Top News

• Hackers spoof Microsoft ADFS login pages to steal credentials

"A help desk phishing campaign targets an organization's Microsoft Active Directory Federation Services (ADFS) using spoofed login pages to steal credentials and bypass multi-factor authentication (MFA) protections."

Link

TLP¹ : Green

• North Korean APT Kimsuky Uses forceCopy Malware to Steal Browser-Stored Credentials

"The North Korea-linked nation-state hacking group known as Kimsuky has been observed conducting spear-phishing attacks to deliver an information stealer malware named forceCopy, according to new findings from the AhnLab Security Intelligence Center (ASEC)."

Link

TLP¹ : Green

• XE Group: From Credit Card Skimming to Exploiting Zero-Days

"This blog provides an in-depth analysis of XE Group’s recent operations based on a collaborative research effort with Solis Security."

Link

TLP¹ : Green

Cybersecurity State: Surveillance, Cyberwarfare, Cybercriminality and Hacktivism

• Spain arrests suspected hacker of US and Spanish military agencies

"The Spanish police have arrested a suspected hacker in Alicante for allegedly conducting 40 cyberattacks targeting critical public and private organizations, including the Guardia Civil, the Ministry of Defense, NATO, the US Army, and various universities."

Link

TLP¹ : Green

• Chinese cyberspies use new SSH backdoor in network device hacks

"A Chinese hacking group is hijacking the SSH daemon on network appliances by injecting malware into the process for persistent access and covert operations."

Link

TLP¹ : Green

Breaches: Data Breaches and Hacks

• Over 1 million Connecticut residents impacted by healthcare data breach

"Over a million people in Connecticut had their personal information compromised in a healthcare data breach."

Link

TLP¹ : Green

Vulnerabilities: Vulnerability Advisories, Zero-Days,Patches and Exploits

• New Microsoft script updates Windows media with bootkit malware fixes

"Microsoft has released a PowerShell script to help Windows users and admins update bootable media so it utilizes the new "Windows UEFI CA 2023" certificate before the mitigations of the BlackLotus UEFI bootkit are enforced later this year."

Link

TLP¹ : Green

• AMD fixes bug that lets hackers load malicious microcode patches

"AMD has released mitigation and firmware updates to address a high-severity vulnerability that can be exploited to load malicious CPU microcode on unpatched devices."

Link

TLP¹ : Green

Incident Response: Infrastructure, Training, SIEM and Incident Handling

• How hackers target your Active Directory with breached VPN passwords

"As the gateways to corporate networks, VPNs are an attractive target for attackers seeking access to Active Directory environments. And when VPN credentials become compromised — through something as seemingly innocuous as an employee reusing a password — your entire network's security could be at risk."

Link

TLP¹ : Green

Technical Articles: Forensics, Reverse Engineering, Malware, Phishing, Pentesting, Software Security and Cryptography

• Take my money: OCR crypto stealers in Google Play and App Store

"We found Android and iOS apps, some available in Google Play and the App Store, which were embedded with a malicious SDK/framework for stealing recovery phrases for crypto wallets."

Link

TLP¹ : Green

¹Traffic Light Protocol (TLP) [1] for information sharing:

• Red:Not for disclosure, restricted to participants only.
• Amber: Limited disclosure, restricted to participants organizations.
• Green: Limited disclosure, restricted to the community.

[1]https://www.first.org/tlp