/ PyPI Packages Used to Deliver Python Remote Access Tools
— https://www.kroll.com/en/insights/publications/cyber/pypi-packages-deliver-python-remote-access-tools
— https://www.kroll.com/en/insights/publications/cyber/pypi-packages-deliver-python-remote-access-tools
Kroll
While researching initial attack vectors, the Kroll Cyber Threat Intelligence team identified a fully featured information stealer…
/ Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers
In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities:
— https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/
In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities:
— https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/
Security Intelligence
Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers
IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities.
/ Microsoft Word Remote Code Execution Vulnerability
Workaround for CVE-2023-21716:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
Workaround for CVE-2023-21716:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
/ New HiatusRAT Router Malware Covertly Spies On Victims
— https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/
— https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/
Lumen Blog
New HiatusRAT router malware covertly spies on victims
Lumen Black Lotus Labs identified a new campaign involving compromised routers. HiatusRAT allows threat actors to remotely interact with the system.
🙌 Note: Today I’ll update certs on Open Sys-Admin BLD DNS services, this actions could’t affect anything. Have a good day to all!
lab.sys-adm.in
Sys-Admin Laboratory
Open Sys-Admin BLD DNS - Focus on information for free with adblocking and implicit cybersecurity threat prevention.
Открытый урок лог-менеджмента Loki (10 марта)
Открытый урок от OTUS, где вместе с практикующим преподавателем Евгением Павловым будет рассмотрена установка, настройка Loki, а также как с помощью Loki проводить анализ.
Урок пройдет в рамках онлайн-курса "Observability: мониторинг, логирование, трейсинг". Курс можно приобрести в рассрочку.
Чтобы записаться на занятие, необходимо пройти вступительное тестирование:
https://otus.pw/wPwC/
Открытый урок от OTUS, где вместе с практикующим преподавателем Евгением Павловым будет рассмотрена установка, настройка Loki, а также как с помощью Loki проводить анализ.
Урок пройдет в рамках онлайн-курса "Observability: мониторинг, логирование, трейсинг". Курс можно приобрести в рассрочку.
Чтобы записаться на занятие, необходимо пройти вступительное тестирование:
https://otus.pw/wPwC/
/ How SYS01 Stealer Will Get Your Sensitive Facebook Info
— https://blog.morphisec.com/sys01stealer-facebook-info-stealer
— https://blog.morphisec.com/sys01stealer-facebook-info-stealer
/ Prevent phishing based on domain registrations
Based on Microsoft Defender SmartScreen and Enhanced Phishing Protection:
— https://cloudbrothers.info/en/prevent-phishing-based-domain-registrations/
Based on Microsoft Defender SmartScreen and Enhanced Phishing Protection:
— https://cloudbrothers.info/en/prevent-phishing-based-domain-registrations/
cloudbrothers.info
Prevent phishing based on domain registrations
Business email compromise and phishing are just two of the threats sent to hundreds and thousands of email inboxes around the world every day. As defenders, we use various tools and methods to limit the delivery of these emails to the intended target.
In…
In…
/ Samba 4.18.0 Available for Download
https://lists.samba.org/archive/samba-announce/2023/000630.html
https://lists.samba.org/archive/samba-announce/2023/000630.html
/ CorePlague: Severe Vulnerabilities in Jenkins Server Lead to RCE
https://blog.aquasec.com/jenkins-server-vulnerabilities
https://blog.aquasec.com/jenkins-server-vulnerabilities
Aqua
CorePlague: Critical Vulnerabilities in Jenkins Server Lead to RCE
Aqua Research revealed a chain of vulnerabilities CVE-2023-27898, CVE-2023-27905 in Jenkins Server & Update Center which could lead to a complete compromise
/ Stealing the LIGHTSHOW (Part One)
Analysys of phishing campaign targeting a U.S.-based technology companies... The phishing payloads primarily utilized by UNC2970 are Microsoft Word documents embedded with macros to perform remote-template injection to pull down and execute a payload from a remote command and control (C2). Mandiant has observed UNC2970 tailoring the fake job denoscriptions to specific targets:
https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970
Analysys of phishing campaign targeting a U.S.-based technology companies... The phishing payloads primarily utilized by UNC2970 are Microsoft Word documents embedded with macros to perform remote-template injection to pull down and execute a payload from a remote command and control (C2). Mandiant has observed UNC2970 tailoring the fake job denoscriptions to specific targets:
https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970
Google Cloud Blog
Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970 | Mandiant | Google Cloud Blog
/ Vulnerability CVE-2023-27532 in a Veeam Backup & Replication component allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts:
https://www.veeam.com/kb4424
https://www.veeam.com/kb4424
Veeam Software
KB4424: CVE-2023-27532
Vulnerability CVE-2023-27532 in a Veeam Backup & Replication component allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker…
/ Home Assistant Supervisor security vulnerability
Authentication bypass Supervisor API:
https://www.home-assistant.io/blog/2023/03/08/supervisor-security-disclosure/
Authentication bypass Supervisor API:
https://www.home-assistant.io/blog/2023/03/08/supervisor-security-disclosure/
Home Assistant
Disclosure: Supervisor security vulnerability
Disclosure of a security vulnerability found impacting installations using the Home Assistant Supervisor.
/ GoBruteforcer: Golang-Based Botnet Actively Harvests Web Servers
https://unit42.paloaltonetworks.com/gobruteforcer-golang-botnet/
https://unit42.paloaltonetworks.com/gobruteforcer-golang-botnet/
Unit 42
GoBruteforcer: Golang-Based Botnet Actively Harvests Web Servers
New Golang-based malware we have dubbed GoBruteforcer targets web servers. Golang is becoming popular with malware programmers due to its versatility.
/ Microsoft 365 enumeration, spraying and exfiltration - TeamFiltration in the spotlight
TeamFiltration is self-defined as a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts.
Article, we will look at its capabilities and how we can potentially detect related events in Azure AD and Microsoft 365 logs. While the article focuses on TeamFiltration, the learnings apply to any similar toolset:
— https://guillaumeben.xyz/Microsoft-365-enumeration/
TeamFiltration is self-defined as a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts.
Article, we will look at its capabilities and how we can potentially detect related events in Azure AD and Microsoft 365 logs. While the article focuses on TeamFiltration, the learnings apply to any similar toolset:
— https://guillaumeben.xyz/Microsoft-365-enumeration/
/ YouTube under fire for allegedly gathering children's data
YouTube collects children’s data… Little steps for settings up YouTube Kids for more protect from harmful activitires from media platform:
— https://www.malwarebytes.com/blog/news/2023/03/youtube-under-fire-for-allegedly-gathering-uk-childrens-data
YouTube collects children’s data… Little steps for settings up YouTube Kids for more protect from harmful activitires from media platform:
— https://www.malwarebytes.com/blog/news/2023/03/youtube-under-fire-for-allegedly-gathering-uk-childrens-data
Malwarebytes
YouTube under fire for allegedly gathering children’s data
The complaint asserts that YouTube collected “the location, viewing habits and preferences” of up to five million children.
/ Kali Linux 2023.1 Release (Kali Purple & Python Changes)
https://www.kali.org/blog/kali-linux-2023-1-release/
https://www.kali.org/blog/kali-linux-2023-1-release/
Kali Linux
Kali Linux 2023.1 Release (Kali Purple & Python Changes) | Kali Linux Blog
Today we are releasing Kali 2023.1 (and on our 10th anniversary)! It will be ready for immediate download or updating by the time you have finished reading this post.
Given its our 10th anniversary, we are delighted to announce there are a few special things…
Given its our 10th anniversary, we are delighted to announce there are a few special things…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
GOAD (Game Of Active Directory) - version 2
GOAD is a pentest active directory LAB project. The purpose of this lab is to give pentesters a vulnerable Active directory environment ready to use to practice usual attack techniques:
-- https://github.com/Orange-Cyberdefense/GOAD
GOAD is a pentest active directory LAB project. The purpose of this lab is to give pentesters a vulnerable Active directory environment ready to use to practice usual attack techniques:
-- https://github.com/Orange-Cyberdefense/GOAD
/ Windows SmartScreen Security Feature Bypass Vulnerability
Impact: Security Feature Bypass, CVE-2023-24880
— https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24880
/ Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability
Impact: Remote Code Execution Max Severity: Critical
— https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23415
P.S. thx for the link for RCE my dear friend ✌️
Impact: Security Feature Bypass, CVE-2023-24880
— https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24880
/ Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability
Impact: Remote Code Execution Max Severity: Critical
— https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23415
P.S. thx for the link for RCE my dear friend ✌️
/ Microsoft Mitigates Outlook Elevation of Privilege Vulnerability
Impacted Products:
All supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected:
— https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
Impacted Products:
All supported versions of Microsoft Outlook for Windows are affected. Other versions of Microsoft Outlook such as Android, iOS, Mac, as well as Outlook on the web and other M365 services are not affected:
— https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
Намечается новая кибер-конфа в Алматы - AppSecFest
Совпало, что я оказался знаком с организаторами данной конфы - это будет апрель 2023, это будет посвящено Application Security и DevSecOps тематикам в РК.
Организаторы обещают:
• Качественный нетворкинг
• 250+ участников
• 8-ми часовую длительность + афтепати
• Стенды от вендоров
• Проходить будет 21 апреля, ТЦ Forum Алматы
Заявки на доклады - appsecfest@astlab.kz, сайт - https://appsecfest.kz
Совпало, что я оказался знаком с организаторами данной конфы - это будет апрель 2023, это будет посвящено Application Security и DevSecOps тематикам в РК.
Организаторы обещают:
• Качественный нетворкинг
• 250+ участников
• 8-ми часовую длительность + афтепати
• Стенды от вендоров
• Проходить будет 21 апреля, ТЦ Forum Алматы
Заявки на доклады - appsecfest@astlab.kz, сайт - https://appsecfest.kz