Mert SARICA’s Post

Russian script kiddie using publicly available malware tools and exploits targeting weak credentials and configurations has amassed a DDoS botnet capable of disruption on a global scale. https://bit.ly/49aBwwc

NEW: APT29, a Russia-linked threat group, is repurposing legitimate red team tools for cyberespionage: » Targeting: Governments, researchers, think tanks. » Scale: 200 victims hit in just a single day. » Method: Malicious RDP files that bypass malware defenses. More at the link…

#NEW #SHARE Hackers use PoC exploits in #attacks 22 minutes after release. Threat actors are quick to weaponize available proof-of-concept (PoC) #exploits in actual attacks, sometimes as quickly as 22 minutes after exploits are made publicly available. That is according to #Cloudflare's Application Security report for 2024, which covers activity between May 2023 and March 2024 and highlights emerging threat trends. Cloudflare, which currently processes an average of 57 million HTTP requests per second, continues to see heightened scanning activity for disclosed #CVEs, followed by command injections and attempts to weaponize available PoCs. https://lnkd.in/dba-MWkP

As my colleague Vasu Jakkal often says, security is a team sport, and an important pillar of acting as a team is ensuring everyone is aware of novel attacks or patterns, including Microsoft Threat Intelligence’s latest research on Iranian threat actor Peach Sandstorm.      While Peach Sandstorm is particularly known for its password spraying hacks, the group continues to evolve tactics with a new multi-stage backdoor, which we have dubbed Tickler. We have observed this group implementing the malware against targets in satellite, communications equipment, oil and gas, and federal and state sectors in the United States and the United Arab Emirates, running commands and gathering data from infected devices.      As we continue to see threat actor groups such as Peach Sandstorm evolve, we remain steadfast in our goal of sharing this information with the broader security community to ensure every organization is equipped with the latest information to keep each other safe and secure.    https://lnkd.in/gvEavv_s 

NEW: APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP! APT29, a Russia-linked threat group, is repurposing legitimate red team tools for cyberespionage: » Targeting: Governments, researchers, think tanks. » Scale: 200 victims hit in just a single day. » Method: Malicious RDP files that bypass malware defenses. More at the link… https://lnkd.in/gwXDiv7z

Salt Typhoon have been seen exploiting vulnerabilities in external-facing services and remote management utilities. They have been found leveraging misconfigured QConvergeConsole installations to deploy malware like Cobalt Strike and custom backdoors such as HemiGate. In one sequence, hackers exploit vulnerable Microsoft Exchange servers to implant web shells that facilitate further intrusions.

A Windows print spooler bug, patched by Microsoft in 2022, has now been revealed to have been actively exploited by the Russian APT group Sofacy since at least 2020. The group now called Forest Blizzard by Microsoft is better known by the CrowdStrike name Fancy Bear. Either way it refers to a hacker team within and allied to the Russian Foreign Intelligence apparatus, GRU Unit 26165. The GRU’s tool, called Goose Egg by researchers after the sometimes-used name of one of its DLL files, alters the Windows registry, causing calls to the Windows print spooler to instead invoke the code hidden elsewhere on their computer. More details in the story Dave Schroeder 🇺🇸 shared below, and also in this second link that I am sharing here, both by @Dan Goodin at Ars Technica. https://lnkd.in/epfWge6T

Don't let the hassle of extra verification steps compromise your company's safety! We show you how you can see what devices on your network have or do not have MFA 🍿Watch Here : https://lnkd.in/eQfAcXEG #CyberSecurity #MFA #DeviceManagement

The Rising Threat: How Hackers Exploit Legacy Systems in SMBs SMBs relying on outdated IT systems are becoming prime targets for cybercriminals. Hackers see legacy systems as easy entry points, exploiting outdated software, a lack of security patches, and weak defenses to launch devastating attacks. For SMBs, the consequences can be severe, ranging from costly data breaches and financial losses to operational downtime and reputational damage. But it doesn’t have to be this way. By conducting IT risk assessments, upgrading legacy systems, and implementing modern cybersecurity measures, SMBs can protect themselves from these growing threats. Want to learn how to protect your business before it’s too late? Dive into the full blog to discover actionable strategies and how Tam Corp can help secure your company’s future.

Attacks will continue so get security from Radware provided through GO2UNO.