Michael Mumcuoglu

⚠ CYBERSECURITY HIGHLIGHTS FOR THE WEEK ⚠ Threat Actor in Focus - Emerging Threat: Void Manticore’s Destructive Cyber Campaigns Targeting Israeli Organizations Threat Actors: Void Manticore Attack Type: Public-facing web server Objective: Espionage Target Technology: Windows Target Geographies: Israel Target Industries: Government & Critical Infrastructure Business Impact: Data Loss, Data exfiltration Summary: Void Manticore (aka Storm-842) is an Iranian state-sponsored threat actor known for conducting destructive attacks on Israeli organizations and leaking information through the online persona ‘Karma’ (sometimes written as KarMa). These operations often target sectors such as government, finance, and critical infrastructure, aligning with Iran’s broader offensive strategy. The group employs straightforward and efficient techniques aimed at causing rapid and significant damage. Their operations extend beyond Israel, with attacks also reported in Albania, where they use the persona ‘Homeland Justice’ to leak stolen data. In Israel, Void Manticore is notable for utilizing a custom wiper named BiBi, after Israeli Prime Minister Benjamin Netanyahu. One common method Void Manticore uses to gain access to target systems is through internet-facing web servers like CVE-2019-0604, where they deploy web shells like the custom “Karma Shell.” This tool, disguised as an error page, can list directories, create processes, upload files, and manage services, using simple encryption methods like base64 and one-byte XOR for obfuscation. They have also been observed uploading a custom executable, do.exe, which checks for Domain Admin credentials. Upon successful authentication, it installs another web shell, reGeorge, indicating valid credentials. This suggests the initial access might be facilitated by another entity, possibly Scarred Manticore, a more sophisticated threat actor. Continue reading here ➡ https://lnkd.in/gvR_-7wt #CyberSecurity #Cyfirma #ETLM #externalthreatlandscape #ThreatIntelligence #CyberIntelligence #CYFIRMAResearch #malware #ransomware #threatactor #cybersecurityawareness Kumar Ritesh Dr. Saurabh Lal, P.D. Michael Henry Anna Koh Amit Thakur Harry Lee Glaiza Pardilla Harsha Vardhan Sam Parmar Rahul Raghav Yusuke Tateno Chiaki Izena（伊是名千晶）Greg Baylis David Plummer Rakesh R V Nicko Navarrete Ruri A. Hyungchan Mike Cho Montai Saiaroon Huy. Nguyen Tuong Vinh Dudley Swanepoel Mouli Saha Greg Baylis Vincent Cheng Julius S.

13

Are you in Vegas ??? 👀 Make sure you don't gamble with your GenAI Security! 📆 Book an intro with our team there: https://lnkd.in/dFj5xcwP Not attending the conferences this week? No worries, we still got you covered. 🛡 Here are some resources to catch up on all things GenAI Security: ▶ Listen to the latest episodes of PromptCast, the podcast of AI and Security: https://lnkd.in/dBrDF383 ▶ Get a quick roundup of GenAI risks and vulnerabilities: https://lnkd.in/d6aPsRjG ▶ Test your homegrown apps with Prompt Fuzzer: https://lnkd.in/d8KVYBe8

28

1 תגובה

Discover Cutting-Edge Israeli SIEM/SOC Solutions Israel's Security Information and Event Management (SIEM) and Security Operations Center (SOC) solutions are at the forefront of cybersecurity innovation. Known for their advanced capabilities, these solutions are pivotal for organizations aiming to bolster their security measures. Israeli SIEM solutions excel in real-time security alert analysis, offering comprehensive visibility into IT environments to swiftly detect and respond to threats. Why Israel? Israel stands as a global cybersecurity hub, hosting over 400 R&D centers of major international companies and boasting more than 300 active cybersecurity firms. With annual exports totaling $3.5 billion and a 5% share of the global market, Israel is second only to the U.S. in this field. The nation's unique culture of entrepreneurship and innovation propels its leadership in cybersecurity advancements. Read more: https://lnkd.in/dz5B9C3h Foreign Trade Administration - Ministry of Economy & Industry #soc solutions #SIEM #Cybersecurity

3

2 תגובות

Recent reports of cyberattacks targeting crucial Israeli institutions have raised concerns about organizational vulnerabilities. 🔒 While investigations are still underway, these incidents underscore the importance of staying ahead of evolving threats. In a recent article for Israel Hayom ישראל היום, Aviv Hooker, Co-Founder and CRO of Faddom, emphasizes the need for advanced cybersecurity solutions. He argues that mapping IT environments is essential for early identification of vulnerabilities, threat detection, and preventing breaches before they happen. https://lnkd.in/dBZN-htB

14

M-Trends #2024 Special Report Mandiant (part of Google Cloud) Zvika Flaicshmann -Expert insights into today’s top cybersecurity trends and attacker developments for 15 years running. In this 15th edition, M-Trends provides an inside look at the evolving cyber threat landscape, with data drawn directly from frontline incident response investigations and threat intelligence findings of high-impact attacks and remediations around the globe. Get informed on the following topics: The latest incident response metrics including dwell times, detection sources, initial infection vectors, and so much more China-nexus attackers increasingly targeting edge devices and platforms that lack EDR Trending adversary operations and motivations behind zero day attacks The evolution of phishing techniques amidst modern security controls How attackers are leveraging AiTM to compromise multi-factor authentication safeguards The reasons and solutions behind growing cloud and hybrid cloud environment intrusions How AI is effectively used in red and purple team operations to help boost cyber defense Do you know who is attacking your kind of companies? Are you familiar what weaknesses exploits those attackers use? We know, and we want you to know, too, so you can better protect your organization. Let's set half an hour for the conversation. We will tell you what we do and how it connects to your needs. Set your meeting with this link: Presale1️⃣ https://lnkd.in/d7uW6_Ug

6

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

30

1 תגובה

"With great power comes great responsibility." - Uncle Ben A few months ago, I received a call from a dedicated member of OTI - The Israeli Autism Association. They had noticed suspicious activity in their email system and had heard about OP Innovate's Digital Forensics and Incident Response (DFIR) services. Without hesitation, Omer Pinsker, Ben B., Mickey Alton, and I decided to help. In our free time, we thoroughly investigated the situation to ensure the organization's data was secure. We also conducted a penetration test to confirm that the attacker would not find another way in. It's infuriating to think someone would target a non-profit organization that supports autistic children. If I could, I would confront the attacker personally for attempting to harm such a noble cause. At OP Innovate, we always stand by those who need cyber protection the most. If you are a non-profit organization facing cybersecurity challenges, feel free to reach out to me on LinkedIn. #CyberSecurity #PenetrationTesting #DFIR #NonProfitSupport #OPInnovate

46

1 תגובה

Hill Climbing Managing Risk AI and human ingenuity working together at Forbes Technology Council Risk management is dependent on input parameters and modeling various scenarios, including edge cases, which are often related to catastrophes (such as the Covid-19 pandemic). While humans are very good at describing boundary conditions, AI is superior in modeling various scenarios, including statistical predictions of catastrophic cases on the edges of models. - Ondrej Krehel #AI #leadership #datascience

1

1 תגובה

Constantly hearing about Infostealers and still don’t know what they are and how they impact your organization? Listen to our interview with Recorded Future to learn all about Infostealers ⬇️

11

Double Threat Detection Duty at GISEC Global ! We're bringing you not one, but TWO expert sessions today at GISEC Global. Here's what we have lined up: 11:50 AM - 12:05 PM (CI Stage, Defence Track): Vladimir Golyashev dives into "Fusion Center development strategies for Air-Gapped environments." 2:10 PM - 2:30 PM (Dark Stage): Ivan Pisarev tackles "The Rise of Hacktivism During Tension." Join us for these insightful sessions and gain valuable knowledge on fortifying your cyber defenses! ️ #GISEC2024 #GroupIB #Cybersecurity #ExpertSessions #FusionCenter #Hacktivism

46

Some necessary stats from Akamai Technologies Boaz Gelbord Check back for the cyber joke of 2024! #RSA #RSAC #RSAC24 __________________________________________ Hi! My name is Maverick! #TheDataLawyer I’m the Founder & Managing Attorney for Avant-Garde Legal, PC I post about pretty much anything related to Data and why you should consider a legal/risk management approach first or in tandem to upping your tech stack. More so, I just like making content on how this applies in real life so follow share and engage with my posts! #data #dataprivacy #dataprotection #dataprotectionlaw #artificialintelligence #ai #databreach #privacy #privacylaw #privacypro #cybersecurity Check out my last post here: https://lnkd.in/eEidE_c3

1

3 תגובות

UNC4393 goes gently into the SILENTNIGHT "In mid-2022, Mandiant's Managed Defense detected multiple intrusions involving QAKBOT, leading to the deployment of BEACON coupled with other pre-ransomware indicators. This marked Mandiant's initial identification of UNC4393, the primary user of BASTA ransomware. Mandiant has responded to over 40 separate UNC4393 intrusions across 20 different industry verticals. While healthcare organizations have not traditionally been a focus for UNC4393, several breaches in the industry this year indicate a possible expansion of their interests. However, this represents only a fraction of the cluster's victims, with the Black Basta data leak site purporting over 500 victims since inception. Over the course of this blog post, Mandiant will detail the evolution of UNC4393's operational tactics and malware usage throughout its active lifespan, with a focus on the period following the QAKBOT botnet takedown. We will highlight the cluster's transition from readily available tools to custom malware development as well as its evolving reliance on access brokers and diversification of initial access techniques."

3

Check out CYJAX's latest cyber intelligence weekly round-up! This week's video explores cyberattacks linked to the Israel-Palestine conflict, global DNS probing by a Chinese threat actor, and a major data leak involving the New York Times. For the written version - subscribe to our newsletter here: https://lnkd.in/dFgKdKPU #DataBreach #CyberSecurityNews #ThreatIntelligence

7

Come to see Dr. Chase Cunningham and Alon Yaffe at MazeBolt ! How DDoS vulnerabilities are the path to a damaging DDoS attack. And how you identify them and get rid of them! Come watch this, should be very interesting! #Akamai #F5 #Radware #A10 #Netscout #Imperva #Dora #Sec #DDoS #DDoSProtection #DDoSMitigation #MazeBolt #Infosec2024 #DDoSVulnerabilites #DDoSVulnerabilityManagement #MazeBolt #MazeBoltRADAR #DDoSTesting #DORA #SEC #Compliance #Cybersecurity #OperationalResilience #cyberinsurance #cyberthreat #BusinessContinuity #VulnerabilityManagement

10

Infostealer - A Threat on the Rise: Last year, an employee of the Israeli National Cyber Directorate learned a harsh lesson. His private workstation was mysteriously infected, and his details leaked to the internet, including screenshots of his desktop and other details. The researcher was hit by "Stealer malware" (aka Infostealer) called Redline. This is THE most trending kind of malware currently – even more prevalent than ransomware – so allow me to elaborate: Stealer malware is designed to steal information from a PC. The attack vectors are numerous – including phishing, software bundles, browser plugins, and more. Once the victim downloads the rogue software, the virus steals all sorts of data: browser cookies, passwords, crypto wallets, files, and more. As the software doesn't need to encrypt files, the attack fingerprint is minimal, and the malware is hard to detect. According to Specops, hundreds of millions of passwords have already leaked online, and it is estimated that millions of devices are infected worldwide. The journey of the stolen files is fascinating. First-hand – the OGs – they skim the cream after evaluating the data and gain access to large wallets, lucrative bank accounts, etc. They then sell the dump with all the data on the dark web or Telegram. The buyers are usually cybercriminals who use this bulk of stolen usernames and passwords to gain access to organizations' networks (this practice is called Credential Stuffing). This is how Uber was breached. We're not done yet because eventually, the data typically leaks onto the web, where strategic players lurk for diamonds. This is presumably how the details of the Israeli gov employee got out. The data changes hands and is exploited multiple times; you've got to admire the scavenging. Two weeks ago, law enforcement agencies from 6 countries managed to take down the infrastructure of Redline – the most notorious stealer malware gang. This is great news, but you know, there is no checkmate in cyber defense. The game is on. So, what can individuals and organizations do to avoid stealer malware? • It is wise to protect employees' personal assets as well – as they are the weakest link in the network. However, privacy issues must be considered. • Strict access management is critical, under Zero-Trust assumptions. No BOYD should be allowed in. • Two-factor authentication across all sensitive assets is always wise, also as protection for this kind of attack. ·     Make sure SSO is implemented in every SaaS and on-prem. ·     Avoid dual users accounts in any cost, leave no generic users such as “support” or similar used by multiple people and teams. ·     Make sure to implemented credential breach monitoring. If you have any thoughts or battle-earned experience with this kind of threat – you're invited to comment and share your knowledge for the benefit of all parties. Be Breach Ready!

50

9 תגובות

TL;DR: Successfully operationalizing SOARs to increase security team efficiency often demands substantial resources in time and personnel. 🚨 Key Challenges in Operationalizing SOAR (Security Orchestration, Automation, and Response) 🚨 SOAR platforms automate repetitive tasks to boost security team efficiency. While earlier SOARs were code-heavy, modern platforms now offer low-code/no-code options, making automation more accessible. Despite this, the core objectives remain: automating actions through API calls, enrichment (correlating alerts with threat intelligence), and end-to-end investigations. However, challenges remain: Lack of Unified Data View SOARs pull data from various tools, but lack of rigorous data normalization requires custom queries to each tool in the stack. This demands expertise in data correlation and API management. Playbook Development & Maintenance Out-of-the-box playbooks often need customization, especially for complex tasks like end-to-end investigations. The more complex the playbook, the more fragile it becomes. Changes to vendor APIs or input data can break playbooks, requiring constant maintenance. Scaling Challenges Playbooks are often designed for specific alert types (e.g., phishing). Scaling to cover all threats is complex and impractical due to the resource investment required. Specialized Skillsets & Hidden Costs The true cost of operationalizing SOAR goes beyond licensing. Specialized engineers are needed to build, integrate, and maintain playbooks, leading to unfulfilled ROI and undermining the initial SOAR investment. 👋 Struggling with these challenges? Harish Singh and I built a solution that addresses these pain points—automating security outcomes with minimal operationalization time using Gen AI. DM me to learn more! #SOAR #CyberSecurity #Automation #IncidentResponse #SecurityOps #CISO #SOC #AI #genAI #AutomationSolutions #AIAnalyst

43