McAfee

NOVEMBER 29, 2021

Using this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network. Threat Intelligence for Exploitation IOCS with MVISION Insights. Exploitation IOCs and Detections in MVISION Insights.

Malware 68

Malware 68

Malwarebytes

APRIL 9, 2024

This blog post aims to share the tactics, techniques and procedures (TTPs) as well as indicators of compromise (IOCs) so defenders can take action. Indicators of Compromise Cloaking domains: kunalicon[.]com We have reported this campaign to Google but no action has been taken yet. dll (Nitrogen). org puuty[.]org

System Administration 106

System Administration DNS Engineering Social Engineering 106

SecureList

FEBRUARY 15, 2023

It is common for security and threat researches to publicly disclose the results of their investigations (adversary indicators, tactics, techniques, and procedures) in the form of reports, presentations, blog articles, tweets, and other types of content. It is capable of generating human-like text in a wide range of styles and formats.

Malware 138

Malware Encryption Phishing Internet 138

Security Boulevard

MAY 9, 2023

By moving away from the traditional indicator of compromise (IOC) mindset, you’ll be able to uncover hidden threats that may have been flying under the radar. In this blog, we’ll […] The post Art of the Hunt: Building a Threat Hunting Hypothesis List appeared first on Cyborg Security.

62

62

McAfee

NOVEMBER 25, 2021

In this blog I want to show you how you can operationalize the data linked to this alert in MVISION Insights together with your investigation and protection capabilities to better protect your organization against this threat. MVISION Insights Global prevalence statistics for this campaign on Nov 19, 2021. It includes Ransomware behaviors.

Encryption 61

Encryption Risk Ransomware Hacking 61

Heimadal Security

AUGUST 27, 2021

Following the cyberattacks that involved the Hive ransomware, the FBI (Federal Bureau of Investigation) has revealed some technical data and IoC (Indicators of Compromise) related to this topic. The post Hive Ransomware: Technical Info Released by the FBI appeared first on Heimdal Security Blog.

Ransomware 97

Ransomware Encryption Malware Phishing 97

Security Affairs

NOVEMBER 1, 2023

F5 also released indicators-of-compromise (IoCs) to help defenders to identify potential compromises. “F5 Praetorian Security updated its blog with additional technical info after the Project Discovery team released the proof of concept on Github. states the advisory.

Authentication 107

Authentication Hacking Risk Cybersecurity 107

eSecurity Planet

OCTOBER 18, 2022

“The covert self-developed tool and the associated C2 commands seem to be the work of a sophisticated, unknown threat actor who has targeted approximately 100 victims,” SafeBreach director of security research Tomer Bar wrote in a blog post today detailing the findings. Phishing on LinkedIn. A Critical Mistake.

Phishing 124

Phishing Encryption Accountability Software 124

Security Affairs

NOVEMBER 1, 2023

F5 also released indicators-of-compromise (IoCs) to help defenders to identify potential compromises. “For indicators of compromise for CVE-2023-46748, please refer to K000137365: BIG-IP Configuration utility authenticated SQL injection vulnerability CVE-2023-46748.” ” states the advisory.

Authentication 111

Authentication Hacking Cybersecurity Information Security 111

Security Affairs

MARCH 6, 2021

“Formerly known as Test-Hafnium, this script automates all four of the commands found in the Hafnium blog post.” “Microsoft has released an updated script that scans Exchange log files for indicators of compromise (IOCs) associated with the vulnerabilities disclosed on March 2, 2021.”

InfoSec 141

InfoSec Hacking Cybersecurity Accountability 141

CyberSecurity Insiders

OCTOBER 11, 2021

Stories from the SOC is a blog series that describes recent real-world security incident investigations conducted and reported by the AT&T SOC analyst team for AT&T Managed Threat Detection and Response customers. Indicators of Compromise (IOC). Upon looking into event logs of the alarm, another IOC < forum[.]comeback[.]pw

Threat Detection 122

Threat Detection Cybersecurity Malware Cyber threats 122

Security Affairs

MAY 22, 2022

North Korea-linked group Lazarus is exploiting the Log4J RCE vulnerability ( CVE-2021-44228 ) to compromise VMware Horizon servers. ASEC researchers published Indicators of Compromise (IoCs) for these attacks. ” reads the analysis published by the experts. To nominate, please visit:? Pierluigi Paganini.

Cryptocurrency 137

Cryptocurrency Internet Internet Malware 137

Security Affairs

APRIL 25, 2022

“The Federal Bureau of Investigation (FBI) has released a Flash report detailing indicators of compromise (IOCs) associated with attacks involving BlackCat/ALPHV, a Ransomware-as-a-Service that has compromised at least 60 entities worldwide.” ” reads the flash advisory. Implement network segmentation.

Ransomware 104

Ransomware Antivirus Passwords Malware 104

Security Affairs

MAY 22, 2022

Interestingly both repositories belong to the same profile, indicating the possibility that Threat Actor (TA) might be hosting a malware campaign targeting Infosec Community.” ” concludes the expert that also shared recommendations along with indicators of compromise (IoCs). To nominate, please visit:?

InfoSec 140

InfoSec Malware Cybercrime Information Security 140

Security Affairs

JUNE 7, 2022

exe -s <IP address of compromised Domain Controller>SYSVOL<random string>.dll The first technique leverages the batch script d.bat which was deployed locally on compromised hosts and executed a series of PowerShell commands. exe: regsvr32.exe Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

Ransomware 141

Ransomware Backups Malware Firewall 141

Security Affairs

MAY 4, 2022

The attacks were monitored by cybersecurity firm CrowdStrike, who discovered that the Docker Engine honeypots deployed between February 27 and March 1 were compromised and used in the DDoS attacks. CrowdStrike Intelligence assesses these actors almost certainly compromised the honeypots to support pro-Ukrainian DDoS attacks.

DDOS 109

DDOS Media Government Engineering 109

Security Affairs

FEBRUARY 26, 2021

Microsoft, which was hit by the attack, published continuous updates on its investigation, and now released the source code of CodeQL queries , which were used by its experts to identify indicators of compromise (IoCs) associated with Solorigate. ” reads the blog post published by Microsoft. or in functionality.”

Hacking 75

Hacking Engineering Malware Government 75

Jane Frankland

JANUARY 9, 2024

In this blog, I’m going to explore the pros and cons of using an MDR provider and whether it’s better choosing a boutique provider over that of a traditional big brand. TDR detects known threats and identifies anomalous patterns indicative of emerging risks. This is where Managed Detection & Response (MDR) providers come in.

Threat Detection 147

Threat Detection Technology Marketing Artificial Intelligence 147

Security Affairs

OCTOBER 24, 2023

The indicators of compromise for this vulnerability are the same released for the VMSA-2023-0001. While we haven’t reversed the Cisco 0-day just yet, we do have the deep-dive and IOCs for CVE-2023-34051 affecting #VMware Aria Operations for Logs. .… See blog above for more details.

Authentication 113

Authentication Hacking Cybersecurity Information Security 113

Security Boulevard

FEBRUARY 20, 2022

Dear blog readers, Did you already pull my public and free STIX STIX2 TAXII threat intelligence feed using your and your organization's Lifetime API Key ? Here's your Lifetime API Key for you and your organization - f8aa0cca-a0ac-4eff-9c03-1c86ad7aee93. Portal: [link]. API: [link]. API Documentation: [link]. API Client: [link]. Cortex XSOAR.

Firewall 98

Firewall Authentication 98

Security Affairs

JUNE 3, 2022

” concludes the report published by Symantec that also includes Indicators of Compromise (IoCs). .” ” concludes the report published by Symantec that also includes Indicators of Compromise (IoCs). Then the downloader connects to the Tor network to download the components of the Clipminer.

Cryptocurrency 136

Cryptocurrency Malware Hacking Software 136

NetSpi Technical

MARCH 14, 2024

We’ve linked out on the above list to some blogs that show how to use those services to attack Managed Identities. We will use this post to expand on Rogier’s blog and show a new MicroBurst function that automates this attack. As Azure penetration testers, we often run into overly permissioned User-Assigned Managed Identities.

Penetration Testing 133

Penetration Testing Accountability Authentication Engineering 133

Security Affairs

APRIL 23, 2022

The alert published by the Ukraine CERT-UA includes Indicators of Compromise (IoCs) for this campaign and recommendations. Ukraine CERT-UA warns of phishing attacks on state organizations of Ukraine using the topic “Azovstal” and Cobalt Strike Beacon. To nominate, please visit:? Pierluigi Paganini.

Phishing 87

Phishing Cybercrime Ransomware Encryption 87

Malwarebytes

MARCH 22, 2023

Threat actors often compete for the same resources, and this couldn't be further from the truth when it comes to website compromises. Recently, while reading a blog post from security vendor Akamai, we spotted a similar situation. that the skimmer was using WebSockets and is the same one as described in Akamai's blog.

67

67

Security Affairs

MAY 4, 2023

The threat actors allegedly obtained access to Ukraine’s public networks by using compromised VPN credentials. The CERT also provided Indicators of Compromise (IoCs) for these attacks. CERT-UA is warning of destructive cyberattacks conducted by the Russia-linked Sandworm APT group against the Ukraine public sector.

VPN 86

VPN Education Accountability Cyber Attacks 86

Security Affairs

MAY 9, 2023

Once compromised a device, the AndoryuBot downloads a script from the URL http[:]//163[.]123[.]142[.]146 “Once a target device is compromised, AndoryuBot quickly spreads and begins communicating with its C2 server via the SOCKS protocol. Once compromised a device, the AndoryuBot downloads a script from the URL http[:]//163[.]123[.]142[.]146

DDOS 96

DDOS Wireless Architecture Advertising 96

Security Affairs

APRIL 5, 2022

The Ukraine CERT-UA published indicators of compromise (IoCs) for this campaign. Ukraine CERT-UA spotted a spear-phishing campaign conducted by Russia-linked Armageddon APT targeting local state organizations. The phishing messages have been sent from “vadim_melnik88@i[.]ua,” To nominate, please visit:? Pierluigi Paganini.

Phishing 113

Phishing Government Hacking Malware 113

Security Affairs

MAY 8, 2023

Threat actors are using emails sent from compromised accounts with the subject “bill/payment” with an attachment in the form of a ZIP archive. Threat actors are using emails sent from compromised accounts with the subject “bill/payment” with an attachment in the form of a ZIP archive. We are in the final!

Malware 92

Malware Phishing VPN Accountability 92

Security Affairs

APRIL 15, 2022

The Indicators of Compromise (IoCs) added to the report was provided by the U.S. The Conti ransomware gang has claimed responsibility for the recent attack against Nordex, one of the largest manufacturers of wind turbines. The company this week announced that it is working to fully recover its operations after the attack.

Hacking 88

Hacking Ransomware Manufacturing Cybersecurity 88

Security Affairs

MAY 24, 2023

“The AhRat research serves as a good example of how an initially legitimate application can transform into a malicious one, even after many months, spying on its users and compromising their privacy. ” concludes ESET that also shared Indicators of Compromise (IoC). We are in the final!

Malware 91

Malware Hacking Cybersecurity Mobile 91

Security Affairs

FEBRUARY 10, 2022

The full report that includes Indicators of Compromise (IOCs) is available here: [link]. This blog details the use of regsvr32.exe This blog details the use of regsvr32.exe The Uptycs threat research team has been observing an increase in utilization of regsvr32.exe Regsvr32 Utility and Squiblydoo Technique.

Malware 93

Malware Engineering Hacking Ransomware 93

Security Affairs

MAY 15, 2022

” The Ukrainian CERT shared the indicators of compromise (IoCs) for this campaign. .” ” The Ukrainian CERT shared the indicators of compromise (IoCs) for this campaign. ” reads the advisory published by CERT-UA. “The activity is carried out by the group UAC-0010 (Armageddon).”

Phishing 94

Phishing Malware Government Hacking 94

Security Affairs

MAY 1, 2023

Infoblox recommends organizations to add the indicators of compromise (IOCs) included in its report to their blocklists manually or via our GitHub repository infobloxopen:threat-intelligence. Infoblox researchers discovered a new sophisticated malware toolkit, dubbed Decoy Dog, targeting enterprise networks.

Malware 75

Malware DNS Education Media 75

Security Affairs

MAY 9, 2022

Government experts observed that malicious executables are downloaded from compromised web resources. The report includes Indicators of Compromise (IoCs). The Computer Emergency Response Team of Ukraine (CERT-UA) warns of attacks spreading info-stealing malware Jester Stealer. To nominate, please visit:?

Password Management 84

Password Management VPN Cryptocurrency Government 84

Security Boulevard

MAY 10, 2023

In the complex terrain of the modern cybersecurity landscape, static defenses and traditional Indicators of Compromise (IOCs) are insufficient. As cyber attackers grow increasingly sophisticated, proactive threat hunting becomes essential.

Cyber Attacks 44

Cyber Attacks Cybersecurity 44

McAfee

SEPTEMBER 22, 2021

This month Microsoft released patches for 86 vulnerabilities. The list of flaws, collectively called OMIGOD, impact a software agent called Open Management Infrastructure that’s automatically deployed in many Azure services – CVE-2021-38647 (CVSS score: 9.8) – Open Management Infrastructure Remote Code Execution Vulnerability.

Firewall 55

Firewall Software DDOS Internet 55

Hot for Security

MARCH 9, 2021

In case you’ve missed the news – hundreds of thousands of Microsoft Exchange Server systems worldwide are thought to have been compromised by hackers, who exploited zero-day vulnerabilities to steal emails. What’s going on? Victims have included the European Banking Authority. What’s a zero-day vulnerability?

Hacking 145

Hacking Small Business Banking Internet 145