Details about of Storm-0940 spray attack
https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/
Previous post:
https://news.1rj.ru/str/sysadm_in_channel/5254
https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/
Previous post:
https://news.1rj.ru/str/sysadm_in_channel/5254
Microsoft News
Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
Since August 2023, Microsoft has observed intrusion activity targeting and successfully stealing credentials from multiple Microsoft customers that is enabled by highly evasive password spray attacks. Microsoft has linked the source of these password spray…
ToxicPanda: a new banking trojan from Asia hit Europe and LATAM
https://www.cleafy.com/cleafy-labs/toxicpanda-a-new-banking-trojan-from-asia-hit-europe-and-latam
https://www.cleafy.com/cleafy-labs/toxicpanda-a-new-banking-trojan-from-asia-hit-europe-and-latam
Cleafy
ToxicPanda: a new banking trojan from Asia hit Europe and LATAM | Cleafy Labs
Discover Cleafy's in-depth analysis of a new Android banking Trojan campaign, ToxicPanda, initially linked to TgToxic. Our findings reveal a sophisticated fraud operation targeting European and LATAM banks, using On-Device Fraud (ODF) tactics to execute account…
Typosquat Campaign Targeting npm Developers
https://blog.phylum.io/supply-chain-security-typosquat-campaign-targeting-puppeteer-users/
https://blog.phylum.io/supply-chain-security-typosquat-campaign-targeting-puppeteer-users/
Phylum Research | Software Supply Chain Security
Fake Puppeteer Packages Contain Malware
Ongoing supply chain attack targets Puppeteer users with malicious npm packages.
Threat Campaign Spreads Winos4.0 Through Game Application
https://www.fortinet.com/blog/threat-research/threat-campaign-spreads-winos4-through-game-application
https://www.fortinet.com/blog/threat-research/threat-campaign-spreads-winos4-through-game-application
Fortinet Blog
Threat Campaign Spreads Winos4.0 Through Game Application
FortiGuard Labs reveals a threat actor spreads Winos4.0, infiltrating gaming apps and targeting the education sector. Learn more.…
Palo Alto Expedition Missing Authentication Vulnerability: Palo Alto Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-5910&field_date_added_wrapper=all&field_cve=&sort_by=field_date_added&items_per_page=20&url=
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-5910&field_date_added_wrapper=all&field_cve=&sort_by=field_date_added&items_per_page=20&url=
Cybersecurity and Infrastructure Security Agency CISA
Known Exploited Vulnerabilities Catalog | CISA
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the…
Вредоносные приложения в Google Play: как злоумышленники используют DNS-протокол для скрытой связи троянов с управляющими серверами
https://news.drweb.ru/show/?i=14935&lng=ru
https://news.drweb.ru/show/?i=14935&lng=ru
Dr.Web
Вредоносные приложения в Google Play: как злоумышленники используют DNS-протокол для скрытой связи троянов с управляющими серверами
Задачей многих троянов Android.FakeApp является переход по ссылкам на различные сайты, и с технической точки зрения такие вредоносные программы довольно примитивны. При запуске они получают команду на открытие заданного веб-адреса, в результате чего установившие…
Offset-free DSE bypass across Windows 11 & 10: utilising ntkrnlmp.pdb
https://blog.cryptoplague.net/main/research/windows-research/offset-free-dse-bypass-across-windows-11-and-10-utilising-ntkrnlmp.pdb
https://blog.cryptoplague.net/main/research/windows-research/offset-free-dse-bypass-across-windows-11-and-10-utilising-ntkrnlmp.pdb
blog.cryptoplague.net
Offset-free DSE bypass across Windows 11 & 10: utilising ntkrnlmp.pdb | cryptoplague blog
Parsing ntkrnlmp.pdb on the target to eliminate the need for static offsetting and thus safely and dynamically bypassing driver signature enforcement across multiple Windows 10 & 11 versions.
Linux kernel test robot noticed a 3888.9% improvement of will-it-scale.per_process_opshttps://lore.kernel.org/lkml/202411072132.a8d2cf0f-oliver.sang@intel.com/
Commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d4148aeab412432bf928f311eca8a2ba52bb05df
Управление памятью и сборщиком мусора в Go (Memory Management and Garbage Collection in Go)
https://www.youtube.com/live/UVqpl4PExkM?si=HbRHSYTQdQcOFswt
https://www.youtube.com/live/UVqpl4PExkM?si=HbRHSYTQdQcOFswt
YouTube
Управление памятью и сборщиком мусора в Go
22 мая Нина сделала новый доклад на Go-митапе в Москве: https://www.youtube.com/live/5BTrGM5ElAA
Слайды: https://github.com/progmsk/progmsk.github.io/files/14963281/go-garbage-collection.pdf
Репозиторий: https://github.com/PakshNina/gc
Канал Нины на ютубе:…
Слайды: https://github.com/progmsk/progmsk.github.io/files/14963281/go-garbage-collection.pdf
Репозиторий: https://github.com/PakshNina/gc
Канал Нины на ютубе:…
Glove Stealer: Leveraging IElevator to Bypass App-Bound Encryption & Steal Sensitive Data
https://www.gendigital.com/blog/insights/research/glove-stealer
https://www.gendigital.com/blog/insights/research/glove-stealer
Gendigital
Glove Stealer: Leveraging IElevator to Bypass App-Bound Encryption & Steal Sensitive Data
A .NET malware, bypasses Chrome's App-Bound Encryption, stealing data from browsers, crypto wallets, 2FA authenticators
Subject Linux 6.12
Linus commented: No strange surprises this last week, so we're sticking to the regular release schedule, and that obviously means that the merge window opens tomorrow. I already have two dozen+ pull requests in my mailbox, kudos to all the early birds..:
https://lkml.org/lkml/2024/11/17/326
Linus commented: No strange surprises this last week, so we're sticking to the regular release schedule, and that obviously means that the merge window opens tomorrow. I already have two dozen+ pull requests in my mailbox, kudos to all the early birds..:
https://lkml.org/lkml/2024/11/17/326
8 Free CyberSec & Networking Courses From Cisco
It may be useful to refresh your knowledge or learn something new:It may be useful to refresh your knowledge or learn something new:
1 Ethical Hacker
2 Junior Cybersecurity Analyst
3 Endpoint Security
4 Cyber Threat Management
5 Introduction to Cybersecurity
6 Network Defense
7 Network Addressing and Basic Troubleshooting
8 Networking Essentials
It may be useful to refresh your knowledge or learn something new:It may be useful to refresh your knowledge or learn something new:
1 Ethical Hacker
2 Junior Cybersecurity Analyst
3 Endpoint Security
4 Cyber Threat Management
5 Introduction to Cybersecurity
6 Network Defense
7 Network Addressing and Basic Troubleshooting
8 Networking Essentials
Netacad
Ethical Hacker
Become an ethical hacker and build your offensive security skills in this free online course - from Cisco Networking Academy. Sign up today!
ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI
https://unit42.paloaltonetworks.com/privilege-escalation-llm-model-exfil-vertex-ai/
https://unit42.paloaltonetworks.com/privilege-escalation-llm-model-exfil-vertex-ai/
Unit 42
ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI
New research reveals two vulnerabilities in Google's Vertex AI that may lead to privilege escalation or data theft through custom jobs or malicious models. New research reveals two vulnerabilities in Google's Vertex AI that may lead to privilege escalation…
One Sock Fits All: The Use And Abuse Of The NSOCKS Botnet
https://blog.lumen.com/one-sock-fits-all-the-use-and-abuse-of-the-nsocks-botnet/
https://blog.lumen.com/one-sock-fits-all-the-use-and-abuse-of-the-nsocks-botnet/
Lumen Blog
One sock fits all: The use and abuse of the NSOCKS botnet
Learn about the NSOCKS crimeware proxy network, housing over 35,000 bots and its connections to prominent cyber criminal organizations.
This media is not supported in your browser
VIEW IN TELEGRAM
Animated Cyber Security))
Malicious packages for AI integration containing infostealer malware were found in the Python Package Index repository.
https://www.kaspersky.com/blog/jarkastealer-in-pypi-packages/52640/
https://www.kaspersky.com/blog/jarkastealer-in-pypi-packages/52640/
Kaspersky official blog
Packages with infostealer found in PyPI repository
Kaspersky GReAT experts have found malicious packages for AI integration containing JarkaStealer malware in the PyPI repository.