Weekly News Roundup — June 13 to June 19

Hello and welcome to Sec Soup, where the weekly newsletter has a collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

CIS: Top 10 Malware May 2021CrowdStrike: Ransomware Actors Evolved Operations in 2020Proofpoint: The First Step: Initial Access Leads to RansomwareRiskIQ: Bit2check: Stolen Card Validation Service Illuminates A New Corner of the Skimming EcosystemCybereason: Report: Ransomware Attacks and the True Cost to BusinessPhishLabs: 62% of Phishing Sites Abuse Free Tools or ServicesTrendMicro: Fake DarkSide Campaign Targets Energy and Food SectorsUnit42: Conti Ransomware Gang: An Overview

Threat Research 

Proofpoint: New TA402 Molerats Malware Targets Governments in the Middle EastFireEye: Smoking Out a DARKSIDE Affiliate’s Supply Chain Software CompromiseProdaft (PDF): LockBit RaaS In-Depth AnalysisSophos: Vigilante malware rats out software pirates while blocking ThePirateBayRecorded Future: Threat Activity Group RedFoxtrot Targets Bordering Asian CountriesSecurelist: Black Kingdom ransomwareSecurelist: Ferocious Kitten: 6 years of covert surveillance in IranIntezer: Klingon RAT Holding on for Dear LifeInquest: PCode Pushing AveMariaSecureworks: Hades Ransomware Operators Use Distinctive Tactics and InfrastructureBinary Defense: Analysis of Hancitor – When Boring Begets BeaconSentinel Labs: Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value TargetsBushido Token: SharePoint Island Hopping: Phishing with compromised accountsMicrosoft: Behind the scenes of business email compromise: Using cross-domain threat data to disrupt a large BEC campaign

Tools and Tips

SpecterOps: Certified Pre-Owned. Active Directory Certificate Services… | by Will | Jun, 2021 | Posts By SpecterOps Team MembersSANS ISC: Easy Access to the NIST RDS DatabaseSANS ISC: Network Forensics on Azure VMs (Part #2)SANS ISC: Update: mac-robber.pyRed Canary: Diary of a Detection Engineer: Babysitting child processesNSA: NSA Releases Guidance on Securing Unified Communications and Voice and Video over IP SystemsVMWare: Detecting UEFI Bootkits in the WildRapid7: Attack Surface Analysis Part 2: Penetration TestingSANS: Top 5 ICS Incident Response Tabletops and How to Run ThemMatryoshkaHax: Lsass and Credential TheftNirSoft: USB Drive Log For Windows 10Andy Piazza: CTI 101 Student Handouttomnomnom: gron: Make JSON greppable!Yaxser: Yaxser/Backstab: A tool to kill antimalware protected processesjaredcatkinson: Code from “Taking Hunting to the Next Level: Hunting in Memory”

Breaches, Government, and Law Enforcement 

Associated Press: The Latest: Biden and Putin depart Geneva after summitNATO: Brussels Summit Communiqué issued by the Heads of State and Government participating in the meeting of the North Atlantic Council in Brussels 14 June 2021Cyberpolice of Ukraine: Cyberpolice exposes hacker group for spreading encryption virus and inflicting half a billion dollars in damage to foreign companiesFlashpoint: Cl0p Ransomware Operators Arrested, Estimated Damages Eclipse $500MThe Record: Brief North Korean hackers breach South Korea’s atomic research agency through VPN bugNPR: Puerto Rico Sees Massive Power Outage After Fire And A Cyberattack

Vulnerabilities and Exploits

ZDNet: Critical remote code execution flaw in thousands of VMWare vCenter servers remains unpatchedTrustwave: Thousands of Vulnerable VMWare vCenter Servers Still Publicly Exposed (CVE-2021-21985, CVE-2021-21986)McAfee: A New Program for Your Peloton – Whether You Like It or NotCISA: Vulnerability Summary for the Week of June 7, 2021MDSec: Bypassing Image Load Kernel Callbacks Read More

The post Weekly News Roundup — June 13 to June 19 appeared first on Malware Devil.

https://malwaredevil.com/2021/06/19/weekly-news-roundup-june-13-to-june-19/?utm_source=rss&utm_medium=rss&utm_campaign=weekly-news-roundup-june-13-to-june-19