Sys-Admin InfoSec

13 May 2024 05:54

/ CISA - StopRansomware: Black Basta

- technical details
- mitre tactics
- IoC
- mitigations

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a

Sys-Admin InfoSec

09 May 2024 13:00

/ TunnelVision (CVE-2024-3661): How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak

https://www.leviathansecurity.com/blog/tunnelvision

PoC: https://github.com/leviathansecurity/TunnelVision

Sys-Admin InfoSec

04 May 2024 12:32

/ GitLab Vulnerability Allows Intercept Accounts Management

https://nvd.nist.gov/vuln/detail/CVE-2023-7028y

Sys-Admin InfoSec

04 May 2024 11:43

/ Analysis of ArcaneDoor

The zero day vulnerabilities identified are tracked as CVE-2024-20353, CVE-2024-20359, and CVE-2024-20358 – of these, only CVE-2024-20353 and CVE-2024-20359 were exploited in the ArcaneDoor campaign.

The campaign, dubbed “ArcaneDoor,” targeted government-owned perimeter network devices from various vendors as part of a global effort..:

https://censys.com/analysis-of-arcanedoor-threat-infrastructure-suggests-potential-ties-to-chinese-based-actor/

Sys-Admin InfoSec

02 May 2024 13:56

📢 Открытый практикум Linux by Rebrain: С Windows на Linux

Время:

• 8 Мая (Среда) 20:00 МСК

Программа:

• Основные сложности
• Стоит ли переходить?
• Что нужно знать в самом начале?
• Пробуем работать в Linux

Детали ↘ Здесь

Ведет:

Андрей Буранов – Системный администратор в департаменте VK Play. 10+ лет опыта работы с ОС Linux.

Sys-Admin InfoSec

01 May 2024 14:46

System Hacking: Common Windows, Linux & Web Server Hacking Techniques

Sys-Admin InfoSec

30 Apr 2024 21:25

/ Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers

..new ongoing social engineering attack campaign (tracked by STR as DEV#POPPER) likely associated with North Korean threat actors who are targeting developers using fake interviews to deliver a Python-based RAT..:

https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/

Sys-Admin InfoSec

26 Apr 2024 08:34

/ Brokewell: do not go broke from new banking malware

..fake browser update page designed to install an Android application.. Brokewell is a typical modern banking malware equipped with both data-stealing and remote-control capabilities built into the malware..:

https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware

Sys-Admin InfoSec

25 Apr 2024 13:53

📢 Открытые практикумы by Rebrain: Расписание на неделю

🔹 2 мая Networks: Мастер-класс по собеседованиям для сетевых инженеров и не только
🔹 6 мая Golang: Prometheus метрики в Golang-приложении
🔹 7 мая DevOps: Повесть о том, как найм идёт в ИТ
🔹 8 мая Linux: С Windows на Linux

Детали: ↘ Здесь

Sys-Admin InfoSec

25 Apr 2024 07:28

/ JA4T: TCP Fingerprinting

https://medium.com/foxio/ja4t-tcp-fingerprinting-12fb7ce9cb5a

Sys-Admin InfoSec

24 Apr 2024 13:37

👍 OpenBLD.net - Превзошел AdGuard, Cloudflare, Quad9 в блокировке малварных доменов! 🚀🚀

Экосистема сервиса, основанная на философии блокировки интернет-шума, показала превосходную защиту от вредоносных доменов и навязчивой рекламы. 💪

Согласно статистике URLhaus, OpenBLD.net обгоняет таких Топ-гигантов, как AdGuard, Cloudflare и Quad9, в блокировке малвари и нежелательных доменов 🔥

OpenBLD.net не просто предлагает защиту - он создает чувство безопасности для Вашего онлайн пространства.

Ваши пожертвования и спонсорство могут помочь стать сервису еще лучше и обеспечить стабильное развитие сервиса.

Присоединяйтесь к OpenBLD.net уже сегодня и вместе мы сделаем интернет безопаснее и тише! Peace ✌️

Sys-Admin InfoSec

23 Apr 2024 07:06

📢 Networks практикум: VRRP. Отказоустойчивость и балансировка нагрузки

Программа:

• Основы теории надежности
• Резервирование маршрутизаторов в группе
• Virtual Router (VR) ID, приоритет, master, backup
• Примеры настройки и схемы использования

• Время: 25 Апреля (Четверг) 20:00 (МСК)
• Детали: ↘ Здесь

Sys-Admin InfoSec

22 Apr 2024 12:43

MITRE Response to Cyber Attack in One of Its R&D Networks

MITRE was Hacked?) 🤦‍♂️

https://www.mitre.org/news-insights/news-release/mitre-response-cyber-attack-one-its-rd-networks

Sys-Admin InfoSec

19 Apr 2024 07:49

Всем привет, выгрузив имена с правильными ответами в файл quiz.txt и использовав команду shuf -n 5 quiz.txt я получил следующий список победителей:

@r_***37
@az*********ov
@pe***1e
@je*****_0
@ni***********in

Парни, я свяжусь с вами. Организаторы оставили форму, где стоит отметиться с комментарием "Викторина от Sys-Adm.in", беслпатный проход готов! Done! Поздравляю! 🎉

Sys-Admin InfoSec

18 Apr 2024 14:02

/ Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials

https://blog.talosintelligence.com/large-scale-brute-force-activity-targeting-vpns-ssh-services-with-commonly-used-login-credentials/

Sys-Admin InfoSec

10 May 2024 10:21

Unmasking Tycoon 2FA: A Stealthy Phishing Kit Used to Bypass Microsoft 365 and Google MFA

Tycoon 2FA is a phishing-as-a-service (PhaaS) platform that was first seen in August 2023. Like many phish kits, it bypasses multifactor authentication (MFA) protections and poses a significant threat to users. Lately, Tycoon 2FA has been grabbing headlines because of its role in ongoing campaigns designed to target Microsoft 365 and Gmail accounts.

This blog post is a rundown of how these attacks work, how they’re evolving, what they look like in the real world..:

https://www.proofpoint.com/us/blog/email-and-cloud-threats/tycoon-2fa-phishing-kit-mfa-bypass

Sys-Admin InfoSec

08 May 2024 05:02

/ Graph: Growing number of threats leveraging Microsoft API

An increasing number of threats have begun to leverage the Microsoft Graph API, usually to facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud.

BirdyClient or OneDriveBirdyClient malware revealed that its main functionality is to connect to the Microsoft Graph API and use Microsoft OneDrive as a C&C server mechanism to upload and download files from it

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/graph-api-threats

Sys-Admin InfoSec

04 May 2024 12:04

/ Eight Arms To Hold You: The Cuttlefish Malware

https://blog.lumen.com/eight-arms-to-hold-you-the-cuttlefish-malware/

Sys-Admin InfoSec

02 May 2024 16:26

/ Hackers breached its Sign production environment and accessed customer email addresses and hashed Dropbox passwords

The actors compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database..:

https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign

Sys-Admin InfoSec

02 May 2024 04:58

/ Detecting browser data theft using Windows Event Logs

This aerticle describes one set of signals for use by system administrators or endpoint detection agents that should reliably flag any access to the browser’s protected data from another application on the system..:

https://security.googleblog.com/2024/04/detecting-browser-data-theft-using.html

Sys-Admin InfoSec

30 Apr 2024 21:31

/ Coordinated attacks on Docker Hub that planted millions of malicious repositories

https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/

Sys-Admin InfoSec

30 Apr 2024 11:06

😡 OpenBLD.net со своими стикерами и мерчем на AppSecFest.kz

Организаторы AppSecFest.kz, предоставили OpenBLD.net, как открытому проекту на безвозмездной основе стенд 🔥

3 Мая, в Алматы, на стенде, у нас будет монитор, команда из трех человек, и мы научим, расскажем, покажем, как:

🔹 Меньше потреблять трафика
🔹 Уменьшить использование ресурсов памяти и процессора
🔹 Уменьшить тепловыделение
🔹 Убрать рекламу в играх
🔹 Батарея живет дольше, телефон греется меньше
🔹 Снизить вероятность возникновения информационных рисков
🔹 Ускорить загрузку веб-страниц
🔹 Уменьшить интернет шум
🔹 Как можно помочь проекту жить и развиваться

И самое главное оставаться собой и быть в фокусе!

Приходите, подходите. Будут олдскул-стайл стикерпаки, пару футболок, пушечный заряд и тонна мотивации.

Информация о конференции доступна Здесь

Sys-Admin InfoSec

25 Apr 2024 17:05

/ Autodesk hosting PDF files used in Microsoft phishing attacks

Autodesk is hosting malicious PDF files that lead phishing attack victims to have their Microsoft login credentials stolen...

https://www.netcraft.com/blog/autodesk-hosting-pdf-files-used-in-microsoft-phishing-attacks/

Sys-Admin InfoSec

25 Apr 2024 12:23

/ IBM acquire HashiCorp

..IBM today announced its intent to acquire HashiCorp, Inc. for $35 per share in cash, representing an enterprise value of $6.4 billion..:

https://newsroom.ibm.com/2024-04-24-IBM-RELEASES-FIRST-QUARTER-RESULTS

Sys-Admin InfoSec

25 Apr 2024 04:07

/ ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

Sys-Admin InfoSec

23 Apr 2024 10:47

/ ToddyCat is making holes in your infrastructure

ToddyCat is an APT group that predominantly targets governmental organizations, some of them defense related, located in the Asia-Pacific region. One of the group’s main goals is to steal sensitive information from hosts.

In most cases, the adversary connected, transferred and run all required tools with the help of PsExec or Impacket..:

https://securelist.com/toddycat-traffic-tunneling-data-extraction-tools/112443/

Sys-Admin InfoSec

22 Apr 2024 12:47

CVE-2024-20356: Jailbreaking a Cisco appliance to run DOOM

https://labs.nettitude.com/blog/cve-2024-20356-jailbreaking-a-cisco-appliance-to-run-doom/

P.S. Thx for link dear subscriber ✌️

Sys-Admin InfoSec

22 Apr 2024 05:07

MagicDot: A Hacker’s Magic Show of Disappearing Dots and Spaces

This action is completed by most user-space APIs in Windows. By exploiting this known issue, I was able to uncover:

🔹 One remote code execution (RCE) vulnerability (CVE-2023-36396) in Windows’s new extraction logic for all newly supported archive types that allowed me to craft a malicious archive that would write anywhere I chose on a remote computer once extracted, leading to code execution.
🔹 Two elevation of privilege (EoP) vulnerabilities: one (CVE-2023-32054) that allowed me to write into files without the required privileges by manipulating the restoration process of a previous version from a shadow copy and another that allowed me to delete files without the required privileges.

With Demo..:

https://www.safebreach.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/

Sys-Admin InfoSec

19 Apr 2024 04:07

/ Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters

Attackers are constantly seeking new vulnerabilities to compromise Kubernetes environments. Microsoft recently uncovered an attack that exploits new critical vulnerabilities in OpenMetadata to gain access to Kubernetes workloads and leverage them for cryptomining activity.

- attack flow
- how to check if your cluster is vulnerable

https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/

Sys-Admin InfoSec

17 Apr 2024 13:59

/ Palo Alto - Putting The Protecc In GlobalProtect (CVE-2024-3400)

A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.

Technial details:

- https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/