Victor Cherubini

As continuos observers in #LATAM region, we've identified in #Chile activity of ransomware groups, such as #Meow, #RansomHub, #Akira, exploting vulnerabilities like listed below: 1. CVE-2018-13379: Vulnerability in Fortinet SSL VPN. 2. CVE-2017-11882: Affects Microsoft Office, allowing remote code execution. 3. CVE-2012-0158: Vulnerability in Microsoft Windows. 4. CVE-2012-0143: Affects Microsoft Excel. 5. CVE-2010-3333: Vulnerability in Microsoft Word. #Cyber #IncidentResponse #MDR #SOC #Malware #Ransomware

3

New Post: #CISA Releases Analysis of #FY23 Risk and Vulnerability Assessments - https://lnkd.in/d-V3nXqW CISA Releases Analysis of FY23 Risk and Vulnerability Assessments 09/13/2024 12:00 PM EDT CISA has released an analysis and infographic detailing the findings from the 121 Risk and Vulnerability Assessments (RVAs) conducted across multiple critical infrastructure sectors in fiscal year 2023 (FY23). The analysis details a sample attack path including tactics and steps a cyber threat actor could follow to compromise an organization with weaknesses representative of those CISA observed in FY23 RVAs. The infographic highlights the most successful techniques for each tactic that RVAs documented. Both the analysis and infographic map threat actor behavior to the MITRE ATT&CK® framework. CISA encourages network defenders to review the analysis and infographic and apply the recommended mitigations to protect against the observed tactics and techniques.   Robert Williams#News247WorldPress

2

𝗗𝗲𝗳𝗲𝗻𝗱𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝗱𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆: 𝗮𝗻 𝗲𝘅𝗽𝗲𝗿𝘁 𝗴𝘂𝗶𝗱𝗲 𝘁𝗼 𝗳𝗼𝗿𝘁𝗶𝗳𝘆𝗶𝗻𝗴 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗮𝗴𝗮𝗶𝗻𝘀𝘁 𝗟𝗗𝗔𝗣 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝘁𝗵𝗿𝗲𝗮𝘁𝘀 🖥   Our Digital Forensics and Incident Response (DFIR) experts in Iberia, Rafael Alfaro March and Rodrigo Muñoz Scannone, are exploring the most prominent Active Directory (AD) threats. In this series, they describe the tell-tale signs that your AD might be at risk, with insight into the best prevention and mitigation strategies.     In the latest blog, we're stepping into the world of LDAP-based attacks - where the very protocol designed to streamline directory access can become an attacker’s playground 👉https://lnkd.in/eF88HT73   #cybersecurity #activedirectorythreats #dfir #ldap #cyberattacks 

17

1 commento

The latest update for #SecurityScorecard includes "Complete Third-Party #RiskManagement Guide for 2025" and "What is #SupplyChain Detection and Response?". #Cybersecurity #GRC https://lnkd.in/dCYSnRZ

1

Researchers at Kaspersky identified a threat group called Twelve, which first surfaced in April 2023 amid the Russian-Ukrainian conflict. Since then, the group has been targeting Russian government organisations with a destructive method of attack, encrypting and deleting victim data. Both groups target organisations in Russia and utilise similar malware, open-source tools, and procedures. BlackJack emerged in late 2023, claiming responsibility for multiple attacks. They rely on publicly available tools such as PuTTY and AnyDesk for remote access and use Ngrok for maintaining persistence in compromised networks. BlackJack and Twelve employ nearly identical versions of LockBit ransomware and Shamoon-based wipers, often placing them in the same network directories. The groups share additional similarities in command execution, naming conventions, and the use of tools like PsExec and Mimikatz. There are few slight differences between the groups. For example, BlackJack uses AnyDesk for remote access, whereas Twelve incorporates additional tools such as chisel, BloodHound, adPEAS, and CrackMapExec. This reliance on open-source utilities underlines the groups’ hacktivist nature, allowing them to operate without proprietary tools while still causing substantial damage to their targets. The report also details a recent discovery of a new activity closely resembling the operations of BlackJack and Twelve. While attribution is not confirmed, the malware samples and techniques indicate a strong connection to the cluster of activity involving these groups. Both groups focus on damaging their targets rather than seeking financial gain, primarily by encrypting and deleting data from the organisations they attack, confirming their hacktivist nature.

1

🚨 Alleged Leader of 'Scattered Spider' Hacking Group Arrested 🚨 On June 15, 2024, a 22-year-old man from the United Kingdom was arrested in Spain, allegedly the ringleader of the notorious cybercrime group, Scattered Spider. This group is suspected of hacking into high-profile organisations including Twilio, LastPass, DoorDash, and Mailchimp, among nearly 130 others. The suspect, identified as Tyler Buchanan from Dundee, Scotland, was apprehended by Spanish authorities in Palma de Mallorca while attempting to board a flight to Italy. Buchanan, also known as "tylerb" in cybercrime circles, is accused of hacking corporate accounts to steal critical information and allegedly controlled Bitcoins worth $27 million at one point. The Scattered Spider group, also referred to as "0ktapus," has been involved in numerous SIM-swapping attacks, where they transfer victims' phone numbers to their devices to intercept authentication codes and password reset links. These attacks have facilitated their access to substantial funds and sensitive corporate data. In January 2024, another alleged member of Scattered Spider, Noah Michael Urban, was arrested in Florida for his involvement in stealing at least $800,000 from multiple victims. Scattered Spider's operations typically start with social engineering tactics to trick individuals into revealing their credentials, allowing the group to infiltrate corporate networks. Their phishing campaigns have targeted major corporations, leading to significant breaches and data thefts. This arrest marks a significant step in combating cybercrime, highlighting the persistent threats posed by sophisticated hacking groups. As always, organisations must remain vigilant and enhance their cybersecurity measures to protect against such attacks. A note of caution though, this does not mean that Scattered Spider is done. Scattered Spider grew from a wider sim swapping community known as The Com. Time will tell if Scattered Spider has enough remaining members to continue, if they replenish their ranks with other members of The Com, or if the remaining members join other groups. Stay informed and stay secure. https://lnkd.in/esi_vbWV #CyberSecurity #ScatteredSpider #SIMSwapping #Hacking #DataBreach #ArachneDigital #CyberCrime #CyberThreats #Phishing #InformationSecurity

5

2 commenti

AV-TEST conducted a comprehensive evaluation of Kaspersky Endpoint Detection and Response Expert from December 2023 to March 2024. The evaluation focused on the effectiveness of the #EDR component in detecting and neutralizing threats commonly associated with sophisticated actor groups known for advanced persistent threats (APTs). The evaluation included detailed test scenarios simulating two different attack patterns, each representing a wide range of tactics and techniques typically used by advanced attackers. Based on the observed results, Kaspersky Endpoint Detection and Response Expert qualifies for the prestigious AV-TEST Approved Advanced Endpoint Detection and Response #certification, which recognizes the product as a reliable and effective solution in the field of cyber security. Read more here: https://lnkd.in/eMHdd24s #Kaspersky #cybersecurity Kaspersky DACH

7

CVE-2024-3661 - CVSS 8.8 - EPSS We don't have an EPSS score for this CVE yet - By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. Ref.1: https://lnkd.in/eXEskBcn Ref.2: https://lnkd.in/e_KwDMtH

1

New feature in TaskForce 2024.6! 🎉 With the new TaskForce update, you can combine various ports into a group in Express mode. Each group has different settings of target folder, file format, type of hash to calculate, and case report fields. #dfir #digitalforensics #forensicimaging

13