Thomas Piret

#CyberAttack #Italy: Università degli Studi di Siena has been compromised by the LockBit 3.0 ransomware group. The group allegedly exfiltrated 514 GB of sensitive documents, including: - Documents with budgets detailing expenses by month from 2020 to 2024 - Documents approved by the Board of Directors regarding the financing of projects and tenders from 2022 to 2026, including financing amounts - Documents on extraordinary construction works, the appointment of the contractor, and the allocation of a budget of 1.7 million euros - Non-disclosure documents for WineCraft 2024 - Tender design contracts for 2023, including the contract budget - Documents outlining the contractor's investment plan for 2022, including expenses, rents, and the general financial plan Ransom deadline: 28th May 24. On May 10, the University of Siena's website communicated that due to a massive cyber attack by an international group of hackers, the website admission[.]unisi[.]it, the ticketing service, and the payment management services linked to international admissions are currently suspended. The technical team, supported by the National Cybersecurity Agency, is progressively restoring all services. Read more: https://lnkd.in/dKEFVWtp #Ransomware #DataBreach

4

The divide between “multi-purpose” and “vertical” vendors is longstanding in IT, but analysts now favor the latter in cybersecurity. 📈 With cyber threats increasing rapidly, few vendors can tackle them on multiple fronts. 🗣️ At #InfoSec 2024, Libraesva CEO Paolo Frizzi discussed their niche status in Italy and international expansion. 🎯 He highlighted future goals and presented “The Reality Gap” study, showing #email is still underestimated as a risk factor ⚠️✉️ (download here: https://ow.ly/oMzL50SIXae). 👨‍💻 Read the full article by SecurityOpenLab, here: https://ow.ly/CTTL50SIXaf #EmailSecurity #Cybersecurity #Interview #InfoSec2024

31

Need to turn business continuity, data management, and security into music to your ears? Let's do this together. SSI: Digitally Mindful #businesscontinuity #datamanagement #cybersecurity Antonio Assandri - Roberto DI CATALDO - Massimo Chierici

7

2 commenti

🚨 GrimResource Attack: Beware Malicious MSC Files! ⚠️💻 🛡️ New Attack Technique Uncovered! 👾 Threat actors are exploiting a novel attack method called GrimResource, leveraging specially crafted Management Saved Console (MSC) files to gain full code execution via Microsoft Management Console (MMC). This technique, identified by Elastic Security Labs, evades security defences effectively. 🛠️ 📅 Discovery and Impact 📉 On June 6, 2024, an artefact named "sccm-updater.msc" was found on the VirusTotal malware scanning platform, marking the discovery of GrimResource. When imported, these malicious console files exploit a vulnerability in MMC libraries, enabling attackers to run arbitrary code, including malware. 🖥️🔓 🔍 How It Works 🧩 GrimResource uses a cross-site scripting (XSS) flaw in the apds.dll library, reported back in 2018 but still unpatched. By referencing the vulnerable APDS resource in the StringTable section of a malicious MSC file, attackers trigger JavaScript code execution within MMC. This method bypasses ActiveX warnings and can be combined with DotNetToJScript for arbitrary code execution. 🔧💣 🛠️ Real-World Examples 🌐 In a similar vein, the Kimsuky hacking group recently used a malicious MSC file to deliver malware. However, GrimResource's technique is unique in its exploitation of the XSS flaw to launch a .NET loader, PASTALOADER, which facilitates the deployment of Cobalt Strike. 🚨 🔒 Evolving Threat Landscape 🌍 With Microsoft disabling Office macros by default for internet-sourced documents, attackers have shifted to alternative vectors like JavaScript, MSI files, and LNK objects. However, these methods are now heavily scrutinised by defenders. GrimResource offers a new way to execute arbitrary code in MMC, showing how threat actors continually adapt to circumvent security measures. 🛡️🕵️‍♂️ 🚀 Stay Protected! 🛡️ - Be Vigilant: Monitor for unusual MSC files and scrutinise them before opening. - Update Regularly: Ensure your security systems are updated to detect and mitigate such novel threats. - Educate: Inform your team about the risks associated with MSC files and other unconventional malware vectors. Stay safe and proactive against evolving cyber threats! 🚀🔒 👉 To read more phishy articles, please visit www.gonephishing.xyz - and sign up to our newsletter to never miss a story! #Newsletter #CyberSecurity #Hacking #Technology #Hacker

1

The cover topic for this month is reverse engineering, and we have a great guide for you to follow, by Leonardo Marciano and Deivison Franco. https://lnkd.in/dr6U9UjG #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

The cover topic for this month is reverse engineering, and we have a great guide for you to follow, by Leonardo Marciano and Deivison Franco. https://lnkd.in/dr6U9UjG #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

The cover topic for this month is reverse engineering, and we have a great guide for you to follow, by Leonardo Marciano and Deivison Franco. https://lnkd.in/dr6U9UjG #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

We have a special series of Cyber Focus coming from #RSAC. First, we have Alison King and Elisa Costante talking about NSM 22, the Report on Cybersecurity Posture of the United States and creating opportunities for women in cyber.

22

2 commenti

Preparing for the ISC2 exam? In the event of a disaster, what should be the objective? a) Protection of the production database b) Application of disaster communication c) Guarantee the continuity of critical systems d) Guarantee the safety of people #CyberSecurity #isc2

4

The cover topic for this month is reverse engineering, and we have a great guide for you to follow, by Leonardo Marciano and Deivison Franco. https://lnkd.in/dZK7GtiU #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #opensource #windows

1

The cover topic for this month is reverse engineering, and we have a great guide for you to follow, by Leonardo Marciano and Deivison Franco. https://lnkd.in/dZK7GtiU #infosec #cybersecurity #pentest #pentesting #hacking #hackers #windows

1

Chinese Cyber Espionage Group Exploits Fortinet, Ivanti and VMware Zero-Days: The China-nexus cyber espionage actor linked to the zero-day exploitation of security flaws in Fortinet, Ivanti, and VMware devices has been observed utilizing multiple persistence mechanisms in order to maintain unfettered access to compromised environments. "Persistence mechanisms encompassed network devices, hypervisors, and virtual machines, ensuring alternative channels remain available

1

New Microsoft Entra Suite! Microsoft has launched a powerful new tier of identity management and security tools, designed to support Zero Trust principles and address integration gaps that could pose risks for your business. 🔑 Key Capabilities: -Private Access -Internet Access -ID Protection -ID Governance -Face Check with Verified ID 💡 Curious how these features can benefit your business? Check out our blog to learn more about boosting security and streamlining operations with Entra ID. https://bit.ly/48dQaSJ #Microsoft365 #EntraID #ZeroTrust #DataSecurity #IdentityManagement #AI

3

#Digitalsecurity skills can be for everyone! Learn about the #InternetofThings (#IoT) and #ITsecurity risks you can reduce; from USB and Bluetooth vulnerabilities to #viruses, #malware, and more in the article by #Cybersecurity expert Simone Davide Bertulli: https://lpi.org/r58w #LPI #SecurityEssentials #openstandards #attestation #Linux #bluebugging #TrustedComputing #cryptography #tech #digitalthreats #dataprivacy

27

1 commento

🛡️ NIST CSF 2.0 Audit Checklist: 𝗔𝗹𝗹 𝗣𝗮𝗿𝘁𝘀 𝗶𝗻 𝗢𝗻𝗲  📑 A Complete Overview 🛡️ 🔍 Why It Matters The NIST Cybersecurity Framework (CSF) 2.0 is the gold standard for managing and improving cybersecurity practices. This checklist empowers organizations to align their processes, ensuring they’re ready to mitigate risks, handle incidents, and recover effectively. 📂 Core Functions Breakdown Every critical component of NIST CSF 2.0 is streamlined into actionable steps for seamless implementation: 1️⃣ Identify (ID): Catalog key systems, assets, and data. Map risks to business priorities. Establish accountability for risk management and governance. 2️⃣ Protect (PR): Implement access controls, encryption, and secure configurations. Train employees on cybersecurity best practices. Strengthen technical safeguards to protect critical resources. 3️⃣ Detect (DE): Deploy tools to monitor threats in real time. Set up alert mechanisms for anomalous activity. Maintain robust logging for future analysis and forensics. 4️⃣ Respond (RS): Develop an incident response framework. Ensure rapid threat containment and recovery. Establish clear communication protocols during crises. 5️⃣ Recover (RC): Test disaster recovery procedures regularly. Integrate lessons learned into updated strategies. Improve resilience through continuous refinement of recovery plans. 💡 Why Choose This Checklist? Whether you’re an auditor or security leader, this resource is a practical tool to navigate NIST CSF 2.0, ensuring compliance and reinforcing your organization’s security posture. ✅ Your Next Step Leverage this all-in-one checklist to audit, improve, and future-proof your cybersecurity strategy. Stay secure, stay prepared! Thank you, Ministry of Security 🤝

46

2 commenti