Oleh Khomiak

DATA BREACH ALERT - Alleged sale of clients database from the JSC NIKORA The threat actor is offering to sell a database of clients from the Georgian company, JSC Nikora, containing 23,106 unique lines of data. The data is from May 2024 and includes information such as first name, last name, phone number, ID number, email, and date of birth. - #data_breach #data_leak #infosec #dark_web #DataBreach  #DataLeak  #Services  #CyberThreat  #CyberAttack

3

#OSCE3. Congratulations again to Petko Melin, our Red Team Lead, with his OffSec Certified Expert 3 (OSCE3) certification. The OSCE3 demonstrates expertise in advanced penetration testing, exploit development, and source code review. The certification proves a mastery of complex scenarios involving multi-layered network environments and custom exploit creation, often simulating real-world, high-stakes cyber attack situations such as those carried out by sophisticated cybercrime groups or nation-state actors. This certification is considered a testament to exceptional mastery in the offensive security domain. Earning the OSCE3 underscores Petko’s elite capabilities as an offensive security professional. The certification not only validates his advanced knowledge in the domain, but also solidifies practical skills in applying offensive security tactics. The OSCE3 requires both the OSWE, OSEP, and OSED certifications, which really cements Petko's expertise in the field. Very impressive and a strong achievement, Petko! itm8 / www.itm8.com #OSCE3 #OffSec #Certification #CyberSecurity #RedTeaming

225

18 Comments

Weekly Vulnerability Roundup (Week Commencing: 7th October 2024) We’re back again with the Weekly Vulnerability Roundup. This report covers any vulnerabilities which have had an EPSS score change of at least 10% and any new additions to the CISA Known Exploited Vulnerabilities catalogue. A new addition to this week’s report is that we’ve added the original EPSS score to add more context to the deltas. Want to receive this report and future reports right to your inbox every Friday? Enter your email address here to sign up: https://lnkd.in/gyU9QYgx See the summary of affected technologies below and read the FULL report on our blog here: https://lnkd.in/gfa5qm3y Total CVEs:  31 References: EPSS by FIRST: https://www.first.org/ CISA KEV: https://lnkd.in/gRGpREQS Penetration Testing and SOC: https://lnkd.in/gMQXZrTs

12

⚠ CYBERSECURITY HIGHLIGHTS FOR THE WEEK ⚠ Threat Actor in Focus - Emerging Threat: Void Manticore’s Destructive Cyber Campaigns Targeting Israeli Organizations Threat Actors: Void Manticore Attack Type: Public-facing web server Objective: Espionage Target Technology: Windows Target Geographies: Israel Target Industries: Government & Critical Infrastructure Business Impact: Data Loss, Data exfiltration Summary: Void Manticore (aka Storm-842) is an Iranian state-sponsored threat actor known for conducting destructive attacks on Israeli organizations and leaking information through the online persona ‘Karma’ (sometimes written as KarMa). These operations often target sectors such as government, finance, and critical infrastructure, aligning with Iran’s broader offensive strategy. The group employs straightforward and efficient techniques aimed at causing rapid and significant damage. Their operations extend beyond Israel, with attacks also reported in Albania, where they use the persona ‘Homeland Justice’ to leak stolen data. In Israel, Void Manticore is notable for utilizing a custom wiper named BiBi, after Israeli Prime Minister Benjamin Netanyahu. One common method Void Manticore uses to gain access to target systems is through internet-facing web servers like CVE-2019-0604, where they deploy web shells like the custom “Karma Shell.” This tool, disguised as an error page, can list directories, create processes, upload files, and manage services, using simple encryption methods like base64 and one-byte XOR for obfuscation. They have also been observed uploading a custom executable, do.exe, which checks for Domain Admin credentials. Upon successful authentication, it installs another web shell, reGeorge, indicating valid credentials. This suggests the initial access might be facilitated by another entity, possibly Scarred Manticore, a more sophisticated threat actor. Continue reading here ➡ https://lnkd.in/gvR_-7wt #CyberSecurity #Cyfirma #ETLM #externalthreatlandscape #ThreatIntelligence #CyberIntelligence #CYFIRMAResearch #malware #ransomware #threatactor #cybersecurityawareness Kumar Ritesh Dr. Saurabh Lal, P.D. Michael Henry Anna Koh Amit Thakur Harry Lee Glaiza Pardilla Harsha Vardhan Sam Parmar Rahul Raghav Yusuke Tateno Chiaki Izena（伊是名千晶）Greg Baylis David Plummer Rakesh R V Nicko Navarrete Ruri A. Hyungchan Mike Cho Montai Saiaroon Huy. Nguyen Tuong Vinh Dudley Swanepoel Mouli Saha Greg Baylis Vincent Cheng Julius S.

13

This week, cybersecurity experts from CERT Polska (CSIRT NASK) and CSIRT MON uncovered a significant malware campaign targeting governmental institutions in Poland. The attack, characterized by a sophisticated modus operandi, bears similarities to previous assaults on Ukrainian entities and is tentatively linked to the APT28 activity set, associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). The attackers employed cunning tactics, leveraging social engineering through compelling email content to entice recipients into clicking malicious links.   The technical analysis of the campaign reveals a multi-step infiltration strategy. The attackers initially distributed emails designed to pique recipients' curiosity, enticing them to click on a provided link. This link, housed within the run.mocky.io domain, was utilized as a redirect to another website, webhook.site, enabling the logging of queries and configuring responses. By utilizing widely-used, free services, the attackers aimed to evade detection, a tactic observed across various APT groups. Ultimately, victims were directed to download a seemingly innocuous ZIP archive purportedly containing photos but harboring malicious components, including a fake Windows calculator executable, a hidden BAT script, and a forged WindowsCodecs.dll file.   Upon execution, the malware deployed a technique known as DLL Side-Loading to run the included BAT script, which in turn initiated a series of actions culminating in the collection and transmission of victim data to a command and control (C2) server. The attackers employed a sophisticated loop mechanism, utilizing Microsoft Edge to download and execute additional scripts from webhook.site, orchestrating a comprehensive infiltration and data exfiltration process. The attack methodology closely mirrors that of previously documented malware, exemplifying the adversaries' adeptness at adapting and refining their tactics.   In response to this threat, CERT Polska issues recommendations to network administrators, urging vigilance and proactive measures to mitigate risk. Recommendations include scrutinizing connections to domains webhook.site and run.mocky.io, considering blocking these domains, and implementing email filtering for links originating from these services. Additionally, individuals are advised to disconnect potentially compromised devices from the network and promptly notify the appropriate CSIRT team in case of suspected malware infection, underscoring the importance of swift response and collaboration in combating sophisticated cyber threats.    #infosec #cyber #cybersec #cybersecurity #infosecurity     Source: https://lnkd.in/eCPUiZvZ  

2

📊 Sharpen your OSINT knowledge with the SANS OSINT Poster! Packed with everything from IP geolocation tools to advanced search queries, this resource will help you uncover the data you need for thorough investigations. 🕵️‍♀️ Download your copy here: https://lnkd.in/e45ZAg3c #OSINT #CyberIntel

11

1 Comment

When performing regular vulnerability scanning, vulnerabilities need immediate attention. How can you organize the information so fast?🤔 Krasimir Kotsev CEO of Kikimora.io delivered impressive insights on turning Vulnerbilty Management into meaningful context-based Vulnerability Intelligence at Infosecurity Europe.💡 💥Learn more about vulnerability management: https://lnkd.in/eGziwfSh #vulnerabiltymanagment #cybersecurity #infosec2024

28

Hacktivist group has been actively targeting Russian organizations since 2023, leveraging advanced tactics and tools. Here are some key points from their recent activities: Exploiting CVE-2023-38831: The group uses the CVE-2023-38831 vulnerability in WinRAR to execute arbitrary code via specially crafted archives12. This method enhances the effectiveness of their payload delivery and disguise. https://lnkd.in/gQUQhQFy Phishing Campaigns: They distribute malicious payloads through phishing emails containing business documents with double extensions (e.g., .pdf.exe)12. https://lnkd.in/gQUQhQFy Custom Malware: Their toolkit includes custom-made malware like PhantomDL and PhantomCore. PhantomDL is a Go-based backdoor for delivering additional payloads and uploading files to a command-and-control (C2) server, while PhantomCore (aka PhantomRAT) is a remote access trojan with similar capabilities12. Ransomware: Head Mare uses LockBit for Windows and Babuk for Linux (ESXi) to encrypt victims’ devices and demand ransom for data decryption12. Deceptive Tactics: They create scheduled tasks and registry values named MicrosoftUpdateCore to disguise their activities as legitimate Microsoft software tasks. They also disguise ransomware samples as legitimate applications like OneDrive and VLC12. Open-Source Tools: The group employs various publicly available tools such as Sliver, rsockstun, ngrok, and Mimikatz for discovery, lateral movement, and credential harvesting12. https://lnkd.in/gQUQhQFy Presence on X: They maintain a presence on X (formerly Twitter), where they leak sensitive information and internal documentation from their victims12. Head Mare’s approach is notable for its use of up-to-date vulnerabilities and custom malware, setting it apart from other hacktivist groups in the context of the Russo-Ukrainian conflict12. If you have any specific questions or need further details, feel free to ask! #CyberSecurity #ThreatIntelligence #LinkedInTips #SocialMediaStrategy #AudienceEngagement #SecastraSecurity #StaySafeOnline #ITSecurity #CyberAwareness

1

FREE Webinar - Understand Your Attackers: The Role of Sandboxing in Threat Intelligence 11 July | 1 pm BST Join us and VMRay and learn how to integrate sandboxing technologies into your threat intelligence workflows, enabling a transition from reactive response measures to proactive defense strategies! Register here: https://ow.ly/pH5T50StTVp

80

🚨 Threat Campaign Alert - Polish Government Targeted by APT28-Linked Malware Campaign 🚨 Summary: Polish government institutions are being targeted in a wide-ranging malware campaign linked to APT28, a group associated with the General Staff of the Armed Forces of the Russian Federation (GRU). The campaign employs social engineering and DLL side-loading techniques to compromise devices and exfiltrate information. Threat Actor/Threat Group: APT28 Malware: None specified Targeted Countries: Poland Targeted Industries: Government Targeted Applications or CVEs: None specified Impact: Device compromise, data exfiltration. IOC: URL's hxxps[://]run[.]mocky[.]io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=2d07e34c-3dd3-45e8-865c-3888a65ab885 hxxps[://]webhook[.]site/2d07e34c-3dd3-45e8-865c-3888a65ab885 hxxps[://]webhook[.]site/4ba464d9-0675-4a7a-9966-8f84e93290ba hxxps[://]webhook[.]site/577b82c3-7249-44e9-9353-5eab106fead6 hxxps[://]run[.]mocky[.]io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=127df518-52be-46c5-bbb2-0479f4b9693b hxxps[://]webhook[.]site/127df518-52be-46c5-bbb2-0479f4b9693b hxxps[://]webhook[.]site/0ef0dcf7-f258-4d02-b274-cbf62a2000cf hxxps[://]run[.]mocky[.]io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=c1112bb3-0e6e-4ba4-abe7-fb31388b47ad hxxps[://]webhook[.]site/c1112bb3-0e6e-4ba4-abe7-fb31388b47ad hxxps[://]webhook[.]site/3f396db1-2016-4b69-9ec3-ffc417d5f3aa hxxps[://]run[.]mocky[.]io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=efb79108-a2b5-4cba-844d-6352bb8fad8c hxxps[://]webhook[.]site/efb79108-a2b5-4cba-844d-6352bb8fad8c hxxps[://]webhook[.]site/9c87649c-220d-425d-8331-ffc8d9b94a38 hxxps[://]webhook[.]site/66ea3bbc-29dc-4ece-b804-71c6ec7b77b6 hxxps[://]webhook[.]site/f97bcee0-0d91-4503-a30c-027f1b34820f SHA-256 Hash 7c6689f591ce2ccd6713df62d5135820f94bdbf2e035ab70e6b3c6746865a898, c968f9dd1f16a435901d2b93a028a0ae2508e943c8f480935a529826deb3dbeb, 34cabc0ff2f216830ffe217e8f8d0fa4b7d3a167576745aba48b7e62f546207b, dfd1f3229f903887f2474f361a26273dc63a6221883e86c5eea2dec9521dc081, 85f10d3df079b4db3a83ae3c4620c58a8362df2be449f8ce830d087ab41c7a52, 96766dfbf6c661ee3e9f750696803824a04e58402c66f208835a7acebfab1cfc, b3e60909036c4110eb7e3d8c0b1db5be5c164fcc32056885e4f1afe561341afd, 750948489ed5b92750dc254c47b02eb595c6ffcefded6f9d14c3482a96a6e793 MITRE TTPs: T1085:Rundll32, T1059:Command and Scripting Interpreter, T1218.011:Security Support Provider, T1071:Standard Application Layer Protocol Reference: This writing is based on Research Advisory Report published by ‘CERT-PL' Team. --------------------------------------------------------------------------------------- 🚀Join us on our mission to secure the digital world and make cyber defense affordable to everyone! 🌐 Follow "CyberXTron Technologies" for the timely, relevant and actionable cyber threat insights.  #Malware #APT28 #Poland #Government #DLLSideLoading #SocialEngineering #SecurityAlert #cyberXTron #uncovertheunknown🛡️🔒

1

New Post: #CISA and @FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory #Traversal Vulnerabilities - https://lnkd.in/dAir6seU CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities 05/02/2024 02:00 PM EDT Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in our Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations. CISA and the FBI urge software manufacturer executives to require their organizations to conduct formal testing to determine their products’ susceptibility to directory traversal vulnerabilities. For more information on recommended principles and best practices to achieve this goal, visit CISA’s Secure by Design page. To catch up on the publications in this series, visit Secure by Design Alerts. Robert Williams#News247WorldPress

1

WATCH: Silverfort's Dor Segal give an overview on bypassing modern authentication methods to SSO from #RSAC2024. READ our story on Segal's session from #RSA here: https://bit.ly/4bM38YP #cybersecurity #infosec #ITsecurity

2

When it comes to Cyber Risk, did you know Kroll is the world’s #1 incident response provider? Follow our Kroll Cyber Risk showcase page for: 💡 Insights 💼 Case studies 📈 Latest trends 🗓 Upcoming events ⚠ High-severity vulnerabilities ✅ Solutions and much more!

48

Webinar: Sysmon for Linux - Elevate Your Threat Hunting with Sysmon and Gravwell Join us on the 18th September at 13:30 EST for this free, hands-on workshop where you will learn: -> Key features of Sysmon for Linux and how to set it up. -> Advanced threat hunting and detection techniques. -> How to leverage Gravwell for threat analytics and event correlation. -> Practical examples and live demonstrations. Register today to save your spot. https://hubs.la/Q02PQ1bM0

10

Each week our cyber threat intelligence team reports on the latest trends they observe from the trenches. This week we covered: ☣ CVE-2024-3400 PAN-OS Vulnerability Update 🐛 Malware Spotlight: GAMARUE 🖥 PuTTY SSH Client vulnerability ⚙ Ransomware Roundup Watch the full briefing here: http://ms.spr.ly/6040YHMdi

13