BI.ZONE

Not every thing is as it seems 🤖 Evolving #GenerativeAI enables scammers to create ultra-realistic human avatars. This technology is becoming increasingly accessible and is deceiving thousands worldwide through voice, image, text manipulation. #ThinkTwice: Verify identities through multiple channels and be cautious of requests, even from "familiar" faces. Don’t hesitate to report suspicious activity to your local authorities. Japan - The Government of Japan, Foreign, Commonwealth and Development Office

So, you got an email with a suspicious link? Don't rush to click it Chances are that it is phishing. This is one of the most common scams that allows criminals to get their hands on all kinds of sensitive data, from personal and corporate account credentials to bank card numbers and CVC codes. What should you do if you clicked one of these links and only then realized it was phishing? See the cards. #ThinkTwice

#Phishing attacks are evolving and becoming harder to detect 🪝 It is important, more than ever, to be cautious with unsolicited messages. Remember: a moment of vigilance can protect you from falling victim to sophisticated scams. #ThinkTwice and carefully evaluate any emails from unfamiliar addresses or containing links. Japan - The Government of Japan, Foreign, Commonwealth and Development Office

Checklist: how to recognize and avoid phishing Amid international turbulence, cyberattacks are on the rise. Criminals are using increasingly sophisticated tools to spy on companies and people, steal private information and capitalize on it. Phishing is one of the most widespread threats. The scam has gained popularity due to its unmatched effectiveness. We have created a checklist to better recognize and avoid phishing across various resources. More cyber hygiene rules are available for download here: https://bit.ly/4gpQjFF #ThinkTwice

Raising global cyber awareness In contribution to the #INTERPOL Global Awareness Campaign, we will be posting a series of materials to help you protect yourself against cyber threats under the hashtag #ThinkTwice To begin with, over the past year, our cyber intelligence specialists have been monitoring malicious campaigns against organizations in Russia and other CIS countries, the GCC region, and other parts of the world. We identified several dozen clusters of activity and categorized them based on the motives of the attacks, giving each category a name: hyenas, wolves, werewolves. The cards talk about the naming in more detail. To learn about the tactics and techniques of the attackers in the countries mentioned, download our research: Threat Zone 2024: https://bit.ly/3VMVmID Threat Zone GCC 2024: https://bit.ly/3Bhk0tJ

Cyber Polygon 2024 highlights Cyber Polygon is an international online training for raising global cyber resilience. Its main goal is to reinforce cybersecurity on all levels. This year, the training took place on September 10–11, within MENA International Security Conference in Riyadh, Saudi Arabia. More than 300 organizations joined the training from 65 countries such as Belgium, France, Saudi Arabia, Spain, Switzerland, the UK, the USA, Vietnam, etc. The teams represented various industries, including finance, e-commerce, and education. Cyber Polygon 2024 was based on the scenario "Intelligent assault: a game of destruction." The teams had 24 hours to investigate a sophisticated targeted cyberattack, using classical digital forensics and threat hunting techniques. Based on the online training, we have published a summary report from behind the scenes: the logic and mechanics of the scenario, the course of the training and its leaders, as well as some helpful insights. The report ends with conclusions and professional recommendations following the training. Learn more: https://bit.ly/3OnQHbX

I wrote an article that introduces vulnerabilities in the mobile client-side. I hope this will be useful for those who are just looking at mobile applications and their security

Venture Wolf employs MetaStealer to attack Russian businesses BI.ZONE Threat Intelligence has discovered a previously unknown cluster whose activity can be traced back to November 2023. Dubbed Venture Wolf, the threat actor focuses on a range of industries including manufacturing, construction, IT, and telecommunications. Venture Wolf spreads archives containing a loader with the .com (and occasionally.exe) extension, as well as one or more phishing documents. The adversaries use various image (JPG, PNG) and text (PDF, DOC/DOCX, ODT) files as decoys. The malicious payload is delivered to the compromised system either through a dummy .NET file or the RegAsm.exe process. The adversaries use MetaStealer as the payload. This malware is a fork of another stealer called RedLine. Unlike its parent program, MetaStealer has no developer restrictions that could prevent its use against businesses in Russia and other CIS countries. Learn more: bit.ly/3Uy0vmT

Analyzing Microsoft SharePoint RCE vulnerability Microsoft September Patch Tuesday featured several patches for Microsoft SharePoint, an extensive system with website management features. Our vulnerability researchers focused on the RCE flaw for privileged users CVE-2024-38227, with a CVSS score of 7.2. The article talks about the difficulties the research team encountered during the analysis and what they learned about the Microsoft SharePoint architecture. Learn more: https://bit.ly/3BXeMTL

BI.ZONE Threat Intelligence continues to monitor the Core Werewolf cluster. In its latest campaigns, the threat actor turned to a new loader written in AutoIt and started delivering malicious files via Telegram (in addition to email). Campaign at a glance Core Werewolf uses RAR archives to deliver SFX executables created with 7-Zip. Namely, the archives contain: — an obfuscated malicious AutoIt script — a legitimate executable of the AutoIt interpreter (v. 3.3.16.1) — a PDF document By running the SFX file, the user extracts its content into the %TEMP% directory. This initiates a malicious script with the AutoIt interpreter acting as a next stage loader. Learn more: https://bit.ly/3zRaHA0