/ GhostToken – Exploiting GCP application infrastructure to create invisible, unremovable trojan app on Google accounts
https://astrix.security/ghosttoken-exploiting-gcp-application-infrastructure-to-create-invisible-unremovable-trojan-app-on-google-accounts/
https://astrix.security/ghosttoken-exploiting-gcp-application-infrastructure-to-create-invisible-unremovable-trojan-app-on-google-accounts/
Astrix Security
GhostToken: Securing GCP Apps Against Invisible Trojans - Astrix Security
GhostToken - Exploiting GCP application infrastructure to create invisible, unremovable trojan app on Google accounts
/ RBAC Buster - First-Ever Attack Leveraging Kubernetes RBAC to Backdoor Clusters
This blog post is a part of a comprehensive study we conducted on misconfigured K8s clusters in the wild. Research findings are significant as they shed light on the risks of misconfigurations and how even large organizations can overlook the importance of securing their clusters, leaving them vulnerable to potential disasters with just one mistake:
— https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters
This blog post is a part of a comprehensive study we conducted on misconfigured K8s clusters in the wild. Research findings are significant as they shed light on the risks of misconfigurations and how even large organizations can overlook the importance of securing their clusters, leaving them vulnerable to potential disasters with just one mistake:
— https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters
Aqua
First-Ever Attack Leveraging Kubernetes RBAC to Backdoor Clusters
For the first time evidence that attackers are exploiting Kubernetes (K8s) Role-Based Access Control (RBAC) in the wild to create backdoors.
/ EvilExtractor – All-in-One Stealer
EvilExtractor (sometimes spelled Evil Extractor) is an attack tool designed to target Windows operating systems and extract data and files from endpoint devices. It includes several modules that all work via an FTP service. It was developed by a company named Kodex, which claims it is an educational tool. However, research conducted by FortiGuard Labs shows cybercriminals are actively using it as an info stealer:
— https://www.fortinet.com/blog/threat-research/evil-extractor-all-in-one-stealer
EvilExtractor (sometimes spelled Evil Extractor) is an attack tool designed to target Windows operating systems and extract data and files from endpoint devices. It includes several modules that all work via an FTP service. It was developed by a company named Kodex, which claims it is an educational tool. However, research conducted by FortiGuard Labs shows cybercriminals are actively using it as an info stealer:
— https://www.fortinet.com/blog/threat-research/evil-extractor-all-in-one-stealer
Fortinet Blog
EvilExtractor – All-in-One Stealer
FortiGuard Labs examines the initial attack method used to deliver EvilExtractor and its malicious activities as an infostealer.…
/ BlueNoroff APT group targets macOS with ‘RustBucket’ Malware
https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Jamf
'RustBucket' malware targets macOS
Learn how APT group, BlueNoroff targets macOS devices with newly discovered malware.
/ Cisco patches high and critical flaws across several products
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-CAeLFk6V
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-CAeLFk6V
Cisco
Cisco Security Advisory: Cisco Industrial Network Director Vulnerabilities
Multiple vulnerabilities in Cisco Industrial Network Director (IND) could allow an authenticated attacker to inject arbitrary operating system commands or access sensitive data.
For more information about these vulnerabilities, see the Details section of…
For more information about these vulnerabilities, see the Details section of…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
new_side_attack_intel_cpu_sys-admin_,up.pdf
380.2 KB
New side attack to Intel CPU report
Abstract—The transient execution attack is a type of attack
leveraging the vulnerability of modern CPU optimization tech-
nologies. New attacks surface rapidly. The side-channel is a key
part of transient execution attacks to leak data
Abstract—The transient execution attack is a type of attack
leveraging the vulnerability of modern CPU optimization tech-
nologies. New attacks surface rapidly. The side-channel is a key
part of transient execution attacks to leak data
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Тезисно о том, как можно получить Open Source - All Product Pack лицензию от JetBrains
Все просто - делай вклад в этот мир и тебе воздастся ;)
— https://youtu.be/9DMnXS0ifAA
Все просто - делай вклад в этот мир и тебе воздастся ;)
— https://youtu.be/9DMnXS0ifAA
YouTube
Тезисно о том, как можно получить Open Source - All Product Pack лицензию от JetBrains
Я получаю вторую подряд Open Source - All Product Pack лицензию от JetBrains, удобные IDE на все случае программерской жизни.
* https://www.jetbrains.com/community/opensource/#support
Мои проекты:
* https://github.com/m0zgen/cactusd
* https://github.co…
* https://www.jetbrains.com/community/opensource/#support
Мои проекты:
* https://github.com/m0zgen/cactusd
* https://github.co…
⚠️ Note: All DoT (853) BLD (bld.sys-adm.in) clients (Android) should be migrate to A-BLD (a-bld.sys-adm.in)
🔆 Внимание. Всем Android клиентам bld.sys-adm.in - необходимо перенастроить безопасный DNS на a-bld.sys-adm.in!
🔆 Внимание. Всем Android клиентам bld.sys-adm.in - необходимо перенастроить безопасный DNS на a-bld.sys-adm.in!
/ Detecting and decrypting Sliver C2 – a threat hunter’s guide
Sliver is an open-source, cross-platform, and extensible C2 framework. It’s written primarily in Go, making it fast, portable, and easy to customize. This versatility makes it a popular choice among red teams for adversary emulation and as a learning tool for security enthusiasts.
The Sliver C2 framework has features catering to both beginner and advanced users. One of its main attractions is the ability to generate dynamic payloads for multiple platforms, such as Windows, Linux, and macOS. These payloads, or “slivers,” provide capabilities like establishing persistence, spawning a shell, and exfiltrating data.
When it comes to communication, Sliver supports a wide range of communication protocols, including HTTP, HTTPS, DNS, TCP, and WireGuard. This ensures that C2 traffic is flexible, stealthy, and can blend in with normal network traffic
— Full article…
Sliver is an open-source, cross-platform, and extensible C2 framework. It’s written primarily in Go, making it fast, portable, and easy to customize. This versatility makes it a popular choice among red teams for adversary emulation and as a learning tool for security enthusiasts.
The Sliver C2 framework has features catering to both beginner and advanced users. One of its main attractions is the ability to generate dynamic payloads for multiple platforms, such as Windows, Linux, and macOS. These payloads, or “slivers,” provide capabilities like establishing persistence, spawning a shell, and exfiltrating data.
When it comes to communication, Sliver supports a wide range of communication protocols, including HTTP, HTTPS, DNS, TCP, and WireGuard. This ensures that C2 traffic is flexible, stealthy, and can blend in with normal network traffic
— Full article…
Immersivelabs
Detecting and decrypting Sliver C2 – a threat hunter's guide
Originating from the Bishop Fox team, Sliver is an open-source, cross-platform, and extensible C2 framework. It’s written primarily in Go, making it fast, portable, and easy to customize.
2023-threatlabz-phishing-report.pdf
4.2 MB
/ Zscaler ThreatLabz 2023 Phishing Report
/ A maintenance release Git v2.40.1 with fixes many security issues
CVE-2023-25652, CVE-2023-25815, and CVE-2023-29007
— https://lkml.org/lkml/2023/4/25/705
CVE-2023-25652, CVE-2023-25815, and CVE-2023-29007
— https://lkml.org/lkml/2023/4/25/705
/ New high-severity vulnerability (CVE-2023-29552) discovered in the Service Location Protocol (SLP)
https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
Bitsight
New high-severity vulnerability (CVE-2023-29552) discovered in the Service Location Protocol (SLP) | Bitsight
Researchers from Bitsight and Curesec have jointly discovered a high-severity vulnerability — tracked as CVE-2023-29552 — in the Service Location Protocol (SLP).
Открытые практикумы DevOps, Linux, Networks и Golang by Rebrain (расписание на май)
• 2 мая DevOps: Использование регулярных выражений на примере анализа логов
• 3 мая Linux: Виртуальные интерфейсы и канальный уровень в Linux
• 4 мая Networks: Traffic Engineering (TE)
• 10 мая Linux: ФСТЭК для Linux (часть 2)
• 16 мая DevOps: Введение в Docker
• 17 мая Linux: ФСТЭК для Linux
• 18 мая Networks: Segment Routing (SR)
• 23 мая DevOps by Rebrain
• 24 мая Linux: Сертификат WEB-сервера
• 25 мая Golang by Rebrain
• 30 мая DevOps: Шифрование секретов в GitOps
• 31 мая Linux: Реализации протоколов маршрутизации для Linux
Подключиться можно Здесь
• 2 мая DevOps: Использование регулярных выражений на примере анализа логов
• 3 мая Linux: Виртуальные интерфейсы и канальный уровень в Linux
• 4 мая Networks: Traffic Engineering (TE)
• 10 мая Linux: ФСТЭК для Linux (часть 2)
• 16 мая DevOps: Введение в Docker
• 17 мая Linux: ФСТЭК для Linux
• 18 мая Networks: Segment Routing (SR)
• 23 мая DevOps by Rebrain
• 24 мая Linux: Сертификат WEB-сервера
• 25 мая Golang by Rebrain
• 30 мая DevOps: Шифрование секретов в GitOps
• 31 мая Linux: Реализации протоколов маршрутизации для Linux
Подключиться можно Здесь
/ Threat Actor Selling New Atomic macOS (AMOS) Stealer on Telegram
https://blog.cyble.com/2023/04/26/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/
https://blog.cyble.com/2023/04/26/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/
/ Never Connect to RDP Servers Over Untrusted Networks
Demonstration - why connecting using the Remote Desktop Protocol (RDP) must be avoided on untrusted networks like in hotels, conferences, or public Wi-Fi. Protecting the connection with a VPN or a Remote Desktop Gateway is the only safe alternative:
https://www.gosecure.net/blog/2023/04/26/never-connect-to-rdp-servers-over-untrusted-networks/
Demonstration - why connecting using the Remote Desktop Protocol (RDP) must be avoided on untrusted networks like in hotels, conferences, or public Wi-Fi. Protecting the connection with a VPN or a Remote Desktop Gateway is the only safe alternative:
https://www.gosecure.net/blog/2023/04/26/never-connect-to-rdp-servers-over-untrusted-networks/
GoSecure
Never Connect to RDP Servers Over Untrusted Networks
Did you know that RDP is unsafe without the use of additional protection like a VPN? In this blog post we will explain why and demonstrate the impact.
/ Elastic Security Labs discovers the LOBSHOT malware
Adversaries continue to abuse and increase reach through malvertising such as Google Ads by impersonating legitimate software..
Deep dive research and protection steps:
— https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware
🥋 Malware domains already blocked in Sys-Admin BLD DNS
Adversaries continue to abuse and increase reach through malvertising such as Google Ads by impersonating legitimate software..
Deep dive research and protection steps:
— https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware
🥋 Malware domains already blocked in Sys-Admin BLD DNS
/ RTM Locker Ransomware as a Service (RaaS) Now Suits Up for Linux Architecture
ESXi servers under attack..:
https://www.uptycs.com/blog/rtm-locker-ransomware-as-a-service-raas-linux
ESXi servers under attack..:
https://www.uptycs.com/blog/rtm-locker-ransomware-as-a-service-raas-linux
Uptycs
RTM Locker Ransomware as a Service (RaaS) Now on Linux - Uptycs
Uptycs threat research team discovered a new ransomware Linux binary attributed to the RTM group Locker, a known Ransomware-as-a-Service (RaaS) provider.