Quotidien Hebdomadaire Mensuel

Quotidien Shaarli

Tous les liens d'un jour sur une page.

February 27, 2023

Man stole nearly $18K in electricity in crypto mining operation

Nadeam Nahas, 39, of Norwell, MA is facing charges of allegedly running a secret cryptocurrency mining operation out of a crawlspace at a middle school.

Hard-to-spot Mac crypto-mining threat, XMRig, hits Pirate Bay

Jamf Threat Labs has spotted a family of Mac malware, XMRig, that spreads through pirated versions of Final Cut Pro, Photoshop and Logic Pro X.

PureCrypter targets government entities through Discord - Blog | Menlo Security

Menlo Labs has uncovered an unknown threat actor leveraging an evasive threat campaign distributed via Discord featuring the PureCrypter downloader and targeting government entities.

Stanford University discloses data breach affecting PhD applicants

Stanford University disclosed a data breach after files containing Economics Ph.D. program admission information were downloaded from its website between December 2022 and January 2023.

Technical Advisory: Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966

Numerous threat actors were detected abusing a critical CVE-2022-47966 RCE vulnerability affecting products from ManageEngine. Read our advisory.

TA569: SocGholish and Beyond
  • TA569 leverages many types of injections, traffic distribution systems (TDS), and payloads including, but not limited to, SocGholish.
  • In addition to serving as an initial access broker, these additional injects imply TA569 may be running a pay-per-install (PPI) service
  • TA569 may remove injections from compromised websites only to later re-add them to the same websites.
  • There are multiple opportunities for defense against TA569: educating users about the activity, using Proofpoint’s Emerging Threats ruleset to block the payload domains, and blocking .js files from executing in anything but a text editor.
EXFILTRATOR-22 - An Emerging Post-Exploitation Framework

Executive Summary The CYFIRMA Research team has provided a preliminary analysis of a new post- exploitation framework called EXFILTRATOR-22 a.k.a....

Cryptomonnaie: arrestation de deux Français suspectés d’avoir piraté la plateforme Platypus

Les deux hommes interpellés mercredi en région parisienne, des frères de 18 et 20 ans, ont causé pour 9,5 millions de dollars de préjudice à la société américaine de finance décentralisée.

OneNote Embedded file abuse

In recent weeks OneNote has gotten a lot of media attention as threat actors are abusing the embedded files feature in OneNote in their phishing campaigns.
I first observed this OneNote abuse in the media via Didier’s post. This was later also mentioned in Xavier’s ISC diary and on the podcast. Later, in the beginning of February, the hacker news covered this as well.

When Low-Tech Hacks Cause High-Impact Breaches

Web hosting giant GoDaddy made headlines this month when it disclosed that a multi-year breach allowed intruders to steal company source code, siphon customer and employee login credentials, and foist malware on customer websites. Media coverage understandably focused on GoDaddy's…