Cybersecurity

New cyberattack campaign, DEEP#GOSU, uses PowerShell & VBScript to target Windows systems.

INTERPOL assisted in the operation where analysts identified Grandoreiro group members by analyzing and matching malware samples.

A sophisticated hacking campaign attributed to a Chinese Advanced Persistent Threat (APT) group known as 'Earth Krahang' has breached 70 organizations and targeted at least 116 across 45 countries.

CISA Adds One Known Exploited JetBrains Vulnerability, CVE-2024-27198, to Catalog

Researchers at G DATA have exposed a scheme dubbed "gitgub" on GitHub, where 17 repositories were delivering the information stealer, RisePro.

The ransomware actor 'ShadowSyndicate' was observed scanning for servers vulnerable to CVE-2024-23334, a directory traversal vulnerability in the aiohttp Python library.

Blocking R2 buckets could be difficult, since is widely used. IPFS could be blocked to restric p2p and block access to gateways (have a uptodate list of IPFS gateways could be challenging).

SIM swappers have adapted their attacks to steal a target's phone number by porting it into a new eSIM card, a digital SIM stored in a rewritable chip present on many recent smartphone models.

The flaw tracked as CVE-2024-21412 is a Windows Defender SmartScreen flaw that allows specially crafted downloaded files to bypass these security warnings.

IoC MD5 – a714b928bbc7cd480fed85e379966f95 (VT: 43/72) : AndarLoader (%SystemDirectory%\SVPNClientW.exe)

– 4f1b1124e34894398aa423200a8ab894 (VT: 43/72) : KeyLogger (%USERPROFILE%\documents\kerberos.tmp, %USERPROFILE%\kl.exe, %SystemDirectory%\dllhostsvc.exe)

– 2c69c4786ce663e58a3cc093c6d5b530 (VT: 0) : ModeLoader

– 29efd64dd3c7fe1e2b022b7ad73a1ba5 (VT: 64/73) : Mimikatz (%USERPROFILE%\mimi.exe)

C&C 주소 – privacy.hopto[.]org:443 : AndarLoader – privatemake.bounceme[.]net:443 : AndarLoader – 84.38.129[.]21 : MeshAgent – hxxp://www.ipservice.kro[.]kr/index.php : ModeLoader – hxxp://www.ipservice.kro[.]kr/view.php : ModeLoader – hxxp://www.ipservice.kro[.]kr/modeRead.php : ModeLoader – hxxp://panda.ourhome.o-r[.]kr/view.php : ModeLoader – hxxp://panda.ourhome.o-r[.]kr/modeRead.php : ModeLoader – hxxp://panda.ourhome.o-r[.]kr/modeView.php : ModeLoader – hxxp://www.mssrv.kro[.]kr/view.php : ModeLoader – hxxp://www.mssrv.kro[.]kr/modeView.php : ModeLoader – hxxp://www.mssrv.kro[.]kr/modeRead.php : ModeLoader – hxxp://www.mssrv.kro[.]kr/modeWrite.php : ModeLoader