/ Detecting browser data theft using Windows Event Logs

This aerticle describes one set of signals for use by system administrators or endpoint detection agents that should reliably flag any access to the browser’s protected data from another application on the system..:

https://security.googleblog.com/2024/04/detecting-browser-data-theft-using.html

📢 Открытый практикум Linux by Rebrain: С Windows на Linux

Время:

• 8 Мая (Среда) 20:00 МСК

Программа:

• Основные сложности
• Стоит ли переходить?
• Что нужно знать в самом начале?
• Пробуем работать в Linux

Детали ↘ Здесь

Ведет:

Андрей Буранов – Системный администратор в департаменте VK Play. 10+ лет опыта работы с ОС Linux.

/ Hackers breached its Sign production environment and accessed customer email addresses and hashed Dropbox passwords

The actors compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database..:

https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign

/ Analysis of ArcaneDoor

The zero day vulnerabilities identified are tracked as CVE-2024-20353, CVE-2024-20359, and CVE-2024-20358 – of these, only CVE-2024-20353 and CVE-2024-20359 were exploited in the ArcaneDoor campaign.

The campaign, dubbed “ArcaneDoor,” targeted government-owned perimeter network devices from various vendors as part of a global effort..:

https://censys.com/analysis-of-arcanedoor-threat-infrastructure-suggests-potential-ties-to-chinese-based-actor/

/ Eight Arms To Hold You: The Cuttlefish Malware

https://blog.lumen.com/eight-arms-to-hold-you-the-cuttlefish-malware/

/ GitLab Vulnerability Allows Intercept Accounts Management

https://nvd.nist.gov/vuln/detail/CVE-2023-7028

/ Graph: Growing number of threats leveraging Microsoft API

An increasing number of threats have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud.

BirdyClient or OneDriveBirdyClient malware revealed that its main functionality is to connect to the Microsoft Graph API and use Microsoft OneDrive as a C&C server mechanism to upload and download files from it

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/graph-api-threats

/ TunnelVision (CVE-2024-3661): How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak

https://www.leviathansecurity.com/blog/tunnelvision

PoC: https://github.com/leviathansecurity/TunnelVision

Unmasking Tycoon 2FA: A Stealthy Phishing Kit Used to Bypass Microsoft 365 and Google MFA

Tycoon 2FA is a phishing-as-a-service (PhaaS) platform that was first seen in August 2023. Like many phish kits, it bypasses multifactor authentication (MFA) protections and poses a significant threat to users. Lately, Tycoon 2FA has been grabbing headlines because of its role in ongoing campaigns designed to target Microsoft 365 and Gmail accounts.

This blog post is a rundown of how these attacks work, how they’re evolving, what they look like in the real world..:

https://www.proofpoint.com/us/blog/email-and-cloud-threats/tycoon-2fa-phishing-kit-mfa-bypass

/ CISA - StopRansomware: Black Basta

- technical details
- mitre tactics
- IoC
- mitigations

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a

/ Apple Fixed Security Issues in iOS, iPadOS, macOS

- An app may be able to access user-sensitive data in iOS/iPadOS
- A malicious application may be able to access Find My data in macOS

/ Trusted Brands and Sponsored Google Ads to Distribute MSIX Payloads

Researchers discovered some of the most dangerous threats – including the Kaseya MSP breach and the more_eggs malware...

https://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads

/ Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2024-30051. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges..:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30051

/ Detecting Compromise of CVE-2024-3400 on Palo Alto Networks GlobalProtect Devices

This blog post aims to provide details on methods for investigating potentially compromised Palo Alto Networks firewall devices and a general approach towards edge device threat detection.

- Detecting Compromise
- Memory Analysis

https://www.volexity.com/blog/2024/05/15/detecting-compromise-of-cve-2024-3400-on-palo-alto-networks-globalprotect-devices/

📢 DevOps, Linux, Networks и Golang by Rebrain: Расписание практикумов на неделю
⁠
• 21 мая Networks: Глубокое погружение в VoIP: Kamailio (Часть 2)
• 22 мая Linux: Определение нагрузки на сервер и поиск узких мест производительности
• 23 мая Networks: Фильтрация, блокировки и взаимодействие с провайдером
• 24 мая DevOps: Настройка firewall с помощью IPTables - 2

Детали: ↘ Здесь
⁠

/ New WiFi Vulnerability: The SSID Confusion Attack

This vulnerability exploits a design flaw in the WiFi standard, allowing attackers to trick WiFi clients on any operating system into connecting to a untrusted network:

https://www.top10vpn.com/research/wifi-vulnerability-ssid/

The incident response cycle, applied to ransomware

/ Threat actors misusing Quick Assist in social engineering attacks leading to ransomware

https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/

/ New Antidot Android Banking Trojan Masquerading as Fake Google Play Updates

https://cyble.com/blog/new-antidot-android-banking-trojan-masquerading-as-google-play-updates/

Git CVE-2024-32002 - This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed

Got vesrsions: 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, 2.39.4

git config --global core.symlinks false can be disable this attack vector

https://nvd.nist.gov/vuln/detail/CVE-2024-32002

PoC: https://github.com/szybnev/git_rce/blob/main/create_poc.sh

P.S. Thx Tatyana for the reporting ✌️