Daria Fediai

Geopolitical DDoS attacks continue to become increasingly prevalent. ASERT research has discovered that Romania is the latest victim of the recent surge in these attacks. 👉 These attacks are not specific to any single industry or adversary, as they target a variety of verticals, with several hacktivist groups taking credit for attacks. https://lnkd.in/ggB4qJRx #DDoS #Romania #DDoSThreatIntelligence

10

𝑻𝒉𝒆 “𝒔𝒊𝒍𝒆𝒏𝒕 𝒕𝒉𝒓𝒆𝒂𝒕” 𝒐𝒇 𝒄𝒚𝒃𝒆𝒓 #𝒆𝒔𝒑𝒊𝒐𝒏𝒂𝒈𝒆 𝒊𝒏 𝒕𝒉𝒆 𝑵𝒆𝒕𝒉𝒆𝒓𝒍𝒂𝒏𝒅𝒔 Earlier this year, the discovery of COATHANGER malware in a Dutch military network shone a light on the growing threat of cyber espionage in the Netherlands. It has since been discovered that the campaign was far more widespread than initially thought, leading to the compromise of 14,000 devices around the world. Targets included Western governments, diplomatic institutions, and companies in the defense sector. The campaign is believed to have been orchestrated by a state-backed Chinese threat actor.  A recent article by TNW points out that despite the breadth and sophistication of espionage campaigns, it’s the topic of ransomware that continues to dominate the conversation in cybersecurity. This is because ransomware is easily identifiable and produces immediate effects, unlike espionage, which is far more subtle. During espionage campaigns, the priority is stealth. Threat actors take deliberate measures to obfuscate their activities and stay under the radar, making them difficult to detect. These campaigns may run for years before being discovered, if they are discovered at all.  Espionage also produces delayed effects, tricking our brains into thinking it is less of a threat than it is. The effects of espionage – loss of sensitive data, intellectual property, state secrets – compound over time, often going unnoticed until the damage is done. To guard against this, organizations whose threat landscapes highlight espionage as a risk should perform periodic assessments to check for breaches, as well as ensuring a proactive monitoring, detection, and response (MDR) solution is in place.  Want to learn more about cyber espionage in the Netherlands? Check our sector-specific threat landscapes, linked in the comments below.

30

2 Comments

We gathered all the reading materials from the course “Attack and Defence in Blockchain Technologies” and prepared a stand alone ebook. https://lnkd.in/dmsVdBxg #infosec #cybersecurity #pentest #pentesting #hacking #hackers #opensource

2

We gathered all the reading materials from the course “Attack and Defence in Blockchain Technologies” and prepared a stand alone ebook. https://lnkd.in/dmsVdBxg #infosec #cybersecurity #pentest #pentesting #hacking #hackers #windows

2

We gathered all the reading materials from the course “Attack and Defence in Blockchain Technologies” and prepared a stand alone ebook. https://lnkd.in/dmsVdBxg #infosec #cybersecurity #pentest #pentesting #hacking #hackers #opensource

6

Recent discoveries by Slovakian cybersecurity firm ESET reveal two new #backdoors, "LunarWeb" and "LunarMail," attributed to the Turla cyberespionage group, with links to Russian interests. Here's what you need to know: 1️⃣ LunarWeb infiltrates servers covertly, using steganography to embed commands within innocent images, while LunarMail embeds within Outlook workstations, leveraging email communications for espionage activities. 2️⃣ LunarWeb communicates via HTTP(S), mirroring legitimate traffic, while LunarMail operates within Outlook, manipulating email attachments to conceal encrypted payloads. 3️⃣ The initial access vectors suggest exploitation of vulnerabilities or spearphishing campaigns, with the compromised entities primarily affiliated with a European MFA, indicating strategic intrusion. Read more: https://lnkd.in/dSHfxjfg #CyberSecurity #Turla #RussianHackers #cyberespionage #hackernews

2

#Russia / #Disinformation - U.S. Seizes Web Domain Names From Hacking Group Linked To Russian Intelligence - from Radio Free Europe/Radio Liberty: U.S. authorities said they have seized dozens of website domain names that hackers linked to Russian intelligence allegedly used to try and break into U.S. government computer systems. The October 4 announcement was the latest in a string of moves by United States and other Western governments seeking to choke out what they say is a wide-ranging cyber campaign by Russian hackers, many of whom are state-sponsored. More than 100 website domain names associated with the hackеrs, known as the Callisto Group, were seized, the Justice Department said in a statement, an action that was coordinated with tech giant Microsoft. A domain name is roughly the series of numbers on a website that allows the website to communicate with servers and send and receive information. U.S. officials said the group sent e-mails that that appeared to come from a trusted source to scores of people, including former U.S. military and intelligence employees, as well as NGOs, U.S. companies, and others. "This seizure is part of a coordinated response with our private sector partners to dismantle the infrastructure that cyberespionage actors use to attack U.S. and international targets," said U.S. Attorney Ismail J. Ramsey for the Northern District of California. Known as spear phishing, the tactic involves sending e-mails with links or attachments that contain malicious computer code. The recipients are tricked into opening the attachments or clicking on the links, launching code that allows hackers to burrow into the computer systems either to steal information or simply observe communications. Callisto Group is the name given by Western officials and tech researchers to the Russian Federal Security Service's Center for Information Security, or Center 18. The center is one of at least two that conduct cyberoperations for the service, known as the FSB. Other Russian security agencies, including the main military intelligence agency known as the GRU, or the Foreign Intelligence Service, known as the SVR, also run similar operations. In its statement announcing the seizure of 66 domain names, Microsoft said the group, which it called Star Blizzard, said detailed research on targets was carried out before sending spear phishing e-mails. Among the U.S. government agencies Star Blizzard targeted was the U.S. Department of Energy, which oversees many nuclear programs. Story continues: https://lnkd.in/eNsWFbQQ

7

1 Comment

🔒 Case Study: eObčanka ID System Vulnerability 🔒 In today’s world, the security of digital identity is critical. But what happens when that security is compromised? A few years ago, WardenSec, alongside Auxilium Cyber Security, uncovered serious vulnerabilities in the electronic ID system, eObčanka. This system, designed for secure communication with state institutions, was found to have insufficient login protections. Our experts demonstrated how an attacker could steal a citizen's identity, completely undetected, through the spread of a simple computer virus. We presented our findings at the QuBIT Prague 2020 conference, raising awareness of this security flaw and its potential consequences. The full case study, along with more details on our research, can be explored on our website. 📽️ Watch the in-depth analysis in our YouTube video. Stay vigilant and protect your identity online. #CyberSecurity #WardenSec #DigitalIdentity #eObcanka #AuxiliumCyberSecurity #ITSecurity #PenTest #PenetrationTesting

1

💡 When greatness collides: Cybersecurity is a cornerstone of national security, and the collaboration between like-minded democracies is vital in tackling the ever-evolving cyber threats. Last week, the European Values Center for Security Policy and CTBC (Czech Taiwanese Business Chamber) co-hosted an event on how to strengthen Czech-Taiwan cybersecurity cooperation. 🇨🇿 🇹🇼 🤝 ⭐ With an all-star panel, including Dr. Benson Wu and Dr. Hon-min Yau, this occasion highlighted the significance of Czech-Taiwan joint security strategy. This growing partnership aims to enhances mutual support, strengthen strategic alliances, and underscore a shared commitment to democratic values. By working together, the goal is to better protect against cyber threats, share valuable resources, and contribute to establishing global cybersecurity norms and standards. 💪 ⚡ Only wish I could have been there! #CyberSecurity #Taiwan #CzechTaiwanCooperation #NationalSecurity #InternationalCooperation (Image: https://lnkd.in/g9wpcgzy)

6

🚀 New Release: go-perun v0.12.0 The latest version of the go-perun framework is here! 🎉 Packed with enhanced security for state channels, support for additional blockchains and new examples to try it out yourself. It’s a big step forward for state channel technology. Check it out and contribute! Let’s build the future of decentralized tech together! 🌐✨ #Blockchain #StateChannels #Hyperledger

9

4 Comments

In our latest Cryptography Caffè blog, explore the importance of formal #verification in ensuring the correctness and security of cryptographic implementations, setting a new gold standard in #cryptography. https://bit.ly/4bNM4B9 #cybersecurity

15

We gathered all the reading materials from the course “Attack and Defence in Blockchain Technologies” and prepared a stand alone ebook http://https://lnkd.in/dmsVdBxg #infosec #cybersecurity #pentest #pentesting #hacking #hackers #windows

1

🔒 You’re the Owner of Your Crypto! 🔒 Cryptography is constantly evolving, and staying ahead is crucial. Join Utimaco and InfoSec Global for our upcoming webinar, “𝗘𝗻𝗵𝗮𝗻𝗰𝗶𝗻𝗴 𝗩𝗶𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 𝗼𝗳 𝗛𝗦𝗠 𝗞𝗲𝘆𝘀 𝗮𝗰𝗿𝗼𝘀𝘀 𝘁𝗵𝗲 𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗘𝗰𝗼𝘀𝘆𝘀𝘁𝗲𝗺”, where we’ll help you gain complete visibility of your cryptographic landscape. In this session, our cybersecurity experts, Julien Probst and Eric PORTRAIT, will guide you through: 🔹 An Introduction into the World of Hardware Security Modules (HSMs), 🔹 Challenges of Managing Cryptographic Keys in the Digital Ecosystem, 🔹The Emerging Quantum Threat and How to Prepare Best for PQC Migration, 🔹Solutions to Manage the Entire Cryptographic Lifecycle, 🔹Product Demo and Use Cases. Whether you're gearing up for a compliance audit or simply want to stay on top of your cryptographic assets, this webinar is perfect for you! 📅 Date & Time: Thursday, Aug 1st - 4 pm CET 🔗 Register now: https://lnkd.in/eCc3GqPb #Cybersecurity #Cryptography #HSM #PQC #FreeWebinar #CryptoManagement #Compliance #QuantumComputing #DigitalEcosystem #CryptoDiscovery

40

🚨 Just published: "Penpie Exploit: A Technical Post-Mortem Analysis" On 3rd Sept. 2024, Penpie Finance, a DeFi protocol built on top of Pendle Finance, was exploited for ~$28M in user-locked funds due to a re-entrancy vulnerability in their smart contracts. 👨‍🏫 The security team at Olympix studied the exploit, traced down the attacker, and wrote a quick hack analysis. This $27.3M hack is a critical case study for DeFi developers and security professionals. What you'll learn: 1️⃣ A detailed breakdown of the re-entrancy vulnerability. 2️⃣ Analysis of the sophisticated attack method. 3️⃣ Audit history and missed red flags. 4️⃣ Key lessons for Solidity developers and auditors. Read the full article here: https://lnkd.in/gvceD4vV 📜 This analysis is crucial for anyone working on or auditing DeFi protocols. Let's discuss the findings and how we can improve our collective security practices! #Web3Security #BlockchainHack #CryptoSafety #DeFi #Web3Security #SecurityAlert #SmartContracts #Security #Web3 #Blockchain #Ethereum #Crypto #DeFisecurity #smartcontracts #penetrationtesting #smartcontractsecurity #Olympix

4

Somehow, Volt Typhoon returned, more sophisticated and more determined than ever. Unlike attackers who vanish when discovered, this adversary digs in even deeper when exposed. According to the STRIKE Team, Volt Typhoon’s tactics are adaptive and multifaceted. They exploit legacy weaknesses in Cisco RV320/325 routers and Netgear ProSafe routers, devices long past their prime, using them as operational relay boxes. These end-of-life devices become perfect entry points, and in just 37 days, Volt Typhoon compromised 30% of visible Cisco RV320/325 routers. You can read more about Ryan Sherstobitoff's insights in this ITPro article written by Solomon Klappholz. #cybersecurity #datahacks #volttyphoon https://lnkd.in/evdecmGd

12

1 Comment

Poland puts Crypto.com’s operator on warning list ➡️ Read All : https://lnkd.in/eFcEAAKf The Polish Financial Supervision Authority has added four new entities to the public warning list, including operator of Crypto.com. Crypto.com‘s Maltese operator Foris DAX MT... [...] #CryptoRegulation #CryptoDotCom #PolishAuthority #FinancialServices #CryptoPenalties #Crypto #Exchanges #NBTC

1