Gpoddity: Exploiting Active Directory Gpos Through Ntlm Relaying, and More…
Group Policy Objects represent high value targets for an attacker in any Active Directory environment. Indeed, compromising such objects would allow taking over any computer or user linked to it, thus opening up a high number of privilege escalation or lateral movement opportunities..:
🔹 https://www.synacktiv.com/publications/gpoddity-exploiting-active-directory-gpos-through-ntlm-relaying-and-more
Group Policy Objects represent high value targets for an attacker in any Active Directory environment. Indeed, compromising such objects would allow taking over any computer or user linked to it, thus opening up a high number of privilege escalation or lateral movement opportunities..:
Please open Telegram to view this post
VIEW IN TELEGRAM
Synacktiv
GPOddity: exploiting Active Directory GPOs through NTLM relaying, and
DarkGate Loader Malware Delivered via Microsoft Teams
— https://www.truesec.com/hub/blog/darkgate-loader-delivered-via-teams
— https://www.truesec.com/hub/blog/darkgate-loader-delivered-via-teams
Truesec
Title: DarkGate Loader delivered via Teams - Truesec
Malspam campaigns involving DarkGate Loader have been on the rise since its author started advertising it as a Malware-as-a-Service offering on popular cybercrime forums in June 2023. Until now DarkGate Loader was seen delivered via traditional email malspam…
Открытый практикум DevOps by Rebrain: Внедрение "DevOps as service"
• 12 Сентября (Вторник) 19:00 МСК. Детали
Программа:
• Что такое "DevOps as service"
• Как его внедрить
• Какой это даст профит
Ведёт:
Александр Крылов - Team Lead DevOps опыт работы более 7 лет. Постоянный спикер: DevOps conf, TeamLead conf, Highload conf. Соавтор и ведущий подкаста ProITStand. Автор курса по Haproxy на Rebrain.
• 12 Сентября (Вторник) 19:00 МСК. Детали
Программа:
• Что такое "DevOps as service"
• Как его внедрить
• Какой это даст профит
Ведёт:
Александр Крылов - Team Lead DevOps опыт работы более 7 лет. Постоянный спикер: DevOps conf, TeamLead conf, Highload conf. Соавтор и ведущий подкаста ProITStand. Автор курса по Haproxy на Rebrain.
/ BEC phishing empire targeting Microsoft 365
https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/
https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/
Group-IB
W3LL oiled machine: Group-IB uncovers covert BEC phishing empire targeting Microsoft 365 – report
Group-IB has today published a new threat report “W3LL DONE: HIDDEN PHISHING ECOSYSTEM DRIVING BEC ATTACKS”.
/ NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild
— https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
— https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
The Citizen Lab
BLASTPASS
Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware while checking the device of an individual employed by a Washington DC-based civil society organization with international offices. We…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Threat Actors Target MSSQL Servers in...
https://www.securonix.com/blog/securonix-threat-labs-security-advisory-threat-actors-target-mssql-servers-in-dbjammer-to-deliver-freeworld-ransomware/
https://www.securonix.com/blog/securonix-threat-labs-security-advisory-threat-actors-target-mssql-servers-in-dbjammer-to-deliver-freeworld-ransomware/
Securonix
Securonix Threat Labs Security Advisory: Threat Actors Target MSSQL Servers in DB#JAMMER to Deliver FreeWorld Ransomware
/ “MrTonyScam” — Botnet of Facebook Users Launch High-Intent Messenger Phishing Attack on Business Accounts
https://labs.guard.io/mrtonyscam-botnet-of-facebook-users-launch-high-intent-messenger-phishing-attack-on-business-3182cfb12f4d?gi=366241f9d889
https://labs.guard.io/mrtonyscam-botnet-of-facebook-users-launch-high-intent-messenger-phishing-attack-on-business-3182cfb12f4d?gi=366241f9d889
Medium
“MrTonyScam” — Botnet of Facebook Users Launch High-Intent Messenger Phishing Attack on Business Accounts
By Oleg Zaytsev (Guardio Labs)
🚀 Присоединяйся к Open SysConf в эту субботу, как все будет
Уверен - будет позитивно и полезно.
🔹 Кто удаленно - Присоединяйся онлайн, будь вместе с нами.
🔹 Кто оффлайн - Встретимся в офисе команды Kolesa Team.
Начнем с базовых вещей, продолжим в low level практике, закончим на ноте размышлений - доклады и расписание.
Соберутся специалисты и уверен - хорошие люди из Алматы, Астаны, других городов РК, соседних государств. Встреча обещает пройти в многостороннем общении, обновлении круга знакомств и новых знаний 🤜🤛
Бери хорошее настроение, желание развития, открывай глаза, настораживай уши, готовь голосовой аппарат и уверенность в том, что все будет хорошо! Be connected on Open SysConf.io🐴
Всем Peace ✌️
Уверен - будет позитивно и полезно.
Начнем с базовых вещей, продолжим в low level практике, закончим на ноте размышлений - доклады и расписание.
Соберутся специалисты и уверен - хорошие люди из Алматы, Астаны, других городов РК, соседних государств. Встреча обещает пройти в многостороннем общении, обновлении круга знакомств и новых знаний 🤜🤛
Бери хорошее настроение, желание развития, открывай глаза, настораживай уши, готовь голосовой аппарат и уверенность в том, что все будет хорошо! Be connected on Open SysConf.io
Всем Peace ✌️
Please open Telegram to view this post
VIEW IN TELEGRAM
Youtube
- YouTube
Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.
/ macOS MetaStealer | New Family of Obfuscated Go Infostealers Spread in Targeted Attacks
Authors highlight how threat actors are proactively targeting macOS businesses by posing as fake clients in order to socially engineer victims into launching malicious payloads..:
— https://www.sentinelone.com/blog/macos-metastealer-new-family-of-obfuscated-go-infostealers-spread-in-targeted-attacks/
Authors highlight how threat actors are proactively targeting macOS businesses by posing as fake clients in order to socially engineer victims into launching malicious payloads..:
— https://www.sentinelone.com/blog/macos-metastealer-new-family-of-obfuscated-go-infostealers-spread-in-targeted-attacks/
SentinelOne
macOS MetaStealer | New Family of Obfuscated Go Infostealers Spread in Targeted Attacks
The rise of macOS infostealers continues with the latest entrant aiming to compromise business environments with targeted social engineering lures.
/ Vitalik Buterin's Twitter account hacked to promote crypto scam
https://web3isgoinggreat.com/single/vitalik-buterins-twitter-account-hacked
https://web3isgoinggreat.com/single/vitalik-buterins-twitter-account-hacked
Web3 is Going Just Great
Vitalik Buterin's Twitter account hacked to promote crypto scam
The Twitter account belonging to Vitalik Buterin, inventor and effective leader of the Ethereum project, was hacked to promote a crypto scam. A tweet posted to his compromised account advertised a "commemorative NFT" to celebrate the impending release of…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Бэкдор во Free Download Manager — возможная атака на Linux через цепочку поставок
— https://securelist.ru/backdoored-free-download-manager-linux-malware/107924/
Title in En: Backdoor in Free Download Manager - Possible Supply Chain Attack on Linux
— https://securelist.ru/backdoored-free-download-manager-linux-malware/107924/
Title in En: Backdoor in Free Download Manager - Possible Supply Chain Attack on Linux
securelist.ru
Зараженный Free Download Manager распространяет бэкдор для Linux
Исследователи «Лаборатории Касперского» проанализировали бэкдор для Linux, распространявшийся с бесплатным ПО Free Download Manager и остававшийся незамеченным в течение не менее трех лет.
Can't Be Contained: Finding a Command Injection Vulnerability in Kubernetes
https://www.akamai.com/blog/security-research/kubernetes-critical-vulnerability-command-injection
https://www.akamai.com/blog/security-research/kubernetes-critical-vulnerability-command-injection
Akamai
Can't Be Contained: Finding a Command Injection Vulnerability in Kubernetes | Akamai
Akamai researchers discover a critical vulnerability in Kubernetes that can lead to remote code execution.
Please open Telegram to view this post
VIEW IN TELEGRAM
Sys-Admin InfoSec pinned «📢 Завтра Open SysConf.io 🐴 - кто регался адрес, онлайн должен быть здесь»
/ Can't Be Contained: Finding a Command Injection Vulnerability in Kubernetes
— https://www.akamai.com/blog/security-research/kubernetes-critical-vulnerability-command-injection
— https://www.akamai.com/blog/security-research/kubernetes-critical-vulnerability-command-injection
Akamai
Can't Be Contained: Finding a Command Injection Vulnerability in Kubernetes | Akamai
Akamai researchers discover a critical vulnerability in Kubernetes that can lead to remote code execution.
/ 38TB of data accidentally exposed by Microsoft AI researchers
Wiz Research found a data exposure incident on Microsoft’s AI GitHub repository, including over 30,000 internal Microsoft Teams messages – all caused by one misconfigured SAS token
The backup includes secrets, private keys, passwords..:
https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers
Wiz Research found a data exposure incident on Microsoft’s AI GitHub repository, including over 30,000 internal Microsoft Teams messages – all caused by one misconfigured SAS token
The backup includes secrets, private keys, passwords..:
https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers
wiz.io
38TB of data accidentally exposed by Microsoft AI researchers | Wiz Blog
Wiz Research found a data exposure incident on Microsoft’s AI GitHub repository, including over 30,000 internal Microsoft Teams messages – all caused by one misconfigured SAS token
/ AWS’s Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation
https://sysdig.com/blog/ambersquid/
https://sysdig.com/blog/ambersquid/
Sysdig
AWS’s Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation | Sysdig
AMBERSQUID is a cloud-native cryptojacking operation that leverages AWS services and can cost victims more than $10,000/day.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Всем привет, меня зовут Евгений Гончаров, кто меня не знает, узнает позже, пост посвящается знающим меня людям.
За последние дни кибер-конференций меня спрашивали "как ты это делаешь, откуда энергия", вопросов было много, на которые я отвечал "у меня есть своя система знаний”.
Система видения мира созданная собственным сознанием, системно организованная, где все практики, результаты, теория - взяты из сугубо личного опыта подтвержденного годами жизни.
Некоторым я рассказываю "как и что", некоторым говорю основы или указываю на ошибки, но действительно - мне хочется отрефлексировать этот опыт в слух, без телефонов, гаджетов.
Мы можем настроиться. Дайте мне знать через форму о своей готовности к участию.
Кто готов. Давайте попробуем в какой-нибудь день вместе послушать о моем “точечном мире”.
Please open Telegram to view this post
VIEW IN TELEGRAM
/ Fileless Remote Code Execution on Juniper Firewalls
In this blog, was demonstrated how CVE-2023-36845, a vulnerability flagged as “Medium” severity by Juniper, can be used to remotely execute arbitrary code without authentication. Authors turned a multi-step (but very good) exploit into an exploit that can be written using a single curl command and appears to affect more (older) systems..:
— https://vulncheck.com/blog/juniper-cve-2023-36845
In this blog, was demonstrated how CVE-2023-36845, a vulnerability flagged as “Medium” severity by Juniper, can be used to remotely execute arbitrary code without authentication. Authors turned a multi-step (but very good) exploit into an exploit that can be written using a single curl command and appears to affect more (older) systems..:
— https://vulncheck.com/blog/juniper-cve-2023-36845
VulnCheck
VulnCheck - Outpace Adversaries
Vulnerability intelligence that predicts avenues of attack with speed and accuracy.