Shubham Gade

Distribution of Malware Under the Guise of MS Office Cracked Versions (XMRig, OrcusRAT, etc.) Through a post titled “Orcus RAT Being Distributed Disguised as a Hangul Word Processor Crack” [1], AhnLab SEcurity intelligence Center (ASEC) previously disclosed an attack case in which a threat actor distributed RAT and CoinMiner to Korean users. Until recently, the attacker created and distributed various malware strains, such as downloaders, CoinMiner, RAT, Proxy, and AntiAV. Numerous systems in South Korea tend to become infected by malware strains that are distributed under the guise of cracked versions of legitimate programs, such as Hangul Word Processor or activation tools for Windows or Microsoft Office. Threat actors have been upgrading their malware by adding another layer to this process, which is registering to the Task Scheduler in the infected system. https://lnkd.in/di_ctMJu

11

In continuation to my yesterday's post and questions I got... Here are some simple practices for your SOC and SIEM Implementation: 1. Prioritisation - Focus on high-impact scenarios first - Align with threat landscape - Consider business context - Address regulatory requirements 2. Tuning - Regular rule optimisation - False positive reduction - Performance impact assessment - Baseline establishment 3. Response Procedures - Clear escalation paths - Documented playbooks - Automated responses where appropriate - Regular testing and updates 4. Monitoring & Maintenance - 24/7 coverage - Regular rule reviews - Updated threat intelligence - Performance optimisation 5. Documentation & Reporting - Detailed alert documentation - Incident tracking - Metrics and KPIs - Trend analysis Key Considerations: 1. Environment-specific customisation 2. Regular updates based on threat intelligence 3. Balance between coverage and manageability 4. Integration with incident response procedures 5. Compliance requirement alignment 6. What and how far would you want to automate 7. How and when to use AI across all the practices 8. Overall Governance, Audit and Control While this provides a foundation for SOC operations, it should be customised based on: - Organisation size and industry - Specific threats and risks - Available resources - Regulatory requirements - Technology stack Share more in comments…

35

🎁Hey Guys As I promised yesterday....The correct answer for the yesterday's Q. No 147 CISSP ToTD is in the COMMENT below. 👇👀👀🎁 Have a look and share your input in comment below.👇👀👀🎁 #cissp #cissptraining #cybersecurity Cybernous Infosec Consulting LLPPratima Sharma

7

1 Comment

Intro to Hacking 0x02: Same-Origin Policy | XSS 101 | Telugu | తెలుగు Discussing basics of browsers, Same-Origin Policy, SOP Bypass and XSS Added English subtitles this time. https://lnkd.in/g3Y4z35f Reposts are appreciated 😅 #infosec #security #xss #sop #telugu

26

2 Comments

How do phishing emails get pass through email security solutions and spam filters? There's a difference between spam and phishing emails. Attackers using phishing as their attacking technique are aware of how spam filters and email security solutions work. All they need to do is get a reputed domain and personalize the email!! #CyberSecurity #phishing #Spam #filters

11

I've published a writeup for ALL forensics challenges from ICMTC CTF 2024 (Qualifications phase). I hope all readers derive benefits from reading it ❤️. Thanks to (Military Technical College – الكلية الفنية العسكرية). #ICMTC #CTF #cybersecurtiy #digitalforensics

28

2 Comments

Many candidates having 1 or 2 yrs of SOC Analyst experience, are approaching us, to get into VAPT domain. We talk to them at length and guide them. Gist of what they tell us ... 1. SOC is so boring, makes me sleepy. 2. I dont know why they told me it was cyber security job, I feel cheated 3. Its hardly any money in this SOC thing, as compared to labour. 4. This SOC job is killing my eyes 5. What I got from this job? Oh.. A syndrome called Text Neck. 6. I have shot my career to hell, I need a restart 7. Pentesting is so exciting. 8. My parents dont want me to leave this SOC job, they are yelling at me. 9. My tea/coffee has increased. 10. This cyber security is so darn confusing. I need someone to guide me but everyone talks about joining some company. I need guidance first, job later. Many more insights we collect. On a lighter note -- If someone wants to build an AI model on this, let me know 😁

95

10 Comments

Requirement 8 of PCI DSS is about identifying access. It also is about restricting access to unique IDs. Meaning that everyone who accesses the CDE is fully identifiable for non-repudiation. Setting lockouts for failed logins and automatic logouts after 15 minutes. We also need to be able to identify any source, both logically and physically, for users and apps/systems.

1

🚨 New Video Alert: "GOVT. Job vs IT JOB😱 Which is Better❓ | Cybersecurity Jobs in SBI Bank" 🚨 Hello LinkedIn Community! 🌐 Are you confused about choosing between a Government Job and an IT Job in the private sector? Especially when it comes to Cybersecurity roles, the decision can be tricky! In our latest YouTube video, we explore the pros and cons of both career paths with a special focus on Cybersecurity Jobs in SBI Bank. Whether you're drawn to the stability of government jobs or the dynamic opportunities in IT, this video will help you make an informed decision. 🔑 What’s inside? 1️⃣ GOVT. Job vs IT Job: A detailed comparison of work culture, growth opportunities, job stability, and compensation. 2️⃣ Cybersecurity in SBI Bank: Insights into what it’s like to work in cybersecurity for a leading government bank, including the roles, responsibilities, and perks. 3️⃣ Choosing the Right Path: Tips and considerations for picking the career path that best aligns with your goals, skills, and aspirations. 🔗 https://lnkd.in/gsy8ktHn Whether you're a fresher or an experienced professional looking to make a career move, this video will help you weigh your options and decide what’s best for your future. 🌟 Like, comment, and share to help others who are on the same journey! 🤝 Let’s navigate the cybersecurity career maze together. 💼 #GovtJobVsITJob #CybersecurityJobs #SBIJobs #CybersecurityCareer #CareerDevelopment #GovtVsPrivate #InfoSec #LearnAndGrow

9

قال سبحانه و تعالى :-(وَعَلَّمَكَ مَا لَمۡ تَكُن تَعۡلَمُۚ وَكَانَ فَضۡلُ ٱللَّهِ عَلَیۡكَ عَظِیمࣰا) [النساء ١١٣] بتوفيق من الله سبحانه و تعالى ♥️ In the last three weeks, I had submitted three Security Vulnerabilities to Google Company :- 1- The First :- Accepted 2- The Second :- Triaged and under investigation . 3- The Third :- Closed as Duplicate (Duplicated by their bug tracking mechanism), The bug was :- Clickjacking vulnerability in sensitive functionality. - The vulnerabilities were in main Google assets ( : - Currently i can't disclose any information about the other two vulnerabilities, maybe after fix. #Tip :- Don't say oh this is a big company and its impossible that it can suffer from this specific type of vulnerability, And always remember that big companies are the most vulnerable ( : #bugbountytips #cybersecurity #security

113

15 Comments

good to know

2

Who is "kiberphant0m," the Threat Actor Behind the BSNL Security Data Breach? 🕵️‍♂️💻 'kiberphant0m,' a notorious Blackhat hacker infamous on the Dark Web. This alias has recently claimed responsibility for the breach of Bharat Sanchar Nigam Limited (BSNL), India’s prominent telecom company. 'kiberphant0m' is no stranger to high-profile cyber attacks. According to their Telegram group, this threat actor boasts possession of data from major financial institutions across the US, UK, Egypt, and India. The critical data stolen from these institutions is being sold on the dark web, posing a significant threat to global cybersecurity. BSNL Breach Details: This marks the second time in six months that BSNL has fallen victim to a data breach. This recent attack has resulted in the leak of 278GB of sensitive data, including: International Mobile Subscriber Identity (IMSI) numbers SIM card details Home location register data Critical security keys Alarmingly, this data is priced at just $5000 on the dark web. Key Questions Arising: ❓Were the necessary steps not taken after the first breach? ❓Is the security of customer data not the top priority? ❓ How effective and swift is the incident response team? ❓ What will be the long-term impact of this breach? Call to Action: Organizations must reassess their cybersecurity strategies, ensure all vulnerabilities are addressed, and prioritize customer data protection. It’s not just about responding to incidents, but proactively preventing them. Stay informed, stay secure! 🌐🔒 #CyberSecurity #DataBreach #BSNL #CyberThreats #Infosec #CyberAwareness

32

7 Comments

SOC Monitoring, has a weird anomaly and trend .. Developed, promoted and hoaxed by industry itself. "Everything is Tagged and Called, An Incident" This tendency of calling everything an incident dilutes so many things, both in monitoring & response. A lot of unclear processes, botched up responses and messed up ownership is because of this tendency. Top Things to Remember (And, Implement) 1. Alert is not an incident (even critical ones) 2. Incident is not a breach (till it is investigated) 3. Breach is when system access or data damage is in play Lot of orgs overload their system and bandwidth, with documentation of the alerts, considering them as an incident. That causes several unwarranted and unnecessary impacts and influences. 1. Noise levels in response eco system go way up 2. When a real incident takes place, it does not get attention 3. Culture becomes more documentation centric than response A lot of this happens, when you don't have a designed, stated and owned incident response process and plan adopted. When your response model (is-kind-of) is buried in monitoring model, this happens a lot. Focus on adopting a proper response plan and process. That saves the day, a lot more often, than just monitoring. #cyberattack #cyberbreach #breach #attack #incidentresponse #cyberincident #goal

19

💼 Unlock Your Career Potential: Dive into Our Exclusive Interview Questions Document! 📝 Before you scroll down Follow Niranjan V for more such Infosec Content. Reach out for ISO 27001 Mentorship, Training, and Guidance. Join our exclusive infosec community: https://lnkd.in/gG_aG5AF 1️⃣ Introduction to the Document: Elevate your career in Governance, Risk Management, and Compliance (GRC), SOC Analysis, or Penetration Testing with this comprehensive Interview Questions document! Whether you're a seasoned professional or aspiring to break into the field, this resource offers invaluable insights to help you ace your next interview and land your dream job. 2️⃣ What's in the Document: Discover a curated collection of interview questions tailored to GRC, SOC Analyst, and Penetration Testing roles, covering essential topics such as risk assessment methodologies, security operations center processes, penetration testing techniques, and more. Prepare yourself with confidence and stand out from the competition with our expertly crafted interview questions. 3️⃣ Conclusion: Ready to take the next step in your career journey? This Interview Questions document equips you with the knowledge and preparation needed to excel in GRC, SOC Analyst, and Penetration Testing interviews. Whether you're seeking new opportunities or aiming to advance in your current role, leverage this resource to showcase your expertise and secure success in the ever-evolving field of cybersecurity. Download now and embark on your path to professional excellence! #GRC #SOCAnalyst #Pentesting #Interview #prep #infosec #cybersecurity #interviewprep

168

8 Comments

The latest Cyber Security Framework revision from SEBI is here and it is more stringent than what the stakeholders anticipated through the draft papers. #SEBI #Cybersecurity Page69: The key functions performed by SOC are as follows: 1. Continuous monitoring: To monitor the end-points and network round the clock to immediately notify of abnormal or suspicious behavior. 2. Log management: To collect, maintain, and review logs of all end-points and network activities. Further, SOC aggregates and correlates data from various applications, firewalls, OS and endpoints to establish a baseline for normal behavior. 3. Threat response: To act as a first responder during a cybersecurity incident. Captive SOC is responsible to perform actions like isolating endpoints and limiting the damage with as little disruption of the business as possible. For all forms of managed SOC, the service provider shall alert the RE and guide them in incident management. 4. Alert Management: To monitor alerts issued by diverse tools and closely inspect each one of them in order to discard false positives (if any), and determine the potential impact of threats. 5. Root Cause Investigation: Post the occurrence of incident, SOC is responsible for investigating when, how and why an incident occurred. SOC analyzes all logs to identify the root cause of the incident and prevent its reoccurrence after incorporating learnings from the incident.

13

Long awaited 😊 . BasisTech offered their 1 Day Autopsy Basics and Hands on course for free, during the initial days of Covid. It is a free, opensource digital forensics tool that is quite handy for the investigation purpose. While most of the tools are only available for law enforcement agencies or quite costly, this one is handy for learning DFIR and investigating cases with multiple 3rd party modules available. The training covers the indepth detail to begin exploring the software, followed by quick overview for other modules which is expected in a one day training course. At the time of the recording, it could analyse the Android device data however didn't support capturing it. Hope, it does now or will do in future. It can do all the required job to begin with as also used by the winner of last CTF by Belkasoft. Though I liked the interface of Belkasoft more, but this one is worth using for free 😉. Stay tuned for more OpenSource Forensics softwares .... #ProjectVic #SQLite #C4ALL #ingestdata #pythonmodules #OSDFCon #sleuthkitlabs #autopsy #basistechnology #thinkific #opensource #forensics #case #metadata #ingest #DFIR #Registryanalysis #EXIFExtraction #Embedded #hashhit #NSRL #Hashkeeper #Webartifacts #Regripper #Apache #Solr #Androidanalyzer #Childabuse #exploitive #investigation #PhotoRec #iOSforensics #E01 #YARAanalyzer #Emailparser #flaggedfiles #cybertraige 

19

2 Comments