Yotam Perkal

"The #Ransomware Renaissance: What we can learn from #hackers about #Malicious #Innovation" A Message from Keren Elazari Dear all #Cybersecurity isn’t about keeping secrets anymore. It's about our way of life, in a fast-changing world that relies on #digital #technology, from clouds to #smartphones, through #sensors to #stock #markets, and so much more. While you may still be thinking of how things used to be, Today’s #cybercriminals are #innovating faster than ever. This talk https://lnkd.in/d7usR2tR will explore and highlight the current #renaissance of #malicious business models such as #ransomware. Keren Elazari Leading Cyber Ladies Presale1️⃣ #presale1 Eyal W. https://lnkd.in/dW5QWTvS

8

Data Breach Alert ☣  - Alleged data sale of Harel Group Threat actor claims to be selling the data of Harel Group, the largest insurance group in Israel. The leaked data reportedly contains 1.8 million records, including names, identity card numbers, dates of birth, addresses, cities, zip codes, phone numbers, and more. - #data_breach #data_leak #infosec #dark_web #DataBreach  #DataLeak  #Services  #CyberThreat  #CyberAttack

29

2 תגובות

Check out CYJAX's latest cyber intelligence weekly round-up! This week's video explores cyberattacks linked to the Israel-Palestine conflict, global DNS probing by a Chinese threat actor, and a major data leak involving the New York Times. For the written version - subscribe to our newsletter here: https://lnkd.in/dFgKdKPU #DataBreach #CyberSecurityNews #ThreatIntelligence

7

M-Trends #2024 Special Report Mandiant (part of Google Cloud) Zvika Flaicshmann -Expert insights into today’s top cybersecurity trends and attacker developments for 15 years running. In this 15th edition, M-Trends provides an inside look at the evolving cyber threat landscape, with data drawn directly from frontline incident response investigations and threat intelligence findings of high-impact attacks and remediations around the globe. Get informed on the following topics: The latest incident response metrics including dwell times, detection sources, initial infection vectors, and so much more China-nexus attackers increasingly targeting edge devices and platforms that lack EDR Trending adversary operations and motivations behind zero day attacks The evolution of phishing techniques amidst modern security controls How attackers are leveraging AiTM to compromise multi-factor authentication safeguards The reasons and solutions behind growing cloud and hybrid cloud environment intrusions How AI is effectively used in red and purple team operations to help boost cyber defense Do you know who is attacking your kind of companies? Are you familiar what weaknesses exploits those attackers use? We know, and we want you to know, too, so you can better protect your organization. Let's set half an hour for the conversation. We will tell you what we do and how it connects to your needs. Set your meeting with this link: Presale1️⃣ https://lnkd.in/d7uW6_Ug

6

📢 Exciting News! Our very own Board Member & Secretary, Konstantina Syntila, was recently featured in an insightful interview in IT Security Pro magazine! (in Greek) Click on the image below. 📰 In the interview titled "United for Security: The Dynamic Growth of the Cybersecurity Association", Konstantina discusses the significant challenges currently facing the information security sector and highlights the proactive measures being taken by the ISC2 Hellenic Chapter. She also shares fascinating insights from recent studies. ✒ Check out the full interview to learn more about the vital work our chapter is doing and the latest trends in cybersecurity. #isc2hellenicchapter #informationsecurity #cybersecurity #itsecuritypro

148

9 תגובות

The future of cybersecurity is evolving, and so are we. Meet Prometheus, our AI-driven penetration testing agent in development.   Designed to continuously monitor, detect, and remediate vulnerabilities, Prometheus will enable businesses to take immediate, data-driven action against potential threats. The best part: Prometheus will be able to autonomously control your organization’s entire cybersec tech stack, allowing you to centralize your security posture, limit distracting notifications for your team, and enable 24/7 threat remediation and compliance monitoring across your organization through one simplistic dashboard. At Targhee, we’ve building smarter, faster, and more resilient security solutions. Follow us to stay up to date on the launch of Prometheus!   #prometheus #penetrationtesting #targheesecurity

6

1 תגובה

Dear Linkedin network, if you need a guy who is passionate on innovative in-the-wild zero-day exploit detection and advanced vulnerability research (Windows platforms only), please let me know. :) Meanwhile, I will be on a mixed style of vacations and personal projects. I will continue to work on my stuff such as EXPMON (https://pub.expmon.com), so maybe you will see more activities from @EXPMON_, maybe.. :) (follow @EXPMON_ at Twitter/X for fresh discoveries and activities) During the last 1.5 years, I've published several of my original research addressing previously-unknown zero-days and attack vectors in Outlook/Office/Windows on CPR blog site, as well as driven exploit detection innovations internally across products. I'm proud of the work (I did save my publications as PDFs, as I treat them as "arts" :)), and hopefully it helped and will help the industry/community for better detection and defense in long term. I tried to go the way "performing research to understand how it works" and "using knowledge gained from research to drive itw exploit detection". The mission continues, regardless. :) * Following are the Publications and Links. Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112) https://lnkd.in/d_vm7_Pt The Risks of the #MonikerLink Bug in Microsoft Outlook and the Big Picture https://lnkd.in/gzTWUVs5 The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors https://lnkd.in/gv5HAac6 Abusing Microsoft Access "Linked Table" Feature to Perform NTLM Forced Authentication Attacks https://lnkd.in/dJbYj4DX QueueJumper: Critical Unauthenticated RCE Vulnerability in MSMQ Service https://lnkd.in/gGFsmCUw

58

Week in review: VMware ESXi zero-day exploited, SMS Stealer malware targeting Android users: Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Why a strong patch management strategy is essential for reducing business risk In this Help Net Security interview, Eran Livne, Senior Director of Product Management, Endpoint Remediation at Qualys and Thomas Scheffler, Security Operations Manager of Cintas Corporation, discuss their experiences with automated patch management. Securing remote access to mission-critical OT assets In this Help Net Security interview, Grant Geyer, … More → The post Week in review: VMware ESXi zero-day exploited, SMS Stealer malware targeting Android users appeared first on Help Net Security.

2

The mysterious pager explosions today that wounded over 3,600 people in Lebanon, mostly Hezbollah terrorists, were the result of extensive planning, according to Israeli cyber expert, Oleg Brodt, Director of Research, Development, and Innovation at Ben-Gurion University of the Negev's Cyber Labs. How does a pager explode? What coordination is needed to pull this off? Read how Israel was able to accomplish this widespread attack from The Jerusalem Post: https://lnkd.in/e-wx-hfk

8

1 תגובה

Unpopular opinion incoming: I don’t believe in this fairytale. With such a big investment behind you, it’s not about the customer. It’s about the investors getting their money back. The product looks nice, I do agree. But isn’t the best in on-prem / hybrid cloud. I hear a lot of companies saying I don’t trust them, how long do they exist? Putting my cloud security eggs in this basket is too risky. I won’t even mention profitability, oops 😬 I did. Any idea what kind of salaries they are offering ? It will take a while before they are profitable (don’t think it will happen) I speak with a lot of people in the industry and a lot of new joiners already regret making the move. I don’t like vendor bashing, but if you truly believe that you will become the largest cyber company, you are asking for a comment like this.

41

6 תגובות

Let’s meet at OWASP Global AppSec Lisbon! On June 27 at 1:15pm, Avishay Zawoznik, Security Research Manager and Member of Cato CTRL, will present: “Start covering your bases & stop chasing APT headlines”. Join us to see an end-to-end simulation of a network breach. This will not be a unique or niche scenario, but a typical breach—one that is highly probable and that you may already have encountered on your network. More info here 👉 https://okt.to/HZDrdB #OWASP #cybersecurity #SASE

44

2 תגובות

S2W's Threat Intelligence Center has published a brief analysis report on the #Handala Group. The report details Handala's claim of responsibility for the #Israeli supply chain attack related to the Hezbollah walkie-talkie explosion incident. If you're interested in the full report, please reach out through the contact information below, and we will respond to you. 👉 Contact us: https://bit.ly/3ZG9MNb ✅ Report Title:

The Handala Group claims responsibility for an Israeli supply chain attack involving the explosion of Hezbollah's walkie-talkies.

 ✅ Executive Summary: The Handala hacking group, active on DDW, claims on forums like BreachForums and Ramp that the Israeli shell companies Vidisco and IIB are linked to Hezbollah's walkie-talkie explosion incident. The connection between Vidisco and IIB (Israeli Industrial Batteries) has not been officially confirmed, and further verification is required to establish the credibility of this link. 
📌 What is the #Hezbollah walkie-talkie explosion incident? The Hezbollah walkie-talkie explosion incident, as reported by The #NewYorkTimes, resulted in 37 deaths and about 3,000 injuries. #Iran's ambassador to #Lebanon, Mojtaba Amani, was among the injured. The batteries in the exploded walkie-talkies were labeled with "Gold Apollo," a Taiwanese brand initially suspected to be behind the attack. However, Gold Apollo denied any connection to terrorism, stating that the batteries were actually produced by BAC Consulting, a Hungarian company licensed to use their brand. Hungary's government later clarified that BAC Consulting was merely a trade intermediary without manufacturing facilities. According to The New York Times, BAC Consulting was revealed to be a shell company set up by Israel in Hungary. Israel had been operating BAC Consulting for several years, posing as a walkie-talkie manufacturer and producing devices for general public use. After years of deception, they managed to supply walkie-talkies to Hezbollah. Since 2022, these devices, equipped with specially made batteries, were secretly exported to Lebanon, awaiting the right moment for sabotage. 👉 Contact us: https://bit.ly/3ZG9MNb #Intelligence #Bigdata #Security #AI #Cybersecurity #Darkweb #Telegram #Securityintelligence #AIsecurity #IT #Hacking #DarkBERT #S2W

7

** Thank you all for your insights on our latest research. We're currently revising the blog post and adding further clarification and any missing information based on feedback from the community and our latest review*** 🚨 Dear Security Engineers / AppSec people Uri Aronovici discovered a new attack where threat actors can exploit widely-used external Terraform providers to gain full control of a cloud production environment. Why you should care about it ? 📍 Most SAST / SDLC processes are not catching it 📍 There are many ways to exploit it 📍 There are few ways to detect it while it happens #terraform #cloudsecurity #appsec #riskmanagement

86

22 תגובות

-5- Breaching AWS Accounts Through Shadow Resources The trio, Yakir Kadkoda, Ofek Itach and Michael Katchinskiy, reveal a unique technique that has uncovered vulnerabilities in six (!) different AWS services. A bit of background: S3, one of the oldest AWS services, is a bit different — the names of buckets (the main type of resource) are globally unique, meaning that if someone has claimed the bucket 'test', nobody else can pick the same name, even under a different AWS account. This allows for a bucket-name-squatting issue — predicting the name of a yet-to-be-used bucket, creating it, and making users accidentally pull files from this attacker-controlled bucket. In this talk, the trio uncovers a crazy extension of this attack: predicting the names of (semi-)automatically created buckets. AWS Services utilize S3 by creating buckets to be used behind the scenes. They normally create those buckets, but how do they behave if it exists? Turns out they mostly continue as usual, pushing the files into the bucket anyway and pulling them out at a later time. If an attacker can predict the names of these buckets, they can create them in advance, and on usage — replace the file before it's pulled back out. In case this file is used to create AWS resources, like in their first example of CloudFormation — this leads to arbitrary access to the victim's AWS account. The only remaining hurdle is the bucket names: can they actually be predicted in advance? (6/9) The group discovered that Glue, EMR, SageMaker, and CodeStar AWS services use the AWS account ID as a source of "randomness" for the bucket name. Unfortunately, AWS account IDs are not considered secrets (hot take, I know), so as long as you know your victim's account ID, you could attack them on use of any of these services. Other services, like CloudFormation, use a random hash making it harder for attackers. However, they are fixed per account. The researcher's show that ARNs of these buckets can be easy found in public repos A very cool technique that I'm sure we'll see again in the future! #DEFCON #AWS #S3 #vulnerability https://lnkd.in/djhQzA8n

13

3 תגובות

⚠ CYBERSECURITY HIGHLIGHTS FOR THE WEEK ⚠ Threat Actor in Focus - Emerging Threat: Void Manticore’s Destructive Cyber Campaigns Targeting Israeli Organizations Threat Actors: Void Manticore Attack Type: Public-facing web server Objective: Espionage Target Technology: Windows Target Geographies: Israel Target Industries: Government & Critical Infrastructure Business Impact: Data Loss, Data exfiltration Summary: Void Manticore (aka Storm-842) is an Iranian state-sponsored threat actor known for conducting destructive attacks on Israeli organizations and leaking information through the online persona ‘Karma’ (sometimes written as KarMa). These operations often target sectors such as government, finance, and critical infrastructure, aligning with Iran’s broader offensive strategy. The group employs straightforward and efficient techniques aimed at causing rapid and significant damage. Their operations extend beyond Israel, with attacks also reported in Albania, where they use the persona ‘Homeland Justice’ to leak stolen data. In Israel, Void Manticore is notable for utilizing a custom wiper named BiBi, after Israeli Prime Minister Benjamin Netanyahu. One common method Void Manticore uses to gain access to target systems is through internet-facing web servers like CVE-2019-0604, where they deploy web shells like the custom “Karma Shell.” This tool, disguised as an error page, can list directories, create processes, upload files, and manage services, using simple encryption methods like base64 and one-byte XOR for obfuscation. They have also been observed uploading a custom executable, do.exe, which checks for Domain Admin credentials. Upon successful authentication, it installs another web shell, reGeorge, indicating valid credentials. This suggests the initial access might be facilitated by another entity, possibly Scarred Manticore, a more sophisticated threat actor. Continue reading here ➡ https://lnkd.in/gvR_-7wt #CyberSecurity #Cyfirma #ETLM #externalthreatlandscape #ThreatIntelligence #CyberIntelligence #CYFIRMAResearch #malware #ransomware #threatactor #cybersecurityawareness Kumar Ritesh Dr. Saurabh Lal, P.D. Michael Henry Anna Koh Amit Thakur Harry Lee Glaiza Pardilla Harsha Vardhan Sam Parmar Rahul Raghav Yusuke Tateno Chiaki Izena（伊是名千晶）Greg Baylis David Plummer Rakesh R V Nicko Navarrete Ruri A. Hyungchan Mike Cho Montai Saiaroon Huy. Nguyen Tuong Vinh Dudley Swanepoel Mouli Saha Greg Baylis Vincent Cheng Julius S.

13

🚀 CTI Workshop at BSides Athens 2024! 🚀 🧱 "Block By Block: Building Your CTI Program" 🧱 Join me on June 29, 2024, for a 2-hour workshop designed to simplify the complexities of Cyber Threat Intelligence (CTI) and provide a clear roadmap to develop your own CTI program. 🔍 What will you gain? - Understand the foundational principles of CTI and its critical role in cyber threat management. - Learn the steps to initiate a CTI program and integrate it seamlessly into your business processes. - Discover practical strategies for quick wins and establishing core CTI capabilities. - Explore how to leverage technology to empower your CTI efforts, enhance the skills of CTI analysts, and use maturity models to measure and boost your program's effectiveness. 🎯 Who should attend? - Cybersecurity professionals at any stage of CTI implementation, from those considering starting a program to those refining an existing one. - Business leaders looking to understand how CTI can safeguard and add value to their operations. 📅 Mark Your Calendar! Date: June 29, 2024 Event: BSides Athens 2024 Session: Block By Block: Building Your CTI Program Don’t miss this chance to transform your approach to cyber threat intelligence. Whether you're starting from scratch or scaling up, this workshop will arm you with the insights and tools you need to succeed. 🔗Link to BSides Athens 2024 Agenda -https://lnkd.in/dFdV3J_H See you on Saturday! #BSidesAthens #CyberSecurity #CTI #ThreatIntelligence #InfoSec #threatintel #BSides #threatmanagement #cyberthreat #training #athens #greece

236

3 תגובות