Unit 42 disclosed a Broken Object Level Authorization (BOLA) in Grafana (CVE-2024-1313) that permits low-privileged or unaffiliated users to delete dashboard snapshots if they know or can guess snapshot keys. The report also describes weak key handling and sna…
JPCERT/CC held JSAC2024 on January 25 and 26, 2024. The purpose of this conference is to raise the knowledge and technical level of security analysts, and we aimed to bring them together in one place where they can share technical knowledge related to incident analysis and response. The conference w…
Morphisec Labs observed an expanded Mispadu (aka URSA) campaign that moved beyond LATAM into Europe and targeted multiple industries, delivering multi-stage payloads via phishing PDFs and URL shorteners that redirect to attachments hosted on Yandex.Mail. The i…
NetSPI discovered that Azure Site Recovery (ASR) creates a managed Automation Account whose visible Job outputs leak a cleartext management-scoped access token for a System-Assigned Managed Identity that has Contributor over the subscription. A low-privileged …
AhnLab ASEC reported Rhadamanthys distributed via a fake groupware installer hosted on an advertised malicious site; the malware uses an indirect syscall technique by mapping an unhooked ntdll.dll to evade user-mode hooks and detection. It injects into legitim…
Google commissioned NCC Group to perform a comprehensive security evaluation of the Privacy Sandbox Aggregation Service, which aggregates, decrypts, and noise-masks measurement data inside a trusted execution environment. NCC Group tested the service’s web-fac…
Netcraft details Darcula, a Chinese-language Phishing-as-a-Service platform that operates across 100+ countries with more than 20,000 phishing domains and updates its templates in place to evade detection. It delivers smishing campaigns via iMessage and RCS to…
Huntress SOC analysts investigated alerts on endpoints running MSSQL Server and Fortinet EMS, uncovering automated attack sequences attempting to deploy a ConnectWise ScreenConnect client that ultimately failed. The investigation revealed encoded commands, Pow…
In this article, we share our analysis of a recent version of the DinodasRAT implant for Linux, which may have been active since 2022.
Threat Actor: – Cyber_589 Victim: – Karabuk University Information: – 💻 The threat actor, Cyber_589, claims to have breached the student and teacher information system login panel of Karabuk University. – 💼 The leaked database allegedly contains sensitive information such as identification details,…
This video provides an in-depth overview of Governance, Risk, and Compliance (GRC), emphasizing its crucial role in cybersecurity and offering practical advice on its implementation. The presenter, an expert with extensive experience in the field, including roles at Grand Thorton in Australia and KP…
Summary : The article discusses how hackers are targeting high-risk individuals’ personal accounts as corporate accounts become more secure. It provides recommendations from cybersecurity experts to counter such attacks. Key Point : 🔒 Activate two-step verification: Use multifactor authentication to…
Threat Actor: 🔒 Victim: 🏢 Information: – The threat actor is offering unauthorized access to a prominent American architecture & design company. – The company has a revenue of $90+ million and employs over 400 people. – The company utilizes Sentinel EDR and offers access to Citrix, Fortinet VPN, RDP…
Summary : Cybercrooks are developing custom, malicious large language models after existing tools failed to meet their needs for advanced intrusion capabilities. Key Point : 🔒 Hackers are exploring ways to exploit guardrails put in place by AI-powered chatbots. 🤖 Demand for AI talent has surged amon…
Threat Actor: 🔥 Victim: 🎯 Information: – The threat actor is offering the source code of AvEleminator software for sale. – AvEleminator is a tool designed for malicious purposes, aiming to neutralize antivirus, endpoint protection platforms, and endpoint detection and response security software. – T…