Yoav Mazor

Detect Initial Compromise, Advanced Persistent Threats, post-attack forensics like reconnaissance, lateral movement, privilege escalation, and command and control communications.     Crystal Eye has up to 11 times more visibility than comparable products in the UTM class. Our security teams prioritise complete visibility across all known malware and threat actors to detect east-west and north-south network traffic to effectively mitigate security risks.    Get best-in-class Detection and Response Capability that disrupts the attack chain from all malwares, APTs and all complex and modern-day attacks.     Level up your security maturity backed by a team of security experts working round-the-clock to protect your systems.  Complete Coverage, Integrated Threat Intelligence, and Peace of Mind!    Read More: https://bit.ly/4991wHg    #Infosec #CyberNews #TeamDefenceAustralia #cybersecurity #AustralianMade

11

1 Comment

According to recent research, Chinese hacking groups have been targeting a Southeast Asian government agency in a coordinated cyber espionage operation since March 2023. Campaign dubbed "Operation Crimson Palace", involved new malware variants and three activity clusters. Despite Sophos blocking some operations, the attackers have persisted, attempting to resume illicit activities more covertly. Co-founder Francois Driessen weighs in on how this situation reveals the vulnerabilities organizations face when relying purely on reactive security; warranting the need for a true proactive approach. "This is a textbook case of failure of reactive security, no matter how good the technology is," shares Francois. Read the full report here: https://bit.ly/3z3tbMF #ZTconnectivity #CyberEspionage #SophosReport #ThreatGroup

8

👉 What are the latest cybersecurity alerts, incidents, and news? 🚨 #CyberAlerts 5 New Critical Vulnerabilities Added to CISA’s Known Exploited Vulnerability List Source: Cybersecurity and Infrastructure Security Agency New TeamTNT Cryptojacking Campaign Targets CentOS Servers with Rootkit Source: Vito Alfano and Nam Le Phuong via Group-IB Ivanti Cloud Appliance Vulnerability Exploited in Ongoing Cyberattacks Source: Ivanti Iran’s UNC1860 Exploits Passive Backdoors in Middle Eastern Networks Source: Google Threat Actors Misuse Splinter Red Team Tool for Post-Exploitation Source: Dominik Reichel via Unit42 by Palo Alto Networks Unit 42 💥 #CyberIncidents Australia’s Compass Group Confirms Second Ransomware Attack Source: David Hollingworth via Cyber Daily Altman Specialty Plants Reports Suffers Breach Exposing Sensitive Consumer Data Source: Altman Plants BingX Confirms Minor Asset Loss Amid Suspicious Hot Wallet Activity Source: BingX via X Schools in Lancashire, UK Face Major Disruption Due to Ransomware Attack Source: Gemma Sherlock via BBC Sensitive Star Health Customer Data Leaked Through Telegram Chatbots Source: The New Indian Express 📢 #CyberNews Federal Trade Commission Uncovers Surveillance of Children by Social Media Firms Source: Federal Trade Commission Germany Shuts Down 47 Crypto Exchanges Allegedly Supporting Underground Economy Source: Federal Criminal Police Office, Germany DDoS Attacks Overtake Ransomware and Are Now the Dominant Cyber Threat in Europe Source: European Union Agency for Cybersecurity (ENISA) Global Operation Dismantles Major Phishing Network Affecting 480,000 Victims Source: Europol HSBC Pilots Quantum-Safe Technology for Tokenized Gold Transactions Source: HSBC Holdings This Cyber Briefing is powered by https://911cyber.app  Get help from cybersecurity first responders today! Find the full stories at cybermaterial.com Or click here 👇 to read the summaries. https://lnkd.in/e-uiPGVW #cyberbriefing #informationsecurity #CISA #Ransomware #CentOS #Ivanti #Splinter #Telegram #Germany #Crypto

2

In a recent Dark Reading story, Tim Peck, Senior Threat Researcher at Securonix, shares insights on a new North Korean cyber campaign targeting Cambodia. The threat group APT37, also known as ScarCruft, deploys a sophisticated backdoor called "VeilShell" using tactics like hidden shortcut files to evade detection. This campaign, dubbed "Shrouded#Sleep," demonstrates the group's patient and stealthy approach, utilizing delayed actions and obscure persistence mechanisms to maintain long-term control over targeted systems. Tim explained to Dark Reading, "The threat actors were incredibly patient, slow, and methodical. They used a lot of long sleep timers — we're talking, like, 6,000 seconds in between different attack stages. And the main goal of the shortcut file was to set the stage. It didn't actually execute any malware. It dropped the files into a location that would allow them to execute on their own on the next system reboot. That reboot could be the same day, or a week from now, depending on how the user uses their PC." Read the full article to learn how APT37's tactics reflect the complexity of North Korea's cyber activities: https://lnkd.in/gti9jHAq For an in-depth analysis, check out our full advisory here: https://lnkd.in/eEuG-K-p #malware #ThreatResearch #ThreatAdvisory #phishing #TDIR #SIEM #cybersecurity

13

🚨 Cyber Espionage Campaign by Tropic Trooper Targets Middle East 🚨 Since June 2023, Tropic Trooper, also known as APT23 or KeyBoy, has been actively targeting unnamed government entities in the Middle East and Malaysia, marking a new chapter in their cyber activities. This Chinese-speaking threat group, notorious for targeting sectors like government, healthcare, and transportation in Taiwan and Hong Kong, has expanded its focus to entities involved in human rights studies. Kaspersky researchers uncovered Tropic Trooper's use of a modified version of the China Chopper web shell, deployed as part of an attack chain exploiting vulnerabilities in Umbraco CMS. Their ultimate goal? Delivering Crowdoor, a malware implant designed to establish persistence and deliver Cobalt Strike for further exploitation. This campaign highlights the group's evolving tactics, including DLL side-loading, and raises concerns about their continued efforts to evade detection by uploading newer malware samples. Stay vigilant and keep your systems patched! #CyberSecurity #APT #TropicTrooper #Crowdoor #ThreatIntel #MiddleEast

6

🛡️ Unit 42 has tracked North Korean threat actors (DPRK) targeting tech industry job seekers with malware disguised as legitimate job recruitment processes. Posing as recruiters, they lure victims into installing malware like BeaverTail and InvisibleFerret, aiming to steal sensitive data, including cryptocurrency wallets. #ThreatIntelligence #CyberSecurity #NorthKorea 💻 The campaign, dubbed CL-STA-240 Contagious Interview, uses sophisticated social engineering tactics, targeting developers through platforms like LinkedIn and X (formerly Twitter). Victims are tricked into downloading malicious applications such as fake MiroTalk or FreeConference software, leading to system compromise. #SocialEngineering #Malware #JobScams 🔒 The BeaverTail downloader, now rewritten in Qt for cross-platform compatibility, targets both macOS and Windows. Its new capabilities include stealing browser passwords and cryptocurrency wallets, with InvisibleFerret acting as a backdoor for remote control and data exfiltration. #CrossPlatform #CyberThreats #Infostealer 📊 InvisibleFerret, a Python-based backdoor, enables remote control of infected systems, keylogging, and browser credential theft. Recent updates show the malware has been refined to target 13 different cryptocurrency wallet extensions, expanding its potential for financial theft. #Cryptocurrency #Backdoor #MalwareAnalysis 🚨 The infection chain starts with a fake job interview, leading to malware installation, exfiltration of sensitive data, and potentially infiltrating companies employing the targeted individuals. This campaign highlights the ongoing financial motivations of DPRK-affiliated threat actors. #JobSeekers #APT #DataExfiltration 🔧 Palo Alto Networks products such as Cortex XDR and Advanced WildFire provide detection and prevention for these threats across macOS and Windows platforms. Protections include behavioral threat protection, machine learning, and credential gathering defense mechanisms. #CyberDefense #ThreatPrevention #XDR 🌐 Organizations and individuals are urged to stay vigilant against such advanced social engineering tactics. Protective measures, including robust endpoint security, are critical in defending against evolving threats like BeaverTail and InvisibleFerret. #EndpointSecurity #MalwareProtection #Awareness

8

🚨 Cybersecurity Alert: Threats Intensify Across Platforms 🚨 From state-sponsored attacks to significant browser vulnerabilities, recent incidents highlight the critical need for robust security. 🌍 🔒 1. North Korean Group & Play Ransomware Threat actors, including the North Korean group known as Jumpy Pisces, joined forces to launch financially motivated ransomware attacks. This marks a notable collaboration in cyber crime circles, demanding an urgent focus on coordinated defense. https://lnkd.in/gRUpknvr 🔐 2. Opera Browser Vulnerability A critical flaw, dubbed “CrossBarking,” exposed Opera users to potential privacy violations, granting full access to private APIs. The patched vulnerability highlights the importance of regular updates to combat zero-day threats. https://lnkd.in/gp6_yhzW 👾 3. Malvertising Hijack on Facebook Hackers launched a malvertising campaign on Facebook, compromising ad accounts to spread the SYS01stealer malware. Businesses and individuals alike should stay vigilant and strengthen account security to prevent unauthorized access. https://lnkd.in/e2j9zySR

3

Our interim CMO, Joanne Pei Lee Wong, recently shared her insights in an article by The Straits Times about the dismantling of the world's largest botnet, the 911 S5 Botnet. Joanne explained the severe impacts of botnet attacks, highlighting how devices can be unknowingly compromised, leading to degraded performance, increased data usage, and potential legal consequences. At LogRhythm, we specialize in detecting and responding to complex cybersecurity threats like botnets. Our SIEM solutions provide comprehensive threat detection and analytics to help organizations stay ahead of cybercriminals. Read the full article to learn more about the international effort to combat cybercrime and the critical role of cybersecurity measures: https://lnkd.in/gm6aVQNe

53

📰 VDI NEWS - EXCITING TECH NEWS OF THE WEEK 🔹 This past week has been full of significant developments in technology, both domestically and globally, particularly concerning cybersecurity issues in various countries. - On June 24, Quang Nam Province issued Official Dispatch No. 4639, warning about the APT group "Mustang Panda" launching cyber-attacks on Vietnam. Recently, many large enterprises in Vietnam have been targeted by cyber-attacks, causing operational disruptions and damaging their reputations. Therefore, it is crucial for organizations to enhance their network security capabilities and promptly detect potential threats. - Indonesia's national data center was recently attacked by a ransomware gang demanding a ransom of 8 million USD. However, the Indonesian government firmly refused to meet this demand. 🔹 This past week has also been an incredibly exciting and productive time for VDI Warriors. On June 20-21, 2024, VDI organized a training session on system management and operation for Viettel Networks. During the same period, VDI co-organized and participated in the Cisco CxO Symposium 2024. ️👇 There are also many other hot topics. Click on the image series below to read more details! #VDI #VDICareers #VDINews #Vdigital #DigitalTransformation #Chuyendoiso ----------------------------------------------- VDI - VIET DIGITAL INVESTMENT JOINT STOCK COMPANY ☎ Hotline: 024.3569.0436 📩 Email: [email protected] 🌐 Website: https://www.vdigital.vn/ 🏡 Address: 21st Floor, ICON4 Multipurpose Building, 243A De La Thanh Street, Lang Thuong Ward, Dong Da District, Hanoi

4

👉 What are the latest cybersecurity alerts, incidents, and news? 🚨 #CyberAlerts Microsoft Releases Emergency Update Fix for Windows Server 2019 Bug Source: Microsoft BLOODALCHEMY Malware Update Targets ASEAN Governments Source: ITOCHU Corporation RustDoor Malware Disguised in Courtroom Software in Supply Chain Attack Source: Rapid7 GitLab XSS Vulnerability Swiftly Addressed with Patch Source: Greg A. via GitLab Google Fixes Another Exploited Chrome Zero-Day Source: Google 💥 #CyberIncidents California School Administrators Warn of Data Breach Source: Association of California School Administrators Websites of Mecklenburg-Western Pomerania Hacked by DDoS Attacks Source: Welt Belgium's Dreamwall Hit by Cyberattack Disrupting Media Source: Pierre Bertinchamps via Telepro Singapore Companies Jumbo Group and Mustafa Hit by Cyber Attacks Source: Qing Ang Via The Straits Times Belgium Mobility Provider Mpact Hit by Cyberattack Source: Stijn Van de Sande via De Standaard 📢 #CyberNews US House Committee Approves Cyber Force Study for National Defense Source: U.S. Rep. Morgan Luttrell via Defense News Privacy Advocates Sound Alarm Over Facial Recognition at Sports Stadiums Source: Privacy International Political Consultant Indicted for Biden Deepfake Robocalls Source: US Federal Communications Commission (FCC) Family Offices Prime Targets for Cyber Hacks and Ransomware Source: Dentons The National Vulnerability Database Misses Over Half of Exploited Software Bugs Source: Patrick Garrity 👾🛹💙 via VulnCheck This Cyber Briefing is powered by https://911cyber.app  Get help from cybersecurity first responders today! Find the full stories at cybermaterial.com Or click here 👇 to read the summaries. https://lnkd.in/e-uiPGVW #cyberbriefing #informationsecurity #Microsoft #Malware #DDoS #Deepfake #Biden #Asia #Ransomware #Biometrics

5

>> Slaying the RE Dragon: Mastering Reverse Engineering A comprehensive workshop aimed at analyzing malware, building tools for vulnerability research with reverse engineering, or automating analysis. Schedule: https://lnkd.in/gKU4AGhD #reverseengineering #NullconHYD #security

21