an AWS account in order to steal proprietary software and credentials. They also attempted to pivot using a Terraform state file to other connected AWS accounts to spread their reach throughout the organization..:
https://sysdig.com/blog/cloud-breach-terraform-data-theft/
The Sysdig Threat Research Team recently discovered a sophisticated cloud operation in a customer environment, dubbed SCARLETEEL, that resulted in stolen proprietary data. The attacker exploited a containerized workload and then leveraged it to perform privilege escalation into an AWS account in order to steal proprietary software and credentials. They also attempted to pivot using a Terraform state file to other connected AWS accounts to spread their reach throughout the organization..:
https://sysdig.com/blog/cloud-breach-terraform-data-theft/
Sysdig
SCARLETEEL: Operation leveraging Terraform, Kubernetes, and AWS for data theft | Sysdig
The Sysdig Threat Research Team recently discovered a sophisticated cloud operation in a customer environment, dubbed SCARLETEEL.
/ MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT
MQsTTang, a new backdoor used by Mustang Panda, which communicates via the MQTT protocol. Technical analysis:
https://www.welivesecurity.com/2023/03/02/mqsttang-mustang-panda-latest-backdoor-treads-new-ground-qt-mqtt/
MQsTTang, a new backdoor used by Mustang Panda, which communicates via the MQTT protocol. Technical analysis:
https://www.welivesecurity.com/2023/03/02/mqsttang-mustang-panda-latest-backdoor-treads-new-ground-qt-mqtt/
WeLiveSecurity
MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT
ESET researchers tease apart MQsTTang, a new backdoor used by the Mustang Panda APT group, which communicates via the MQTT protocol.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Creating a Dynamic Malware Analysis Virtual Machine
https://thelastcitadel.eu/2023/02/18/creating-a-dynamic-malware-analysis-virtual-machine/
https://thelastcitadel.eu/2023/02/18/creating-a-dynamic-malware-analysis-virtual-machine/
/ strongSwan Vulnerability (CVE-2023-26463)
A vulnerability related to certificate verification in TLS-based EAP methods was discovered in strongSwan that results in a denial of service but possibly even remote code execution. Versions 5.9.8 and 5.9.9 may be affected:
https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html
A vulnerability related to certificate verification in TLS-based EAP methods was discovered in strongSwan that results in a denial of service but possibly even remote code execution. Versions 5.9.8 and 5.9.9 may be affected:
https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html
www.strongswan.org
strongSwan - strongSwan Vulnerability (CVE-2023-26463)
/ Gitpod remote code execution 0-day vulnerability via WebSockets
https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/
https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/
Snyk Labs
Gitpod remote code execution 0-day vulnerability via WebSockets | Snyk Labs
/ PyPI Packages Used to Deliver Python Remote Access Tools
— https://www.kroll.com/en/insights/publications/cyber/pypi-packages-deliver-python-remote-access-tools
— https://www.kroll.com/en/insights/publications/cyber/pypi-packages-deliver-python-remote-access-tools
Kroll
While researching initial attack vectors, the Kroll Cyber Threat Intelligence team identified a fully featured information stealer…
/ Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers
In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities:
— https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/
In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities:
— https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/
Security Intelligence
Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers
IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities.
/ Microsoft Word Remote Code Execution Vulnerability
Workaround for CVE-2023-21716:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
Workaround for CVE-2023-21716:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
/ New HiatusRAT Router Malware Covertly Spies On Victims
— https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/
— https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/
Lumen Blog
New HiatusRAT router malware covertly spies on victims
Lumen Black Lotus Labs identified a new campaign involving compromised routers. HiatusRAT allows threat actors to remotely interact with the system.
🙌 Note: Today I’ll update certs on Open Sys-Admin BLD DNS services, this actions could’t affect anything. Have a good day to all!
lab.sys-adm.in
Sys-Admin Laboratory
Open Sys-Admin BLD DNS - Focus on information for free with adblocking and implicit cybersecurity threat prevention.
Открытый урок лог-менеджмента Loki (10 марта)
Открытый урок от OTUS, где вместе с практикующим преподавателем Евгением Павловым будет рассмотрена установка, настройка Loki, а также как с помощью Loki проводить анализ.
Урок пройдет в рамках онлайн-курса "Observability: мониторинг, логирование, трейсинг". Курс можно приобрести в рассрочку.
Чтобы записаться на занятие, необходимо пройти вступительное тестирование:
https://otus.pw/wPwC/
Открытый урок от OTUS, где вместе с практикующим преподавателем Евгением Павловым будет рассмотрена установка, настройка Loki, а также как с помощью Loki проводить анализ.
Урок пройдет в рамках онлайн-курса "Observability: мониторинг, логирование, трейсинг". Курс можно приобрести в рассрочку.
Чтобы записаться на занятие, необходимо пройти вступительное тестирование:
https://otus.pw/wPwC/
/ How SYS01 Stealer Will Get Your Sensitive Facebook Info
— https://blog.morphisec.com/sys01stealer-facebook-info-stealer
— https://blog.morphisec.com/sys01stealer-facebook-info-stealer
/ Prevent phishing based on domain registrations
Based on Microsoft Defender SmartScreen and Enhanced Phishing Protection:
— https://cloudbrothers.info/en/prevent-phishing-based-domain-registrations/
Based on Microsoft Defender SmartScreen and Enhanced Phishing Protection:
— https://cloudbrothers.info/en/prevent-phishing-based-domain-registrations/
cloudbrothers.info
Prevent phishing based on domain registrations
Business email compromise and phishing are just two of the threats sent to hundreds and thousands of email inboxes around the world every day. As defenders, we use various tools and methods to limit the delivery of these emails to the intended target.
In…
In…
/ Samba 4.18.0 Available for Download
https://lists.samba.org/archive/samba-announce/2023/000630.html
https://lists.samba.org/archive/samba-announce/2023/000630.html