/ Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting
Detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems:
https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
Detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems:
https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
Trend Micro
Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting
We detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems.
/ CI/CD Secrets Extraction, Tips And Tricks
on Azure DevOpes, GitHub examples
https://www.synacktiv.com/en/publications/cicd-secrets-extraction-tips-and-tricks.html
on Azure DevOpes, GitHub examples
https://www.synacktiv.com/en/publications/cicd-secrets-extraction-tips-and-tricks.html
Synacktiv
CI/CD secrets extraction, tips and tricks
/ Operation leveraging Terraform, Kubernetes, and AWS for data theft
The Sysdig Threat Research Team recently discovered a sophisticated cloud operation in a customer environment, dubbed SCARLETEEL, that resulted in stolen proprietary data. The attacker exploited a containerized workload and then leveraged it to perform privilege escalation into an AWS account in order to steal proprietary software and credentials. They also attempted to pivot using a Terraform state file to other connected AWS accounts to spread their reach throughout the organization..:
https://sysdig.com/blog/cloud-breach-terraform-data-theft/
The Sysdig Threat Research Team recently discovered a sophisticated cloud operation in a customer environment, dubbed SCARLETEEL, that resulted in stolen proprietary data. The attacker exploited a containerized workload and then leveraged it to perform privilege escalation into an AWS account in order to steal proprietary software and credentials. They also attempted to pivot using a Terraform state file to other connected AWS accounts to spread their reach throughout the organization..:
https://sysdig.com/blog/cloud-breach-terraform-data-theft/
Sysdig
SCARLETEEL: Operation leveraging Terraform, Kubernetes, and AWS for data theft | Sysdig
The Sysdig Threat Research Team recently discovered a sophisticated cloud operation in a customer environment, dubbed SCARLETEEL.
/ MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT
MQsTTang, a new backdoor used by Mustang Panda, which communicates via the MQTT protocol. Technical analysis:
https://www.welivesecurity.com/2023/03/02/mqsttang-mustang-panda-latest-backdoor-treads-new-ground-qt-mqtt/
MQsTTang, a new backdoor used by Mustang Panda, which communicates via the MQTT protocol. Technical analysis:
https://www.welivesecurity.com/2023/03/02/mqsttang-mustang-panda-latest-backdoor-treads-new-ground-qt-mqtt/
WeLiveSecurity
MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT
ESET researchers tease apart MQsTTang, a new backdoor used by the Mustang Panda APT group, which communicates via the MQTT protocol.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Creating a Dynamic Malware Analysis Virtual Machine
https://thelastcitadel.eu/2023/02/18/creating-a-dynamic-malware-analysis-virtual-machine/
https://thelastcitadel.eu/2023/02/18/creating-a-dynamic-malware-analysis-virtual-machine/
/ strongSwan Vulnerability (CVE-2023-26463)
A vulnerability related to certificate verification in TLS-based EAP methods was discovered in strongSwan that results in a denial of service but possibly even remote code execution. Versions 5.9.8 and 5.9.9 may be affected:
https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html
A vulnerability related to certificate verification in TLS-based EAP methods was discovered in strongSwan that results in a denial of service but possibly even remote code execution. Versions 5.9.8 and 5.9.9 may be affected:
https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html
www.strongswan.org
strongSwan - strongSwan Vulnerability (CVE-2023-26463)
/ Gitpod remote code execution 0-day vulnerability via WebSockets
https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/
https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/
Snyk Labs
Gitpod remote code execution 0-day vulnerability via WebSockets | Snyk Labs
/ PyPI Packages Used to Deliver Python Remote Access Tools
— https://www.kroll.com/en/insights/publications/cyber/pypi-packages-deliver-python-remote-access-tools
— https://www.kroll.com/en/insights/publications/cyber/pypi-packages-deliver-python-remote-access-tools
Kroll
While researching initial attack vectors, the Kroll Cyber Threat Intelligence team identified a fully featured information stealer…
/ Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers
In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities:
— https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/
In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities:
— https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/
Security Intelligence
Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers
IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities.
/ Microsoft Word Remote Code Execution Vulnerability
Workaround for CVE-2023-21716:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
Workaround for CVE-2023-21716:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
/ New HiatusRAT Router Malware Covertly Spies On Victims
— https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/
— https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/
Lumen Blog
New HiatusRAT router malware covertly spies on victims
Lumen Black Lotus Labs identified a new campaign involving compromised routers. HiatusRAT allows threat actors to remotely interact with the system.
🙌 Note: Today I’ll update certs on Open Sys-Admin BLD DNS services, this actions could’t affect anything. Have a good day to all!
lab.sys-adm.in
Sys-Admin Laboratory
Open Sys-Admin BLD DNS - Focus on information for free with adblocking and implicit cybersecurity threat prevention.
Открытый урок лог-менеджмента Loki (10 марта)
Открытый урок от OTUS, где вместе с практикующим преподавателем Евгением Павловым будет рассмотрена установка, настройка Loki, а также как с помощью Loki проводить анализ.
Урок пройдет в рамках онлайн-курса "Observability: мониторинг, логирование, трейсинг". Курс можно приобрести в рассрочку.
Чтобы записаться на занятие, необходимо пройти вступительное тестирование:
https://otus.pw/wPwC/
Открытый урок от OTUS, где вместе с практикующим преподавателем Евгением Павловым будет рассмотрена установка, настройка Loki, а также как с помощью Loki проводить анализ.
Урок пройдет в рамках онлайн-курса "Observability: мониторинг, логирование, трейсинг". Курс можно приобрести в рассрочку.
Чтобы записаться на занятие, необходимо пройти вступительное тестирование:
https://otus.pw/wPwC/
/ How SYS01 Stealer Will Get Your Sensitive Facebook Info
— https://blog.morphisec.com/sys01stealer-facebook-info-stealer
— https://blog.morphisec.com/sys01stealer-facebook-info-stealer
/ Prevent phishing based on domain registrations
Based on Microsoft Defender SmartScreen and Enhanced Phishing Protection:
— https://cloudbrothers.info/en/prevent-phishing-based-domain-registrations/
Based on Microsoft Defender SmartScreen and Enhanced Phishing Protection:
— https://cloudbrothers.info/en/prevent-phishing-based-domain-registrations/
cloudbrothers.info
Prevent phishing based on domain registrations
Business email compromise and phishing are just two of the threats sent to hundreds and thousands of email inboxes around the world every day. As defenders, we use various tools and methods to limit the delivery of these emails to the intended target.
In…
In…
/ Samba 4.18.0 Available for Download
https://lists.samba.org/archive/samba-announce/2023/000630.html
https://lists.samba.org/archive/samba-announce/2023/000630.html
/ CorePlague: Severe Vulnerabilities in Jenkins Server Lead to RCE
https://blog.aquasec.com/jenkins-server-vulnerabilities
https://blog.aquasec.com/jenkins-server-vulnerabilities
Aqua
CorePlague: Critical Vulnerabilities in Jenkins Server Lead to RCE
Aqua Research revealed a chain of vulnerabilities CVE-2023-27898, CVE-2023-27905 in Jenkins Server & Update Center which could lead to a complete compromise
/ Stealing the LIGHTSHOW (Part One)
Analysys of phishing campaign targeting a U.S.-based technology companies... The phishing payloads primarily utilized by UNC2970 are Microsoft Word documents embedded with macros to perform remote-template injection to pull down and execute a payload from a remote command and control (C2). Mandiant has observed UNC2970 tailoring the fake job denoscriptions to specific targets:
https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970
Analysys of phishing campaign targeting a U.S.-based technology companies... The phishing payloads primarily utilized by UNC2970 are Microsoft Word documents embedded with macros to perform remote-template injection to pull down and execute a payload from a remote command and control (C2). Mandiant has observed UNC2970 tailoring the fake job denoscriptions to specific targets:
https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970
Google Cloud Blog
Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970 | Mandiant | Google Cloud Blog
/ Vulnerability CVE-2023-27532 in a Veeam Backup & Replication component allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts:
https://www.veeam.com/kb4424
https://www.veeam.com/kb4424
Veeam Software
KB4424: CVE-2023-27532
Vulnerability CVE-2023-27532 in a Veeam Backup & Replication component allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker…
/ Home Assistant Supervisor security vulnerability
Authentication bypass Supervisor API:
https://www.home-assistant.io/blog/2023/03/08/supervisor-security-disclosure/
Authentication bypass Supervisor API:
https://www.home-assistant.io/blog/2023/03/08/supervisor-security-disclosure/
Home Assistant
Disclosure: Supervisor security vulnerability
Disclosure of a security vulnerability found impacting installations using the Home Assistant Supervisor.
/ GoBruteforcer: Golang-Based Botnet Actively Harvests Web Servers
https://unit42.paloaltonetworks.com/gobruteforcer-golang-botnet/
https://unit42.paloaltonetworks.com/gobruteforcer-golang-botnet/
Unit 42
GoBruteforcer: Golang-Based Botnet Actively Harvests Web Servers
New Golang-based malware we have dubbed GoBruteforcer targets web servers. Golang is becoming popular with malware programmers due to its versatility.