Quotidien Shaarli

Amazon has launched AWS Security Incident Response, a service to help triage and respond to cybersecurity threats.

A researcher has discovered a data broker had stored 644,869 PDF files in a publicly accessible cloud storage container.

On Friday, the United Nations Agency for Digital Technologies said it is partnering with the International Telecommunication Union (ITU) and International Cable Protection Committee (ICPC) to create the International Advisory Body for Submarine Cable Resilience.

• Initial access was via a resume lure as part of a TA4557/FIN6 campaign.
• The threat actor abused LOLbins like ie4uinit.exe and msxsl.exe to run the more_eggs malware.
• Cobalt Strike and python-based C2 Pyramid were employed by the threat actor for post-exploitation activity.
• The threat actor abused CVE-2023-27532 to exploit a Veeam server and facilitate lateral movement and privilege escalation activities.
• The threat actor installed Cloudflared to assist in tunneling RDP traffic.
• This case was first published as a Private Threat Brief for customers in April of 2024.
• Eight new rules were created from this report and added to our Private Detection Ruleset.