/ Technical Analysis of Pikabot
Peeking into the malware backdoor. Pikabot is a malicious backdoor that has been active since early 2023. The malware is modular with a loader and a core component that implements the majority of the functionality:
https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot
Peeking into the malware backdoor. Pikabot is a malicious backdoor that has been active since early 2023. The malware is modular with a loader and a core component that implements the majority of the functionality:
https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot
Zscaler
Pikabot | ThreatLabz
Pikabot is a modular backdoor capable of delivering second-stage payloads that shares similarities with Qakbot.
Открытый практикум DevOps by Rebrain: Шифрование секретов в GitOps
• 30 Мая (Вторник), 19:00 по МСК. Детали
Программа:
• Где хранить секреты - git, vault или облачный сервис?
• Разбираемся с dek, kek и kms
• Изучаем схему работы sops, sealed secrets
• Если успеем, то затронем варианты реализации kubernetes authentication в vault и external secrets
Ведет:
Василий Озеров - Руководит международной командой в рамках своего агентства Fevlake. Co-Founder REBRAIN. Более 8 лет Devops практик.
P.S. Зарегистрировавшимся запись практикума "DevOps by Rebrain" в подарок
• 30 Мая (Вторник), 19:00 по МСК. Детали
Программа:
• Где хранить секреты - git, vault или облачный сервис?
• Разбираемся с dek, kek и kms
• Изучаем схему работы sops, sealed secrets
• Если успеем, то затронем варианты реализации kubernetes authentication в vault и external secrets
Ведет:
Василий Озеров - Руководит международной командой в рамках своего агентства Fevlake. Co-Founder REBRAIN. Более 8 лет Devops практик.
P.S. Зарегистрировавшимся запись практикума "DevOps by Rebrain" в подарок
Vulnerability (CVE-2023-2868) in Barracuda Email Security Gateway appliance (ESG)
— https://status.barracuda.com/incidents/34kx82j5n4q9
— https://status.barracuda.com/incidents/34kx82j5n4q9
Barracuda
Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) on May 19, 2023.
Barracuda Networks's Status Page - Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) on May 19, 2023..
Free VPN Data Breach Exposed 360 Million Records Online
— https://www.vpnmentor.com/news/report-super-vpn-breach/
— https://www.vpnmentor.com/news/report-super-vpn-breach/
vpnMentor
Free VPN Data Breach Exposed 360 Million Records Online. Why Using the Right VPN Matters!
Cybersecurity security researcher Jeremiah Fowler discovered and reported to vpnMentor a non-password protected database containing over 360 million records related to a VPN data
/ OpenBLD.net DNS Mitigated Influence from new Microsoft Encrypted Restricted Permission Messages Deliver Phishing
New phishing company:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/microsoft-encrypted-restricted-permission-messages-deliver-phishing/
New phishing company:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/microsoft-encrypted-restricted-permission-messages-deliver-phishing/
Trustwave
Microsoft Encrypted Restricted Permission Messages Deliver Phishing | Trustwave
Over the past few days, we have seen phishing attacks that use a combination of compromised Microsoft 365 accounts and .rpmsg encrypted emails to deliver the phishing message.
/ Zyxel security advisory for multiple buffer overflow vulnerabilities of firewalls
…buffer overflow vulnerability in the notification function in some firewall versions could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device:
— https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls
…buffer overflow vulnerability in the notification function in some firewall versions could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device:
— https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls
Zyxel
Zyxel security advisory for multiple buffer overflow vulnerabilities of firewalls | Zyxel Networks
CVEs: CVE-2023-33009, CVE-2023-33010 Summary Zyxel has released patches for firewalls affected by multiple buffer overflow vulnerabilities. Users are advised to install them for optimal protection. What are the vulnerabilities? CVE-2023-33009 A buffer overflow…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Free (9) short cources from GitLab
— GitLab 101. 1h - https://levelup.gitlab.com/courses/gitlab101
— GitLab 201. 1h - https://levelup.gitlab.com/courses/gitlab-201-certification
— GitLab CI/CD. 3h - https://levelup.gitlab.com/courses/continuous-integration-and-delivery-ci-cd-with-gitlab
— GitLab Security Essentials. 4 1/2h - https://levelup.gitlab.com/courses/security-essentials
— GitLab Technical Writing Fundamentals. 3h - https://levelup.gitlab.com/courses/gitlab-technical-writing-fundamentals
— GitLab with Git Essentials. 4h - https://levelup.gitlab.com/courses/gitlab-with-git-essentials
— GitLab Agile Project Management. 2 ½hours - https://levelup.gitlab.com/courses/gitlab-agile-project-management
— Remote Foundations Certification. 2h - https://levelup.gitlab.com/courses/remote-foundations
— TeamOps. 1-2h - https://levelup.gitlab.com/courses/teamops
— GitLab 101. 1h - https://levelup.gitlab.com/courses/gitlab101
— GitLab 201. 1h - https://levelup.gitlab.com/courses/gitlab-201-certification
— GitLab CI/CD. 3h - https://levelup.gitlab.com/courses/continuous-integration-and-delivery-ci-cd-with-gitlab
— GitLab Security Essentials. 4 1/2h - https://levelup.gitlab.com/courses/security-essentials
— GitLab Technical Writing Fundamentals. 3h - https://levelup.gitlab.com/courses/gitlab-technical-writing-fundamentals
— GitLab with Git Essentials. 4h - https://levelup.gitlab.com/courses/gitlab-with-git-essentials
— GitLab Agile Project Management. 2 ½hours - https://levelup.gitlab.com/courses/gitlab-agile-project-management
— Remote Foundations Certification. 2h - https://levelup.gitlab.com/courses/remote-foundations
— TeamOps. 1-2h - https://levelup.gitlab.com/courses/teamops
Edcast
Gitlab
LevelUp is GitLab's integrated talent enablement solution.
В проекте OpenBLD.net DNS запущен режим OpenBLD+
Проект живет благодаря поддержке пользователей, сегодня есть возможность оформить подписку за 3$+, в замен получить:
• Персональную поддержку, помощь в расследовании Cybersecurity инцидентов
• Hardening, AppSec консультации, +консультации по SEO оптимизации Вашего сайта
• Улучшенная скорость доставки Вашего сайта/Домена пользователям OpenBLD.net DNS
• Лого компании или никнейм на сайте проекта со ссылкой на сайт или соц. профиль
• Unlimited доступ для выделенных IP
• Есть вопросы / предложения - welcome @sysadminkz
*en* - OpenBLD+ Benefits
*ru* - Что дает OpenBLD+
Проект живет благодаря поддержке пользователей, сегодня есть возможность оформить подписку за 3$+, в замен получить:
• Персональную поддержку, помощь в расследовании Cybersecurity инцидентов
• Hardening, AppSec консультации, +консультации по SEO оптимизации Вашего сайта
• Улучшенная скорость доставки Вашего сайта/Домена пользователям OpenBLD.net DNS
• Лого компании или никнейм на сайте проекта со ссылкой на сайт или соц. профиль
• Unlimited доступ для выделенных IP
• Есть вопросы / предложения - welcome @sysadminkz
*en* - OpenBLD+ Benefits
*ru* - Что дает OpenBLD+
Sys-Admin InfoSec pinned «В проекте OpenBLD.net DNS запущен режим OpenBLD+ Проект живет благодаря поддержке пользователей, сегодня есть возможность оформить подписку за 3$+, в замен получить: • Персональную поддержку, помощь в расследовании Cybersecurity инцидентов • Hardening…»
/ DogeRAT: The Android Malware Campaign Targeting Users Across Multiple Industries
masked on Youtube Premium, Zetflix, Standoff 2, private chat apps..
..deep dive into the operation of the DogeRAT malware campaign and provide tips on how to protect yourself from this threat:
https://cloudsek.com/blog/dogerat-the-android-malware-campaign-targeting-users-across-multiple-industries
masked on Youtube Premium, Zetflix, Standoff 2, private chat apps..
..deep dive into the operation of the DogeRAT malware campaign and provide tips on how to protect yourself from this threat:
https://cloudsek.com/blog/dogerat-the-android-malware-campaign-targeting-users-across-multiple-industries
Cloudsek
DogeRAT: The Android Malware Campaign Targeting Users Across Multiple Industries | CloudSEK
CloudSEK’s TRIAD team discovered yet another open-source Android malware called DogeRAT (Remote Access Trojan), targeting a large customer base across multiple industries, especially Banking and Entertainment. Although the majority of this campaign targeted…
/ New macOS vulnerability, Migraine, could bypass System Integrity Protection
https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/
https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/
Microsoft News
New macOS vulnerability, Migraine, could bypass System Integrity Protection
A new vulnerability could allow an attacker with root access to bypass SIP in macOS and perform arbitrary operations on a device.
/ Are your files securely stored at Google Drive and Docs?
Investigation with google docs analysys, dorking examples:
— https://ad14.gitbook.io/ad14s-blog/
Investigation with google docs analysys, dorking examples:
— https://ad14.gitbook.io/ad14s-blog/
ad14.gitbook.io
Are your files securely stored at Google Drive and Docs? | AD14's Blog
Google Drive and Docs are popular cloud storage and productivity services that allow users to store and share files online. But are your files securely stored when you use these services?
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Supply Chain Risk From Gigabyte App Center Backdoor
Recently, the Eclypsium platform began detecting suspected backdoor-like behavior within Gigabyte systems in the wild.
..analysis discovered that firmware in Gigabyte systems is dropping and executing a Windows native executable during the system startup process, and this executable then downloads and executes additional payloads insecurely. It uses the same techniques as other OEM backdoor-like features like Computrace backdoor (a.k.a. LoJack DoubleAgent)..:
https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/
Recently, the Eclypsium platform began detecting suspected backdoor-like behavior within Gigabyte systems in the wild.
..analysis discovered that firmware in Gigabyte systems is dropping and executing a Windows native executable during the system startup process, and this executable then downloads and executes additional payloads insecurely. It uses the same techniques as other OEM backdoor-like features like Computrace backdoor (a.k.a. LoJack DoubleAgent)..:
https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/
Eclypsium | Supply Chain Security for the Modern Enterprise
Supply Chain Risk from Gigabyte App Center Backdoor
Eclypsium Research discovers that Gigabyte motherboards have an embedded backdoor in their firmware, which drops a Windows executable that can download and execute additional payloads insecurely. The backdoor affects gaming PCs and high-end computers.
Открытые практикумы DevOps, Linux, Networks, Golang by Rebrain (расписание, Июнь 2023)
Бесплатные практикумы на всевозможные IT темы. Основное — Kubernetes, Docker, Ansible, Gitlab CI, Linux, Kafka , MySQL, Golang и др. Работа в консоли, разбор реальных кейсов на практике:
• 6 июня DevOps: SQL: Введение в использование JOIN (Виктор Щупоченко - DevOps-engineer)
• 7 июня Linux: OpenVPN (Даниил Батурин - Основатель проекта VyOS)
• 8 июня Golang: Design patterns в GO (Егор Гришечко - Software engineer в Uber)
• 13 июня DevOps: Configuration drift - управляем конфигурацией приложений
• 14 июня Linux: С Windows на Linux (Андрей Буранов - Специалист по UNIX-системам VK)
• 15 июня Networks: OSPF Loop Prevention (Дмитрий Радчук - Team Lead Вконтакте)
• 20 июня DevOps: Система Percona Motoring and Management в Docker
• 21 июня Linux: Как контролировать ресурсы (Андрей Буранов)
• 22 июня Networks: Основы построения Wi-Fi сетей (Ольга Яновская - Руководитель направления Networks by Rebrain)
• 27 июня DevOps by Rebrain (Василий Озеров - Co-Founder REBRAIN/Fevlake)
• 28 июня Linux: Пользователи Linux (Андрей Буранов)
• 29 июня Networks: Дизайн multi-area OSPF (Дмитрий Радчук)
Подключиться можно Здесь
Бесплатные практикумы на всевозможные IT темы. Основное — Kubernetes, Docker, Ansible, Gitlab CI, Linux, Kafka , MySQL, Golang и др. Работа в консоли, разбор реальных кейсов на практике:
• 6 июня DevOps: SQL: Введение в использование JOIN (Виктор Щупоченко - DevOps-engineer)
• 7 июня Linux: OpenVPN (Даниил Батурин - Основатель проекта VyOS)
• 8 июня Golang: Design patterns в GO (Егор Гришечко - Software engineer в Uber)
• 13 июня DevOps: Configuration drift - управляем конфигурацией приложений
• 14 июня Linux: С Windows на Linux (Андрей Буранов - Специалист по UNIX-системам VK)
• 15 июня Networks: OSPF Loop Prevention (Дмитрий Радчук - Team Lead Вконтакте)
• 20 июня DevOps: Система Percona Motoring and Management в Docker
• 21 июня Linux: Как контролировать ресурсы (Андрей Буранов)
• 22 июня Networks: Основы построения Wi-Fi сетей (Ольга Яновская - Руководитель направления Networks by Rebrain)
• 27 июня DevOps by Rebrain (Василий Озеров - Co-Founder REBRAIN/Fevlake)
• 28 июня Linux: Пользователи Linux (Андрей Буранов)
• 29 июня Networks: Дизайн multi-area OSPF (Дмитрий Радчук)
Подключиться можно Здесь
/ Multi-stage attack chain uses PowerShell downloader and DLL sideloading
New Horabot campaign targets Gmail, Yahoo, Outlook mailboxes.. exfiltrate contacts’ email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim’s mailbox:
https://blog.talosintelligence.com/new-horabot-targets-americas/
New Horabot campaign targets Gmail, Yahoo, Outlook mailboxes.. exfiltrate contacts’ email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim’s mailbox:
https://blog.talosintelligence.com/new-horabot-targets-americas/
Cisco Talos Blog
New Horabot campaign targets the Americas
Cisco Talos has observed a threat actor deploying a previously unidentified botnet program Talos is calling “Horabot,” which delivers a known banking trojan and spam tool onto victim machines in a campaign that has been ongoing since at least November 2020.
/ Splunk - ‘edit_user’ Capability Privilege Escalation
https://advisory.splunk.com/advisories/SVD-2023-0602
https://advisory.splunk.com/advisories/SVD-2023-0602
Splunk Vulnerability Disclosure
‘edit_user’ Capability Privilege Escalation
A low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing a specially crafted web request. This is because the ‘edit_user’ capability does not honor the …
/ Malicious code in PDF Toolbox extension
https://palant.info/2023/05/16/malicious-code-in-pdf-toolbox-extension/
https://palant.info/2023/05/16/malicious-code-in-pdf-toolbox-extension/
Almost Secure
Malicious code in PDF Toolbox extension
PDF Toolbox extension (used by more than 2 million users) contains obfuscated malicious code, allowing serasearchtop[.]com website to inject arbitrary JavaScript code into all websites you visit.
/ kill Cortana: MS released doc named: End of support for Cortana in Windows
https://support.microsoft.com/en-us/topic/end-of-support-for-cortana-in-windows-d025b39f-ee5b-4836-a954-0ab646ee1efa
https://support.microsoft.com/en-us/topic/end-of-support-for-cortana-in-windows-d025b39f-ee5b-4836-a954-0ab646ee1efa
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
/ Zyxel’s guidance for the recent attacks on the ZyWALL devices
— some firewall versions could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device
https://www.zyxel.com/global/en/support/security-advisories/zyxels-guidance-for-the-recent-attacks-on-the-zywall-devices
— some firewall versions could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device
https://www.zyxel.com/global/en/support/security-advisories/zyxels-guidance-for-the-recent-attacks-on-the-zywall-devices
Zyxel
Zyxel’s guidance for the recent attacks on the ZyWALL devices | Zyxel Networks
Summary Zyxel recently became aware of a cyberattack targeting our ZyWALL devices. These vulnerabilities already have patches - we took immediate action as soon as we become aware of them, and have released patches, as well as security advisories for CVE…