Joseph Carson

⚠ CYBERSECURITY HIGHLIGHTS FOR THE WEEK ⚠ Threat Actor in Focus - Emerging Threat: Void Manticore’s Destructive Cyber Campaigns Targeting Israeli Organizations Threat Actors: Void Manticore Attack Type: Public-facing web server Objective: Espionage Target Technology: Windows Target Geographies: Israel Target Industries: Government & Critical Infrastructure Business Impact: Data Loss, Data exfiltration Summary: Void Manticore (aka Storm-842) is an Iranian state-sponsored threat actor known for conducting destructive attacks on Israeli organizations and leaking information through the online persona ‘Karma’ (sometimes written as KarMa). These operations often target sectors such as government, finance, and critical infrastructure, aligning with Iran’s broader offensive strategy. The group employs straightforward and efficient techniques aimed at causing rapid and significant damage. Their operations extend beyond Israel, with attacks also reported in Albania, where they use the persona ‘Homeland Justice’ to leak stolen data. In Israel, Void Manticore is notable for utilizing a custom wiper named BiBi, after Israeli Prime Minister Benjamin Netanyahu. One common method Void Manticore uses to gain access to target systems is through internet-facing web servers like CVE-2019-0604, where they deploy web shells like the custom “Karma Shell.” This tool, disguised as an error page, can list directories, create processes, upload files, and manage services, using simple encryption methods like base64 and one-byte XOR for obfuscation. They have also been observed uploading a custom executable, do.exe, which checks for Domain Admin credentials. Upon successful authentication, it installs another web shell, reGeorge, indicating valid credentials. This suggests the initial access might be facilitated by another entity, possibly Scarred Manticore, a more sophisticated threat actor. Continue reading here ➡ https://lnkd.in/gvR_-7wt #CyberSecurity #Cyfirma #ETLM #externalthreatlandscape #ThreatIntelligence #CyberIntelligence #CYFIRMAResearch #malware #ransomware #threatactor #cybersecurityawareness Kumar Ritesh Dr. Saurabh Lal, P.D. Michael Henry Anna Koh Amit Thakur Harry Lee Glaiza Pardilla Harsha Vardhan Sam Parmar Rahul Raghav Yusuke Tateno Chiaki Izena（伊是名千晶）Greg Baylis David Plummer Rakesh R V Nicko Navarrete Ruri A. Hyungchan Mike Cho Montai Saiaroon Huy. Nguyen Tuong Vinh Dudley Swanepoel Mouli Saha Greg Baylis Vincent Cheng Julius S.

13

Like #ISO26262 for Functional Safety ASIL levels, we have an interesting standard coming up for #ISO21434. With ISO PAS 8475, #Cybersecurity Assurance Levels look for a good starting point. Join János Kovács at the SOS2024 ASRG conference. #AutomotiveECU #CAL #AutomotiveCybersecurity

3

Hacktivist group has been actively targeting Russian organizations since 2023, leveraging advanced tactics and tools. Here are some key points from their recent activities: Exploiting CVE-2023-38831: The group uses the CVE-2023-38831 vulnerability in WinRAR to execute arbitrary code via specially crafted archives12. This method enhances the effectiveness of their payload delivery and disguise. https://lnkd.in/gQUQhQFy Phishing Campaigns: They distribute malicious payloads through phishing emails containing business documents with double extensions (e.g., .pdf.exe)12. https://lnkd.in/gQUQhQFy Custom Malware: Their toolkit includes custom-made malware like PhantomDL and PhantomCore. PhantomDL is a Go-based backdoor for delivering additional payloads and uploading files to a command-and-control (C2) server, while PhantomCore (aka PhantomRAT) is a remote access trojan with similar capabilities12. Ransomware: Head Mare uses LockBit for Windows and Babuk for Linux (ESXi) to encrypt victims’ devices and demand ransom for data decryption12. Deceptive Tactics: They create scheduled tasks and registry values named MicrosoftUpdateCore to disguise their activities as legitimate Microsoft software tasks. They also disguise ransomware samples as legitimate applications like OneDrive and VLC12. Open-Source Tools: The group employs various publicly available tools such as Sliver, rsockstun, ngrok, and Mimikatz for discovery, lateral movement, and credential harvesting12. https://lnkd.in/gQUQhQFy Presence on X: They maintain a presence on X (formerly Twitter), where they leak sensitive information and internal documentation from their victims12. Head Mare’s approach is notable for its use of up-to-date vulnerabilities and custom malware, setting it apart from other hacktivist groups in the context of the Russo-Ukrainian conflict12. If you have any specific questions or need further details, feel free to ask! #CyberSecurity #ThreatIntelligence #LinkedInTips #SocialMediaStrategy #AudienceEngagement #SecastraSecurity #StaySafeOnline #ITSecurity #CyberAwareness

1

Incident reporting is really important at all levels. End user self reporting is crucial and often overlooked. https://lnkd.in/dgVj5hZa

5

DATA BREACH ALERT - Alleged sale of clients database from the JSC NIKORA The threat actor is offering to sell a database of clients from the Georgian company, JSC Nikora, containing 23,106 unique lines of data. The data is from May 2024 and includes information such as first name, last name, phone number, ID number, email, and date of birth. - #data_breach #data_leak #infosec #dark_web #DataBreach  #DataLeak  #Services  #CyberThreat  #CyberAttack

3

Key takeaways for critical OT environments such as energy, transport, and water management about NIS2: ✅ NIS2 establishes a set of rules and minimum requirements to foster EU wide cooperation and reporting. ✅ NIS2 has evolved from the original NIS Directive, including new OT verticals such as certain manufacturing sectors, and new requirements for increasing accountability and reporting. ✅ Article 21 encourages the use of appropriate measures based on risk, which in the case of critical infrastructures is likely to translate into the application of stricter standards and regulations. ✅ Article 23 requires the prompt reporting of cyberattacks, which will enhance transparency. ✅ Accountability provisions may include fines for businesses and direct responsibility for top company officials. ✅ OT operators should use as guidance enhanced EU vertical standards and guidance such as NCCS for energy and TS 50701 for rail, as well as evolving US regulations. ✅ The strict separation of OT and IT segments simplifies implementation of NIS2 and is consistent with NCCS, TS 50701, and new US regulations. For more information download our complete guide "NIS2 Compliance Guide for OT systems" ➡️ https://bit.ly/45ncZ5a Feel free to message me if you have any questions. #OTsecurity #NIS #ICSsecurity #IEC #NCCS #cyberrisk #cybersecurity #criticalinfrastructure #transportation #oilandgas #powerindustry #wastewater

48

Data Breach Alert ☣  - Alleged data sale of Israeli Air Force Threat actor claims to be selling data related to the Israeli Air Force, including detailed information about active and inactive pilots and employees. The alleged data contains information such as ranks, positions, service records, and training qualifications. The leak reportedly includes information from several airbases, such as Haifa, Hatzor, Ovda, Nevatim, Ramat David, Ramón, Tel Nof, Sdot Micha, and the special forces group. - #data_breach #data_leak #infosec #dark_web #DataBreach  #DataLeak  #Services  #CyberThreat  #CyberAttack

26

Over 22k unpatched Palo Alto Network devices (PANs) exposed to the internet. The time to patch these has passed as exploitation attempts have been detected, with more expected. Patch your PANs and sign up for Shadowserver reports to get alerts as to whether or not there are vulnerable PANs in your networks.

93

5 Comments

Mara from our analyst team recently released the Europe Threat Landscape report. In it she detailed interesting statistics such as: - Top types of fraud experienced by Cyberint's European customers - Most prevalent data leakage cases in Europe - Types of phishing attacks experienced by our European customers and more. Read the report for trends, statistics and forecasts: https://bit.ly/3NOpiQ4

22

2 Comments

ICANN have made a decision to reserve .INTERNAL from delegation in the DNS root zone permanently to provide for its use in private-use applications. Excellent news in so many dimensions. First of course that we now have one such TLD so that people do not have to create problems (like with .HOME, .CORP etc). Secondly that it's a big success related to cooperation between ICANN, Internet Architecture Board and Internet Engineering Task Force. Last of course that it is one of the few cases where the SSAC (Security and Stability Advisory Committee of ICANN) made up its mind that something is serious and really have to be done. This specific work started in 2020 (although SSAC have been looking at collision issues from a security perspective since at least 2011), and now 2024 we are done! Hard work by many people in many organisations. https://lnkd.in/dc9W5gFd

325

7 Comments

Some amazing discussions, panels, informal chats and relationship building networking at the Bled Strategic Forum this year: 1. Technology (Ransomware and crypto currencies) Gwen Clavon 2. NATO and global complexities - Dr Vlasta Zekulic 3. Slovenian Cybersecurity Leadership (very impressed by leadership of Agency for Informational Security)- Uroš Svete 4. Slovenian Foreign Ministry - big thanks to Jakob Štunf - for great strategic vision and enabling us to see the achievements accomplished in region. Looking forward to #BSF2025

42

Why #Scams Are Different and What #Customer #Security Means? Scams target the #human factor directly - demanding a #paradigm #shift from protecting systems to #protecting #people. Yesterday, at the #FraudFighters IL Meetup hosted at the Team8 offices, I discussed how we can #rethink #fraud #prevention through Customer Security: 1️⃣ The #Human #Factor: Scams exploit #trust and #emotions, not systems. Understanding human #vulnerabilities and emerging scam trends is key to staying ahead. 2️⃣ #Beyond #Perimeters: Scams move across platforms — starting on #social #media and ending in a #bank transaction or #card #payment. Fighting them requires a connected view beyond any single organization. 3️⃣ #Beyond #Identity: Traditional fraud focuses on who you are. With scams, the challenge lies with the recipient, making #recipient #intelligence critical to prevention. 4️⃣ #Shattered #Trust: Scams hit people hardest - breaking trust and causing real #emotional #distress. Organizations must respond with #care, #support, and better #incident #response. Scams are not just another fraud type — they force us to rethink how we #protect people and help victims #recover. Oren Karmi - thanks for leading this #community! How do you think we can address this growing challenge together? I’d love to hear your thoughts. #FraudPrevention #ScamIntelligence #Cybersecurity #HumanFactor #CustomerSecurity #team8

68

8 Comments

Interesting report by Cyberint, a Check Point Company about Telegram's recent change of policy due to Pavel Durov's arrest. https://lnkd.in/dsyY6Ynh As far as alternatives, one trend that our reserachers have spotted, beyond the move to other platform such as Signal, is an increased use of anonimity services such as VPN and TOR, as well as a dramatic increased adoption of Telegram proxies. With hundreds of proxy addresses avialable on Telegram channels, as well as clear and dark web sites, proxies are a straightforward means of hiding one's IP addreses from Telegram, and hence from law enforcement.

2

1 Comment

Since PAYMENTS are not particularly well covered by the current ARF, the EUIDW-4-Payments pilots have come up with quite different solutions. Some parties have apparently bought into the EPC scheme for mobile S€PA payments (MSCT). However, S€PA/ISO 20022 messages were designed for data interchange between Financial Parties, which maps pretty poorly to Wallets as well as adding complexity. In addition, requiring Merchants to use External Providers to generate transaction requests and associated QR-codes seems like overkill since Merchants anyway are authoritative for the originating requests. Yeah, I feel that there may be certain stakeholder interests behind this "brilliant" idea 😆

32

10 Comments

https://lnkd.in/daXiir98 The information regarding Israel's allegedly targeting Hezbollah operatives in a cyber attack, involving exploding pagers, has raised significant safety concerns. If the military possess the capability to remotely damage and explode mobile devices, the proximity of individuals to such devices could present a potential safety hazard. As a preventative measure, individuals may need to rely more on Bluetooth headsets and maintain a safe distance from their devices whenever possible. This incident, however, brings forth a broader concern. It is plausible to assume that such advanced technology may eventually fall into the hands of well-funded cybercriminals or Advanced Persistent Threats (APTs). For high-value individuals or entities, the implication is clear: additional countermeasures must be adopted to mitigate such risks. In Hezbollah's case, it is anticipated that they will conduct a thorough cybersecurity assessment and review in response to the attack. The immediate step would likely involve isolating and containing compromised systems. However, this isolation can disrupt communication channels, forcing a fallback to manual or more rudimentary methods. Such a shift would inevitably reduce operational efficiency and open new vulnerabilities for exploitation.

2

1 Comment

✈️In aviation, there’s no room for compromise when it comes to security. 🚀Try Assura’s Next-Gen Proactive Threat Detection & Response for FREE at https://lnkd.in/erducC7G. Cyberattacks don’t just disrupt—they ground operations, threaten safety, and risk lives. Assura, Inc. Next-Gen Managed SIEM powered by Stellar Cyber Open XDR integrates advanced AI with human expertise to detect and respond to threats before they take off. With automated incident response and real-time threat detection, we help safeguard your IT/OT environments, ensuring smooth operations from the ground to the skies. 🌐 #AviationSecurity #CyberResilience #NextGenSIEM #ITOTSecurity #ThreatPrevention #AviationSafety #CyberDefense #ProactiveSecurity #ThreatDetection #SecurityMonitoring

11

2 Comments