Quotidien Hebdomadaire Mensuel

Hebdomadaire Shaarli

Tous les liens d'un semaine sur une page.

Semaine 35 (August 26, 2024)

Cybercriminals operating ransomware as a service from overseas continue to be responsible for most high-profile cybercrime attacks against the UK

The deployment of ransomware remains the greatest serious and organised cybercrime threat, the largest cybersecurity threat, and also poses a risk to the UK’s national security. Ransomware attacks can have a significant impact on victims due to financial, data, and service losses, which can lead to business closure, inaccessible public services, and compromised customer data. Threat actors are typically based in overseas jurisdictions where limited cooperation makes it challenging for UK law enforcement to disrupt their activities.

Germany's Sovereign Tech Fund Puts Over $750K Into FreeBSD Infrastructure Projects

The FreeBSD Foundation will organize and manage the projects that STF is funding, which mainly focuses on security.

Fake Palo Alto GlobalProtect used as lure to backdoor enterprises

Threat actors target Middle Eastern organizations with malware disguised as the legitimate Palo Alto GlobalProtect Tool that can steal data and execute remote PowerShell commands to infiltrate internal networks further.

Dutch cabinet bans phones in meetings over espionage fears

Devices are kept in vault during weekly gatherings, prime minister said.

Scam Sites at Scale: LLMs Fueling a GenAI Criminal Revolution

This article explores Netcraft’s research into the use of generative artificial intelligence (GenAI) to create text for fraudulent websites in 2024. Insight ...

State-backed attackers and commercial surveillance vendors repeatedly use the same exploits

We’re sharing an update on suspected state-backed attacker APT29 and the use of exploits identical to those used by Intellexa and NSO.

Beware the Unpatchable: Corona Mirai Botnet Spreads via Zero-Day
  • The Akamai Security Intelligence and Response Team (SIRT) has observed a botnet campaign that is abusing several previously exploited vulnerabilities, as well as a zero-day vulnerability discovered by the SIRT.

  • CVE-2024-7029 (discovered by Aline Eliovich) is a command injection vulnerability found in the brightness function of AVTECH closed-circuit television (CCTV) cameras that allows for remote code execution (RCE).

  • Once injected, the botnet spreads a Mirai variant with string names that reference the COVID-19 virus that has been seen since at least 2020.

  • We have included a list of indicators of compromise (IOCs) to assist in defense against this threat.

Hacktivist Response to Telegram CEO Arrest

Telegram is vital to hacktivist groups and their operations. They would have limited platforms to operate on without Telegram, they try X but are often shut-down and they would likely get drowned out if they tried to operate on underground forums.

HZ Rat backdoor for macOS harvests data from WeChat and DingTalk

Kaspersky experts discovered a macOS version of the HZ Rat backdoor, which collects user data from WeChat and DingTalk messengers.

Telegram CEO’s brother also wanted by French authorities

Arrest warrants for Pavel and Nikolai Durov were issued months earlier than previously known.

Unprecedented 3.15 Billion Packet Rate DDoS Attack Mitigated by Global Secure Layer

On August 25th 2024, Global Secure Layer mitigated the largest packet rate DDoS attack recorded against our platform

Threat Actors Retaliate After Durov’s Arrest

Threat Actors Retaliate After Durov’s Arrest Discover the latest security threats and database leaks, including unauthorized VPN access and email breaches, in the cyber underground world.Stay informed about emerging cyber threats, such as unauthorized access to databases and sensitive information leaks, affecting global companies and organizations.Learn about the latest cyber incidents, including DDoS attacks and malware threats targeting cryptocurrency wallets and financial institutions.

Après l’arrestation de Pavel Durov, une vague de cyberattaques cible la France

Ces dernières heures, plusieurs sites français disent avoir été visés par des attaques informatiques. A l’origine de ces actions : des petits groupes de hackeurs qui réclament la libération du patron de Telegram.

New 0-Day Attacks Linked to China’s ‘Volt Typhoon’

Malicious hackers are exploiting a zero-day vulnerability in Versa Director, a software product used by many Internet and IT service providers. Researchers believe the activity is linked to Volt Typhoon, a Chinese cyber espionage group focused on infiltrating critical U.S.…

Paris court explains why it's arrested Telegram founder, Pavel Durov

When Pavel Durov, founder and CEO of messaging app Telegram, was arrested on August 24, French authorities did not respond to requests for comment. The

Malicious Plugin

Pidgin is a universal chat client, allowing you to consolidate all your different messaging apps into a single tool.

17-Year-old Student Exposes Germany's 'Secret' Pirate Site Blocklist

A 17-year-old student has launched a dedicated portal to exposing Germany's 'secret' pirate site blocklist to the public.

WordPress Websites Used to Distribute ClearFake Trojan Malware

Learn about the ClearFake Trojan malware distributed via WordPress sites, its tactics, and how to safeguard your online experience.

Is Telegram really an encrypted messaging app? – A Few Thoughts on Cryptographic Engineering

This blog is reserved for more serious things, and ordinarily I wouldn't spend time on questions like the above. But much as I'd like to spend my time writing about exciting topics, sometimes the world requires a bit of what Brad Delong calls "Intellectual Garbage Pickup," namely: correcting wrong, or mostly-wrong ideas that spread unchecked…

Telegram says CEO has ‘nothing to hide’ after being arrested in France

The messaging app says “it is absurd to claim that a platform or its owner are responsible for abuse of that platform” after CEO Pavel Durov was arrested by French authorities.

The gift that keeps on giving: A new opportunistic Log4j campaign

In this post, we analyze a new opportunistic exploitation campaign based on the Log4j vulnerability.

BlackSuit Ransomware
  • In December 2023, we observed an intrusion that started with the execution of a Cobalt Strike beacon and ended in the deployment of BlackSuit ransomware.
  • The threat actor leveraged various tools, including Sharphound, Rubeus, SystemBC, Get-DataInfo.ps1, Cobalt Strike, and ADFind, along with built-in system tools.
  • Command and control traffic was proxied through CloudFlare to conceal their Cobalt Strike server.
  • Fifteen days after initial access, BlackSuit ransomware was deployed by copying files over SMB to admin shares and executing them through RDP sessions.
  • Three rules were added to our private ruleset related to this case.