Hunt & Hackett looks at the leak from Chinese hacker-for-hire contractor i-SOON and its possible ties to at least three Chinese APTs—Poison Carp (also known as Evil Eye, Earth Empusa, EvilBamboo), Jackpot Panda, and APT41 (also known as Double Dragon, Wicked Panda, Bronze Atlas).
https://www.huntandhackett.com/blog/isoon-leak-sheds-light
Senior Ukrainian cybersecurity officials sacked amid corruption probe
Yurii Shchyhol and Victor Zhora were accused of participating in a scheme to contract software at inflated prices.
https://cyberscoop.com/zhora-shchyhol-fired-corruption/
Enterprise software giant VMWare has published two security advisories to fix two sets of issues in its vCenter Server and Tools applications.
The worst of the two is the vCenter update, which fixes a 9.8/10-rated memory issue that can lead to remote code execution attacks (CVE-2023-34048).
https://www.vmware.com/security/advisories/VMSA-2023-0023.html
Also:
-MACE Act passes in US
-ASEAN casinos are laundering cybercrime profits
-Ransomware dwell time plummets from 5 to 1 day
-Hacker steals $100k crypto from Python devs
-Rootkits spotted on npm
-China's semiconductor espionage
-Operation Jacana
-macOS DirtyNIB vulnerability
-Cisco, X.org, cURL, and printer bugs
-NSA& CISA publish Top 10 misconfigs
-NSA&CISA publish IAM guidance for vendors
-CISA publishes Security Planning Workbook
-BlackBerry to split in two
-New tool—OpenPubkey
https://files.mastodon.social/media_attachments/files/111/187/293/978/736/376/original/129dee8b6eda4954.png
Ransomware is being deployed within one day of initial access in more than 50% of engagements.
In just 12 months the median dwell time identified in the annual Secureworks State of the Threat Report has freefallen from 4.5 days to less than one day.
In 10% of cases, ransomware was even deployed within five hours of initial access.
https://www.secureworks.com/about/press/ransomware-dwell-time-hits-low-of-24-hours
From cURL founder on the nazi-X-chan:
"We are cutting the release cycle short and will release curl 8.4.0 on October 11, including a fix for a severity HIGH CVE."
Ukraine Energy Minister German Galushchenko says cyberattacks are a bigger threat to the country's power grid than rockets and drones because the repercussions of a cyber incident can paralyze whole systems rather than impact small substations—as rockets usually tend to do
https://archive.ph/Y2srj
Apple has a security update for iOS devices to patch two actively exploited zero-days.
The first is a vulnerability (CVE-2023-42824) in the iOS kernel that Apple says was exploited against older iPhones using iOS 16.6 or lower.
The second is a zero-day (CVE-2023-5217) in the Libvpx library that Google discovered last week, and Apple also ported and fixed in iOS.
https://support.apple.com/en-us/HT213961
Interesting episode this week from Pat and Adam, with Pat talking to Kroll about how Clop has been testing its MOVEit exploits for over 2 years before this year's hacks
https://risky.biz/RBNEWS724/
And:
-Thai crypto scammers detained
-18.6% of FOSS JS and Java projects went dead this year
-Malware reports on Knight ransomware and Mystic Stealer
-APT reports on APT41's Android malware, new REF5961 group, Konni, and Cytrox
-Microsoft patches apps for Libwebp and Libvpx zero-days
-Exim patches RCE bugs
-New Looney Tunables vulnerability
-New ShellTorch vulnerability
-ConnectedIO router bugs
-Gartner's cybersecurity spending forecast (it's good news)
-New tools—cloudgrep and KubeHound
https://files.mastodon.social/media_attachments/files/111/176/004/758/846/742/original/83afe49c8697f8ee.webp
Cado Security has open-sourced cloudgrep, a tool for searching resources across S3 cloud storage servers.
>>>>>>>"It currently supports searching log files, optionally compressed with gzip (.gz) or zip (.zip), in AWS S3."
https://github.com/cado-security/cloudgrep
@f7d0478e Only a few days ago people were ridiculing this vulnerability because there were "only 550 servers" connected online. Looks like ransomware gangs didn't give a shit about the infosec community's opinions once again.
And:
-Malware reports on BunnyLoader, RustDeck, GuLoader
-Lazarus poses as Meta recruiter
-Oilrig targets Saudi Arabia
-US report on Chinese disinformation efforts
-Vulnerability exploitation trends from Mandiant
-Exploitation of JetBrains TeamCity servers is underway
-SharePoint bug PoC is live
-You can bypass Cloudflare with Cloudflare
-New tool—DavRelayUp
-DarkBeam leaks its own database
-Source code of India's BharOS leaks
-The Apple iOS feature you should probably be aware of
https://files.mastodon.social/media_attachments/files/111/164/610/469/580/970/original/3275e7308c5daac3.jpg
Back in June, the Clop gang began releasing some of the data from the MOVEit hacks as torrent files after it began having problems with its hosting infrastructure.
Researchers from Palo Alto Networks have analyzed the seeds of the Clop torrent files and found that most of the stolen MOVEit files have been released through three IP addresses belonging to Moscow-based web hosting provider FlyServers.
https://unit42.paloaltonetworks.com/cl0p-group-distributes-ransomware-data-with-torrents/
Plus:
-ECH support lands in Chrome
-Snatch ransomware leak site leaks data on its owners
-Confiant takes down ScamClub malvertising group
-FBI warns of double-ransomware attacks
-Hackers spoof Dependabot to inject malware in projects
-APT reports on AridViper and Budworm
-Taiwan hit with CN disinfo
-Russian exploit broker promises $20mil for iOS and Android zero-days
-Apache NiFi and JBoss RichFaces exploitation
-Apple security updates
-New GPU.zip, Marvin, SideEye attacks
-New tool—Chalk
https://files.mastodon.social/media_attachments/files/111/147/699/183/159/247/original/4889de20ddd937dd.png
A threat actor named ScamClub is abusing ad platforms to place malicious ads on reputable websites that redirect users to phishing pages, gift card scams, and giveaway scams.
The group has been active since 2019, has employed multiple browser zero-days, and is believed to have made an estimated $8.5 million in the first half of the year alone.
Security firm Confiant has linked the group's operations to a Hong Kong company named WayTop International Advertising Limited.
https://blog.confiant.com/exploring-scamclub-payloads-via-deobfuscation-using-abstract-syntax-trees-65ef7f412537
Oddbean new post about login | logout
Notes by Catalin Cimpanu | export