Security News in Review: SolarWinds Threat Group Launches New Phishing Campaign

Welcome to your weekly roundup of cybersecurity news. In the current edition, you’ll find information about a new campaign by the threat group behind the SolarWinds supply chain attack, Belgian authorities closing a campaign they think originated in China, and information on a new cybersecurity directive for pipeline operators. 

Read on for the news!

The post Security News in Review: SolarWinds Threat Group Launches New Phishing Campaign appeared first on Security Boulevard.

Read More

The post Security News in Review: SolarWinds Threat Group Launches New Phishing Campaign appeared first on Malware Devil.

https://malwaredevil.com/2021/05/29/security-news-in-review-solarwinds-threat-group-launches-new-phishing-campaign/?utm_source=rss&utm_medium=rss&utm_campaign=security-news-in-review-solarwinds-threat-group-launches-new-phishing-campaign

Researchers Demonstrate 2 New Hacks to Modify Certified PDF Documents

Cybersecurity researchers have disclosed two new attack techniques on certified PDF documents that could potentially enable an attacker to alter a document’s visible content by displaying malicious content over the certified content without invalidating its signature.
“The attack idea exploits the flexibility of PDF certification, which allows signing or adding annotations to certified documents
Read More

The post Researchers Demonstrate 2 New Hacks to Modify Certified PDF Documents appeared first on Malware Devil.

https://malwaredevil.com/2021/05/29/researchers-demonstrate-2-new-hacks-to-modify-certified-pdf-documents/?utm_source=rss&utm_medium=rss&utm_campaign=researchers-demonstrate-2-new-hacks-to-modify-certified-pdf-documents

How Gamification is Changing Cybersecurity

Gamification is changing cybersecurity and the way we learn! Scott Wright, Co-host and CEO of Click Armor, joins us this month to discuss why gamification is a “game” changer in our industry. ** Links mentioned on the show ** What is Gamified Learning? https://clickarmor.ca/guide-to-gamified-learning/ ** Watch this episode on YouTube ** https://youtu.be/C37MnOUWsv0 ** Thank you […]

The post How Gamification is Changing Cybersecurity appeared first on The Shared Security Show.

The post How Gamification is Changing Cybersecurity appeared first on Security Boulevard.

Read More

The post How Gamification is Changing Cybersecurity appeared first on Malware Devil.

https://malwaredevil.com/2021/05/29/how-gamification-is-changing-cybersecurity/?utm_source=rss&utm_medium=rss&utm_campaign=how-gamification-is-changing-cybersecurity

El aumento de los ciberataques y su prevención: Caso Colonial Pipeline

Cada día que pasa vemos nuevos casos de ciberataques cada vez más mediáticos y con daños notables; la industria energética no ha sido ajena a estos eventos. Y es  que al momento de presentarse un nuevo ataque, trae consigo consecuencias …

The post El aumento de los ciberataques y su prevención: Caso Colonial Pipeline appeared first on ManageEngine Blog.

The post El aumento de los ciberataques y su prevención: Caso Colonial Pipeline appeared first on Security Boulevard.

Read More

The post El aumento de los ciberataques y su prevención: Caso Colonial Pipeline appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/el-aumento-de-los-ciberataques-y-su-prevencion-caso-colonial-pipeline/?utm_source=rss&utm_medium=rss&utm_campaign=el-aumento-de-los-ciberataques-y-su-prevencion-caso-colonial-pipeline

AA21-148A: Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs

Original release date: May 28, 2021

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are responding to a spearphishing campaign targeting government organizations, intergovernmental organizations (IGOs), and non-governmental organizations (NGOs). A sophisticated cyber threat actor leveraged a compromised end-user account from Constant Contact, a legitimate email marketing software company, to spoof a U.S.-based government organization and distribute links to malicious URLs.[1] Note: CISA and FBI acknowledge open-source reporting attributing the activity discussed in the report to APT29 (also known as Nobelium, The Dukes, and Cozy Bear).[2,3] However, CISA and FBI are investigating this activity and have not attributed it to any threat actor at this time. CISA and FBI will update this Joint Cybersecurity Advisory as new information becomes available.

This Joint Cybersecurity Advisory contains information on tactics, techniques, and procedures (TTPs) and malware associated with this campaign. For more information on the malware, refer to Malware Analysis Report MAR-10339794-1.v1: Cobalt Strike Beacon.

CISA and FBI urge governmental and international affairs organizations and individuals associated with such organizations to immediately adopt a heightened state of awareness and implement the recommendations in the Mitigations section of this advisory.

For a downloadable list of indicators of compromise (IOCs), refer to AA21-148A.stix, and MAR-10339794-1.v1.stix.

 

Technical Details

Based on incident reports, malware collection, and trusted third-party reporting, CISA and FBI are responding to a sophisticated spearphishing campaign. A cyber threat actor leveraged a compromised end-user account from Constant Contact, a legitimate email marketing software company, to send phishing emails to more than 7,000 accounts across approximately 350 government organizations, IGOs, and NGOs. The threat actor sent spoofed emails that appeared to originate from a U.S. Government organization. The emails contained a legitimate Constant Contact link that redirected to a malicious URL [T1566.002, T1204.001], from which a malicious ISO file was dropped onto the victim’s machine.

The ISO file contained (1) a malicious Dynamic Link Library (DLL) named Documents.dll [T1055.001], which is a custom Cobalt Strike Beacon version 4 implant, (2) a malicious shortcut file that executes the Cobalt Strike Beacon loader [T1105], and (3) a benign decoy PDF titled “Foreign Threats to the 2020 US Federal Elections” with file name “ICA-declass.pdf” (see figure 1). Note: The decoy file appears to be a copy of the declassified Intelligence Community Assessment pursuant to Executive Order 13848 Section 1(a), which is available at https://www.intelligence.gov/index.php/ic-on-the-record-database/results/1046-foreign-threats-to-the-2020-us-federal-elections-intelligence-community-assessment.

Figure 1: Decoy PDF: ICA-declass.pdf

Cobalt Strike is a commercial penetration testing tool used to conduct red team operations.[4] It contains a number of tools that complement the cyber threat actor’s exploitation efforts, such as a keystroke logger, file injection capability, and network services scanners. The Cobalt Strike Beacon is the malicious implant that calls back to attacker-controlled infrastructure and checks for additional commands to execute on the compromised system [TA0011].

The configuration file for this Cobalt Strike Beacon implant contained communications protocols, an implant watermark, and the following hardcoded command and control (C2) domains:

dataplane.theyardservice[.]com/jquery-3.3.1.min.woff2
cdn.theyardservice[.]com/jquery-3.3.1.min.woff2
static.theyardservice[.]com/jquery-3.3.1.min.woff2
worldhomeoutlet[.]com/jquery-3.3.1.min.woff2

The configuration file was encoded via an XOR with the key 0x2e and a 16-bit byte swap.

For more information on the ISO file and Cobalt Strike Beacon implant, including IOCs, refer to Malware Analysis Report MAR-10339794-1.v1: Cobalt Strike Beacon.

INDICATORS OF COMPROMISE

The following IOCS were derived from trusted third parties and open-source research. For a downloadable list of IOCs, refer to AA21-148A.stix and MAR-10339794-1.v1.stix.

URL: https[:]//r20.rs6.net/tn.jsp?f=
Host IP: 208.75.122[.]11 (US)
Owner: Constant Contact, Inc.
Activity: legitimate Constant Contact link found in phishing email that redirects victims to actor-controlled infrastructure at https[:]//usaid.theyardservice.com/d/<target_email_address>
●    URL: https[:]//usaid.theyardservice.com/d/<target_email_address>
Host IP: 83.171.237[.]173 (Germany)
Owner: [redacted]
First Seen: May 25, 2021
Activity: actor-controlled URL that was redirected from https[:]//r20.rs6.net/tn.jsp?f=; the domain usaid[.]theyardservice.com was detected as a malware site; hosted a malicious ISO file “usaid[.]theyardservice.com”
●    File: ICA-declass.iso [MD5: cbc1dc536cd6f4fb9648e229e5d23361]
File Type: Macintosh Disk Image
Detection: Artemis!7EDF943ED251, Trojan:Win32/Cobaltstrike!MSR, or other malware
Activity: ISO file container; contains a custom Cobalt Strike Beacon loader; communicated with multiple URLs, domains, and IP addresses
●    File: /d/ [MD5: ebe2f8df39b4a94fb408580a728d351f]
File Type: Macintosh Disk Image
Detection: Cobalt, Artemis!7EDF943ED251, or other malware
Activity: ISO file container; contains a custom Cobalt Strike Beacon loader; communicated with multiple URLs, domains, and IP addresses
●    File: ICA-declass.iso [MD5: 29e2ef8ef5c6ff95e98bff095e63dc05]
File Type: Macintosh Disk Image
Detection: Cobalt Strike, Rozena, or other malware
Activity: ISO file container; contains a custom Cobalt Strike Beacon loader; communicated with multiple URLs, domains, and IP addresses
●    File: Reports.lnk [MD5: dcfd60883c73c3d92fceb6ac910d5b80]
File Type: LNK (Windows shortcut)
Detection: Worm: Win32-Script.Save.df8efe7a, Static AI – Suspicious LNK, or other malware
Activity: shortcut contained in malicious ISO files; executes a custom Cobalt Strike Beacon loader
●    File: ICA-declass.pdf [MD5: b40b30329489d342b2aa5ef8309ad388]
File Type: PDF
Detection: undetected
Activity: benign, password-protected PDF displayed to victim as a decoy; currently unrecognized by antivirus software
●    File: DOCUMENT.DLL [MD5: 7edf943ed251fa480c5ca5abb2446c75]
File Type: Win32 DLL
Detection: Trojan: Win32/Cobaltstrike!MSR, Rozena, or other malware
Activity: custom Cobalt Strike Beacon loader contained in malicious ISO files; communicating with multiple URLs, domains, and IP addresses by antivirus software
●    File: DOCUMENT.DLL [MD5: 1c3b8ae594cb4ce24c2680b47cebf808]
File Type: Win32 DLL
Detection: Cobalt Strike, Razy, Khalesi, or other malware
Activity: Custom Cobalt Strike Beacon loader contained in malicious ISO files; communicating with multiple URLs, domains, and IP addresses by antivirus software
●    Domain: usaid[.]theyardservice.com
Host IP: 83.171.237[.]173 (Germany)
First Seen: May 25, 2021
Owner: Withheld for Privacy Purposes
Activity: subdomain used to distribute ISO file according to the trusted third party; detected as a malware site by antivirus programs
●    Domain: worldhomeoutlet.com
Host IP: 192.99.221[.]77 (Canada)
Created Date: March 11, 2020
Owner: Withheld for Privacy Purposes by Registrar
Activity: Cobalt Strike C2 subdomain according to the trusted third party; categorized as suspicious and observed communicating with multiple malicious files according to antivirus software; associated with Cobalt Strike malware
●    Domain: dataplane.theyardservice[.]com
Host IP: 83.171.237[.]173 (Germany)
First Seen: May 25, 2021
Owner: [redacted]
Activity: Cobalt Strike C2 subdomain according to the trusted third party; categorized as suspicious and observed communicating with multiple malicious files according to antivirus software; observed in phishing, malware, and spam activity
●    Domain: cdn.theyardservice[.]com
Host IP: 83.171.237[.]173 (Germany)
First Seen: May 25, 2021
Owner: Withheld for Privacy Purposes by Registrar
Activity: Cobalt Strike C2 subdomain according to the trusted third party; categorized as suspicious and observed communicating with multiple malicious files according to antivirus software
●    Domain: static.theyardservice[.]com
Host IP: 83.171.237[.]173 (Germany)
First Seen: May 25, 2021
Owner: Withheld for Privacy Purposes
Activity: Cobalt Strike C2 subdomain according to the trusted third party; categorized as suspicious and observed communicating with multiple malicious files according to antivirus software
●    IP: 192.99.221[.]77
Organization: OVH SAS
Resolutions: 7
Geolocation: Canada
Activity: detected as a malware site; hosts a suspicious domain worldhomeoutlet[.]com; observed in Cobalt Strike activity
●    IP: 83.171.237[.]173
Organization: Droptop GmbH
Resolutions: 15
Geolocation: Germany
Activity: Categorized as malicious by antivirus software; hosted multiple suspicious domains and multiple malicious files were observed downloaded from this IP address; observed in Cobalt Strike and activity
●    Domain: theyardservice[.]com
Host IP: 83.171.237[.]173 (Germany)
Created Date: January 27, 2010
Owner: Withheld for Privacy Purposes
Activity: Threat actor controlled domain according to the trusted third party; categorized as suspicious by antivirus software; observed in Cobalt Strike activity

 

Mitigations

CISA and FBI urge CI owners and operators to apply the following mitigations.
●    Implement multi-factor authentication (MFA) for every account. While privileged accounts and remote access systems are critical, it is aslo important to ensure full coverage across SaaS solutions. Enabling MFA for corporate communications platforms (as with all other accounts) provides vital defense against these types of attacks and, in many cases, can prevent them.
●    Keep all software up to date. The most effective cybersecurity programs quickly update all of their software as soon as patches are available. If your organization is unable to update all software shortly after a patch is released, prioritize implementing patches for CVEs that are already known to be exploited.
●    Implement endpoint and detection response (EDR) tools. EDR allows a high degree of visibility into the security status of endpoints and is can be an effective tool against threat actors.
○    Note: Organizations using Microsoft Defender for Endpoint or Microsoft 365 Defense should refer to Microsoft: Use attack surface reduction rules to prevent malware infection for more information on hardening the enterprise attack surface.
●    Implement centralized log management for host monitoring. A centralized logging application allows technicians to look out for anomalous activity in the network environment, such as new applications running on hosts, out-of-place communication between devices, or unaccountable login failures on machines. It also aids in troubleshooting applications or equipment in the event of a fault. CISA and the FBI recommend that organizations:
○    Forward logs from local hosts to a centralized log management server—often referred to as a security information and event management (SIEM) tool
○    Ensure logs are searchable. The ability to search, analyze, and visualize communications will help analysts diagnose issues and may lead to detection of anomalous activity.
○    Correlate logs from both network and host security devices. By reviewing logs from multiple sources, an organization can better triage an individual event and determine its impact to the organization as a whole.
○    Review both centralized and local log management policies to maximize efficiency and retain historical data. Organizations should retain critical logs for a minimum of 30 days.
●    Deploy signatures to detect and/or block inbound connection from Cobalt Strike servers and other post-exploitation tools.
●    Implement unauthorized execution prevention by disabling macro scripts from Microsoft Office files transmitted via email. Consider using Office Viewer software to open Microsoft Office files transmitted via email instead of full Microsoft Office suite applications.
●    Configure and maintain user and administrative accounts using a strong account management policy.
○    Use administrative accounts on dedicated administration workstations.
○    Limit access to and use of administrative accounts.
○    Use strong passwords. For more information on strong passwords, refer to CISA Tip: Choosing and Protecting Passwords and National Institute of Standards (NIST) SP 800-63: Digital Identity Guidelines: Authentication and Lifecycle Management.
○    Remove default accounts if unneeded. Change the password of default accounts that are needed.
○    Disable all unused accounts.
●    Implement a user training program and simulated attacks for spearphishing to discourage users from visiting malicious websites or opening malicious attachments and re-enforce the appropriate user responses to spearphishing emails.

RESOURCES

Volexity Blog: Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns | Volexity
Microsoft Blog: New sophisticated email-based attack from NOBELIUM – Microsoft Security
Microsoft Blog: Another Nobelium Cyberattack

 

Revisions

Initial version: May 28, 2021

This product is provided subject to this Notification and this Privacy & Use policy.

Read More

The post AA21-148A: Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/aa21-148a-sophisticated-spearphishing-campaign-targets-government-organizations-igos-and-ngos-2/?utm_source=rss&utm_medium=rss&utm_campaign=aa21-148a-sophisticated-spearphishing-campaign-targets-government-organizations-igos-and-ngos-2

AA21-148A: Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs

Original release date: May 28, 2021SummaryThe Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are responding to a spearphishing campaign targeting government organizations, intergovernmental organizations (IGOs), and non-governmental organizations (NGOs). A sophisticated cyber threat actor leveraged a compromised end-user account from Constant Contact, a legitimate email marketing software company, to spoof a U.S.-based government organization and distribute links to malicious URLs.[1] Note: CISA and FBI acknowledge open-source reporting attributing the activity discussed in the report to APT29 (also known as Nobelium, The Dukes, and Cozy Bear).[2,3] However, CISA and FBI are investigating this activity and have not attributed it to any threat actor at this time. CISA and FBI will update this Joint Cybersecurity Advisory as new information becomes available.

This Joint Cybersecurity Advisory contains information on tactics, techniques, and procedures (TTPs) and malware associated with this campaign. For more information on the malware, refer to Malware Analysis Report MAR-10339794-1.v1: Cobalt Strike Beacon.

CISA and FBI urge governmental and international affairs organizations and individuals associated with such organizations to immediately adopt a heightened state of awareness and implement the recommendations in the Mitigations section of this advisory.

For a downloadable list of indicators of compromise (IOCs), refer to AA21-148A.stix, and MAR-10339794-1.v1.stix.

 
Technical DetailsBased on incident reports, malware collection, and trusted third-party reporting, CISA and FBI are responding to a sophisticated spearphishing campaign. A cyber threat actor leveraged a compromised end-user account from Constant Contact, a legitimate email marketing software company, to send phishing emails to more than 7,000 accounts across approximately 350 government organizations, IGOs, and NGOs. The threat actor sent spoofed emails that appeared to originate from a U.S. Government organization. The emails contained a legitimate Constant Contact link that redirected to a malicious URL [T1566.002, T1204.001], from which a malicious ISO file was dropped onto the victim’s machine.

The ISO file contained (1) a malicious Dynamic Link Library (DLL) named Documents.dll [T1055.001], which is a custom Cobalt Strike Beacon version 4 implant, (2) a malicious shortcut file that executes the Cobalt Strike Beacon loader [T1105], and (3) a benign decoy PDF titled “Foreign Threats to the 2020 US Federal Elections” with file name “ICA-declass.pdf” (see figure 1). Note: The decoy file appears to be a copy of the declassified Intelligence Community Assessment pursuant to Executive Order 13848 Section 1(a), which is available at https://www.intelligence.gov/index.php/ic-on-the-record-database/results/1046-foreign-threats-to-the-2020-us-federal-elections-intelligence-community-assessment.

Figure 1: Decoy PDF: ICA-declass.pdf

Cobalt Strike is a commercial penetration testing tool used to conduct red team operations.[4] It contains a number of tools that complement the cyber threat actor’s exploitation efforts, such as a keystroke logger, file injection capability, and network services scanners. The Cobalt Strike Beacon is the malicious implant that calls back to attacker-controlled infrastructure and checks for additional commands to execute on the compromised system [TA0011].

The configuration file for this Cobalt Strike Beacon implant contained communications protocols, an implant watermark, and the following hardcoded command and control (C2) domains:

dataplane.theyardservice[.]com/jquery-3.3.1.min.woff2
cdn.theyardservice[.]com/jquery-3.3.1.min.woff2
static.theyardservice[.]com/jquery-3.3.1.min.woff2
worldhomeoutlet[.]com/jquery-3.3.1.min.woff2

The configuration file was encoded via an XOR with the key 0x2e and a 16-bit byte swap.

For more information on the ISO file and Cobalt Strike Beacon implant, including IOCs, refer to Malware Analysis Report MAR-10339794-1.v1: Cobalt Strike Beacon.

INDICATORS OF COMPROMISE

The following IOCS were derived from trusted third parties and open-source research. For a downloadable list of IOCs, refer to AA21-148A.stix and MAR-10339794-1.v1.stix.

URL: https[:]//r20.rs6.net/tn.jsp?f=
Host IP: 208.75.122[.]11 (US)
Owner: Constant Contact, Inc.
Activity: legitimate Constant Contact link found in phishing email that redirects victims to actor-controlled infrastructure at https[:]//usaid.theyardservice.com/d/<target_email_address>
●    URL: https[:]//usaid.theyardservice.com/d/<target_email_address>
Host IP: 83.171.237[.]173 (Germany)
Owner: [redacted]
First Seen: May 25, 2021
Activity: actor-controlled URL that was redirected from https[:]//r20.rs6.net/tn.jsp?f=; the domain usaid[.]theyardservice.com was detected as a malware site; hosted a malicious ISO file “usaid[.]theyardservice.com”
●    File: ICA-declass.iso [MD5: cbc1dc536cd6f4fb9648e229e5d23361]
File Type: Macintosh Disk Image
Detection: Artemis!7EDF943ED251, Trojan:Win32/Cobaltstrike!MSR, or other malware
Activity: ISO file container; contains a custom Cobalt Strike Beacon loader; communicated with multiple URLs, domains, and IP addresses
●    File: /d/ [MD5: ebe2f8df39b4a94fb408580a728d351f]
File Type: Macintosh Disk Image
Detection: Cobalt, Artemis!7EDF943ED251, or other malware
Activity: ISO file container; contains a custom Cobalt Strike Beacon loader; communicated with multiple URLs, domains, and IP addresses
●    File: ICA-declass.iso [MD5: 29e2ef8ef5c6ff95e98bff095e63dc05]
File Type: Macintosh Disk Image
Detection: Cobalt Strike, Rozena, or other malware
Activity: ISO file container; contains a custom Cobalt Strike Beacon loader; communicated with multiple URLs, domains, and IP addresses
●    File: Reports.lnk [MD5: dcfd60883c73c3d92fceb6ac910d5b80]
File Type: LNK (Windows shortcut)
Detection: Worm: Win32-Script.Save.df8efe7a, Static AI – Suspicious LNK, or other malware
Activity: shortcut contained in malicious ISO files; executes a custom Cobalt Strike Beacon loader
●    File: ICA-declass.pdf [MD5: b40b30329489d342b2aa5ef8309ad388]
File Type: PDF
Detection: undetected
Activity: benign, password-protected PDF displayed to victim as a decoy; currently unrecognized by antivirus software
●    File: DOCUMENT.DLL [MD5: 7edf943ed251fa480c5ca5abb2446c75]
File Type: Win32 DLL
Detection: Trojan: Win32/Cobaltstrike!MSR, Rozena, or other malware
Activity: custom Cobalt Strike Beacon loader contained in malicious ISO files; communicating with multiple URLs, domains, and IP addresses by antivirus software
●    File: DOCUMENT.DLL [MD5: 1c3b8ae594cb4ce24c2680b47cebf808]
File Type: Win32 DLL
Detection: Cobalt Strike, Razy, Khalesi, or other malware
Activity: Custom Cobalt Strike Beacon loader contained in malicious ISO files; communicating with multiple URLs, domains, and IP addresses by antivirus software
●    Domain: usaid[.]theyardservice.com
Host IP: 83.171.237[.]173 (Germany)
First Seen: May 25, 2021
Owner: Withheld for Privacy Purposes
Activity: subdomain used to distribute ISO file according to the trusted third party; detected as a malware site by antivirus programs
●    Domain: worldhomeoutlet.com
Host IP: 192.99.221[.]77 (Canada)
Created Date: March 11, 2020
Owner: Withheld for Privacy Purposes by Registrar
Activity: Cobalt Strike C2 subdomain according to the trusted third party; categorized as suspicious and observed communicating with multiple malicious files according to antivirus software; associated with Cobalt Strike malware
●    Domain: dataplane.theyardservice[.]com
Host IP: 83.171.237[.]173 (Germany)
First Seen: May 25, 2021
Owner: [redacted]
Activity: Cobalt Strike C2 subdomain according to the trusted third party; categorized as suspicious and observed communicating with multiple malicious files according to antivirus software; observed in phishing, malware, and spam activity
●    Domain: cdn.theyardservice[.]com
Host IP: 83.171.237[.]173 (Germany)
First Seen: May 25, 2021
Owner: Withheld for Privacy Purposes by Registrar
Activity: Cobalt Strike C2 subdomain according to the trusted third party; categorized as suspicious and observed communicating with multiple malicious files according to antivirus software
●    Domain: static.theyardservice[.]com
Host IP: 83.171.237[.]173 (Germany)
First Seen: May 25, 2021
Owner: Withheld for Privacy Purposes
Activity: Cobalt Strike C2 subdomain according to the trusted third party; categorized as suspicious and observed communicating with multiple malicious files according to antivirus software
●    IP: 192.99.221[.]77
Organization: OVH SAS
Resolutions: 7
Geolocation: Canada
Activity: detected as a malware site; hosts a suspicious domain worldhomeoutlet[.]com; observed in Cobalt Strike activity
●    IP: 83.171.237[.]173
Organization: Droptop GmbH
Resolutions: 15
Geolocation: Germany
Activity: Categorized as malicious by antivirus software; hosted multiple suspicious domains and multiple malicious files were observed downloaded from this IP address; observed in Cobalt Strike and activity
●    Domain: theyardservice[.]com
Host IP: 83.171.237[.]173 (Germany)
Created Date: January 27, 2010
Owner: Withheld for Privacy Purposes
Activity: Threat actor controlled domain according to the trusted third party; categorized as suspicious by antivirus software; observed in Cobalt Strike activity

 
MitigationsCISA and FBI urge CI owners and operators to apply the following mitigations.
●    Implement multi-factor authentication (MFA) for every account. While privileged accounts and remote access systems are critical, it is aslo important to ensure full coverage across SaaS solutions. Enabling MFA for corporate communications platforms (as with all other accounts) provides vital defense against these types of attacks and, in many cases, can prevent them.
●    Keep all software up to date. The most effective cybersecurity programs quickly update all of their software as soon as patches are available. If your organization is unable to update all software shortly after a patch is released, prioritize implementing patches for CVEs that are already known to be exploited.
●    Implement endpoint and detection response (EDR) tools. EDR allows a high degree of visibility into the security status of endpoints and is can be an effective tool against threat actors.
○    Note: Organizations using Microsoft Defender for Endpoint or Microsoft 365 Defense should refer to Microsoft: Use attack surface reduction rules to prevent malware infection for more information on hardening the enterprise attack surface.
●    Implement centralized log management for host monitoring. A centralized logging application allows technicians to look out for anomalous activity in the network environment, such as new applications running on hosts, out-of-place communication between devices, or unaccountable login failures on machines. It also aids in troubleshooting applications or equipment in the event of a fault. CISA and the FBI recommend that organizations:
○    Forward logs from local hosts to a centralized log management server—often referred to as a security information and event management (SIEM) tool
○    Ensure logs are searchable. The ability to search, analyze, and visualize communications will help analysts diagnose issues and may lead to detection of anomalous activity.
○    Correlate logs from both network and host security devices. By reviewing logs from multiple sources, an organization can better triage an individual event and determine its impact to the organization as a whole.
○    Review both centralized and local log management policies to maximize efficiency and retain historical data. Organizations should retain critical logs for a minimum of 30 days.
●    Deploy signatures to detect and/or block inbound connection from Cobalt Strike servers and other post-exploitation tools.
●    Implement unauthorized execution prevention by disabling macro scripts from Microsoft Office files transmitted via email. Consider using Office Viewer software to open Microsoft Office files transmitted via email instead of full Microsoft Office suite applications.
●    Configure and maintain user and administrative accounts using a strong account management policy.
○    Use administrative accounts on dedicated administration workstations.
○    Limit access to and use of administrative accounts.
○    Use strong passwords. For more information on strong passwords, refer to CISA Tip: Choosing and Protecting Passwords and National Institute of Standards (NIST) SP 800-63: Digital Identity Guidelines: Authentication and Lifecycle Management.
○    Remove default accounts if unneeded. Change the password of default accounts that are needed.
○    Disable all unused accounts.
●    Implement a user training program and simulated attacks for spearphishing to discourage users from visiting malicious websites or opening malicious attachments and re-enforce the appropriate user responses to spearphishing emails.

RESOURCES

Volexity Blog: Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns | Volexity
Microsoft Blog: New sophisticated email-based attack from NOBELIUM – Microsoft Security
Microsoft Blog: Another Nobelium Cyberattack

 
Revisions
Initial version: May 28, 2021

This product is provided subject to this Notification and this Privacy & Use policy.
Read More

The post AA21-148A: Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/aa21-148a-sophisticated-spearphishing-campaign-targets-government-organizations-igos-and-ngos/?utm_source=rss&utm_medium=rss&utm_campaign=aa21-148a-sophisticated-spearphishing-campaign-targets-government-organizations-igos-and-ngos

Playing with ImageTragick like it’s 2016

Read More

The post Playing with ImageTragick like it’s 2016 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/playing-with-imagetragick-like-its-2016-2/?utm_source=rss&utm_medium=rss&utm_campaign=playing-with-imagetragick-like-its-2016-2

[Invision Power Services, Inc.] high – PHP Code Injection through “previewBlock()” method

Read More

The post [Invision Power Services, Inc.] high – PHP Code Injection through “previewBlock()” method appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/invision-power-services-inc-high-php-code-injection-through-previewblock-method-2/?utm_source=rss&utm_medium=rss&utm_campaign=invision-power-services-inc-high-php-code-injection-through-previewblock-method-2

Unleashing Fuzzing Through Comprehensive, Efficient, and Faithful Exploitable-Bug Exposing

Read More

The post Unleashing Fuzzing Through Comprehensive, Efficient, and Faithful Exploitable-Bug Exposing appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/unleashing-fuzzing-through-comprehensive-efficient-and-faithful-exploitable-bug-exposing-2/?utm_source=rss&utm_medium=rss&utm_campaign=unleashing-fuzzing-through-comprehensive-efficient-and-faithful-exploitable-bug-exposing-2

Chinese APT Groups Continue to Pound Away on Pulse Secure VPNs

Security vendor says it has observed threat groups using a set of 16 tools specifically designed to attack Pulse Secure devices since April 2020.

The post Chinese APT Groups Continue to Pound Away on Pulse Secure VPNs appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/chinese-apt-groups-continue-to-pound-away-on-pulse-secure-vpns/?utm_source=rss&utm_medium=rss&utm_campaign=chinese-apt-groups-continue-to-pound-away-on-pulse-secure-vpns

WooCommerce Credit Card Skimmer Hides in Plain Sight

Recently, a client’s customers were receiving a warning from their anti-virus software when they navigated to the checkout page of the client’s ecommerce website. Antivirus software such as Kaspersky and ESET would issue a warning but only once a product had been added to the cart and a customer was about to enter their payment information. This is, of course, a tell-tale sign that there is something seriously wrong with the website and likely a case of credit card exfiltration.

Continue reading WooCommerce Credit Card Skimmer Hides in Plain Sight at Sucuri Blog.

The post WooCommerce Credit Card Skimmer Hides in Plain Sight appeared first on Security Boulevard.

Read More

The post WooCommerce Credit Card Skimmer Hides in Plain Sight appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/woocommerce-credit-card-skimmer-hides-in-plain-sight/?utm_source=rss&utm_medium=rss&utm_campaign=woocommerce-credit-card-skimmer-hides-in-plain-sight

MAR 10339794-1.v1 – Cobalt Strike Beacon

AR21-148A
Read More

The post MAR 10339794-1.v1 – Cobalt Strike Beacon appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/mar-10339794-1-v1-cobalt-strike-beacon/?utm_source=rss&utm_medium=rss&utm_campaign=mar-10339794-1-v1-cobalt-strike-beacon

Hackers Exploit Post-COVID Return to Offices

Spoofed CIO ‘pandemic guideline’ emails being used to steal credentials.
Read More

The post Hackers Exploit Post-COVID Return to Offices appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/hackers-exploit-post-covid-return-to-offices/?utm_source=rss&utm_medium=rss&utm_campaign=hackers-exploit-post-covid-return-to-offices

Censorship of “Seb Gorka, a Nazi, is collecting your ad dollars”

A new post about a notorious Nazi collecting ad dollars is getting banned by LinkedIn. (I find neo-Nazi to be a unnecessary wordplay concession to Nazism, since no Nazi ever says neo-Communist when talking about people today who they think are Communists) It’s a curious case of the good guys being censored by… secret police. … Continue reading Censorship of “Seb Gorka, a Nazi, is collecting your ad dollars” →

The post Censorship of “Seb Gorka, a Nazi, is collecting your ad dollars” appeared first on Security Boulevard.

Read More

The post Censorship of “Seb Gorka, a Nazi, is collecting your ad dollars” appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/censorship-of-seb-gorka-a-nazi-is-collecting-your-ad-dollars/?utm_source=rss&utm_medium=rss&utm_campaign=censorship-of-seb-gorka-a-nazi-is-collecting-your-ad-dollars

Apple Patches Flaw That Allows Sneaky Screenshots | Avast

Apple released Big Sur 11.4 this week in order to patch a zero-day flaw that allowed users to take screenshots, record video, and access files on someone else’s Mac without being detected. The exploit provided a way to bypass Apple’s Transparency Consent and Control (TCC) framework, which oversees the permissions granted to each app. The flaw was discovered by cybersecurity firm Jamf when, according to its blog, it observed XCSSET spyware “using this bypass specifically for the purpose of taking screenshots of the user’s desktop without requiring additional permissions.” The malware was able to evade the TCC by essentially hijacking permissions granted to other apps. 

The post Apple Patches Flaw That Allows Sneaky Screenshots | Avast appeared first on Security Boulevard.

Read More

The post Apple Patches Flaw That Allows Sneaky Screenshots | Avast appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/apple-patches-flaw-that-allows-sneaky-screenshots-avast/?utm_source=rss&utm_medium=rss&utm_campaign=apple-patches-flaw-that-allows-sneaky-screenshots-avast

ESB-2021.1839 – [Appliance] AmegaView: Multiple vulnerabilities

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2021.1839
Advisory (icsa-21-147-03) MesaLabs AmegaView
28 May 2021

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: AmegaView
Publisher: ICS-CERT
Operating System: Network Appliance
Impact/Access: Increased Privileges — Existing Account
Execute Arbitrary Code/Commands — Remote/Unauthenticated
Unauthorised Access — Remote/Unauthenticated
Reduced Security — Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-27453 CVE-2021-27451 CVE-2021-27449
CVE-2021-27447 CVE-2021-27445

Original Bulletin:
https://us-cert.cisa.gov/ics/advisories/icsa-21-147-03

– ————————–BEGIN INCLUDED TEXT——————–

ICS Advisory (ICSA-21-147-03)

MesaLabs AmegaView

Original release date: May 27, 2021

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided
“as is” for informational purposes only. The Department of Homeland Security
(DHS) does not provide any warranties of any kind regarding any information
contained within. DHS does not endorse any commercial product or service,
referenced in this product or otherwise. Further dissemination of this product
is governed by the Traffic Light Protocol (TLP) marking in the header. For more
information about TLP, see https://us-cert.cisa.gov/tlp/ .

1. EXECUTIVE SUMMARY

o CVSS v3 10.0
o ATTENTION: Exploitable remotely/low attack complexity
o Vendor: Mesa Labs
o Equipment: AmegaView
o Vulnerabilities: Command Injection, Improper Authentication, Authentication
Bypass Using an Alternate Path or Channel, Improper Privilege Management

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow remote code
execution or allow access to the device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of AmegaView, a continuous monitoring hardware and
software platform, are affected:

o AmegaView Versions 3.0 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND (‘COMMAND
INJECTION’) CWE-77

The affected product is vulnerable to a command injection, which may allow an
attacker to remotely execute arbitrary code.

CVE-2021-27447 has been assigned to this vulnerability. A CVSS v3 base score of
10.0 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:C/
C:H/I:H/A:H ).

3.2.2 IMPROPER AUTHENTICATION CWE-287

The affected product’s passcode is generated by an easily reversible algorithm,
which may allow an attacker to gain access to the device.

CVE-2021-27451 has been assigned to this vulnerability. A CVSS v3 base score of
7.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:L/I:L/A:L ).

3.2.3 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288

The affected product uses default cookies that could be set to bypass
authentication to the web application, which may allow an attacker to gain
access.

CVE-2021-27453 has been assigned to this vulnerability. A CVSS v3 base score of
7.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:L/I:L/A:L ).

3.2.4 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND (‘COMMAND
INJECTION’) CWE-77

The affected product has a command injection vulnerability that can be
exploited to execute commands in the web server.

CVE-2021-27449 has been assigned to this vulnerability. A CVSS v3 base score of
9.9 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:L/UI:N/S:C/
C:H/I:H/A:H ).

3.2.5 IMPROPER PRIVILEGE MANAGEMENT CWE-269

The affected product has insecure file permissions that could be exploited to
escalate privileges on the device.

CVE-2021-27445 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:H ).

3.3 BACKGROUND

o CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health, Food and
Agriculture
o COUNTRIES/AREAS DEPLOYED: United States
o COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Stephen Yackey of Securifera reported these vulnerabilities to CISA.

4. MITIGATIONS

MesaLabs has scheduled AmegaView for end-of-life at the end of 2021. Due to
this discontinued service, MesaLabs does not plan to release an update to
address these vulnerabilities. MesaLabs recommends users upgrade to the newer
ViewPoint software that is compatible with AmegaView hardware.

CISA recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:

o Minimize network exposure for all control system devices and/or systems,
and ensure that they are not accessible from the Internet .
o Locate control system networks and remote devices behind firewalls, and
isolate them from the business network.
o When remote access is required, use secure methods, such as Virtual Private
Networks (VPNs), recognizing VPNs may have vulnerabilities and should be
updated to the most current version available. Also recognize VPN is only
as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.cisa.gov . Several recommended practices are
available for reading and download, including Improving Industrial Control
Systems Cybersecurity with Defense-in-Depth Strategies .

Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper,
ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation
Strategies .

Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.

No known public exploits specifically target these vulnerabilities.

For any questions related to this report, please contact the CISA at:

Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870

CISA continuously strives to improve its products and services. You can help by
choosing one of the links below to provide feedback about this product.

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYLA9eeNLKJtyKPYoAQh1Sg/6A3ndCXaTJBbrwrPdTlU70X/NYJDGqdhD
WpdxfwVFItS2JTBNL9YksupFn5TUduP54858suDeUdekeFj0hCqDyk+wd/xSZBwf
vxWkEp7HhCWH5aWsn7Tk+BVlgkFP6U+Ib9+yxq+6cs0T1YvS+pzvbln+y2yWU/Oa
YGNKY7NksCh4iF2Jc/nFGQ5hQ77vUDPrU9mHMRW2ADASCUvmUhByfVnbKiAtzAa4
G/oKjlpLuJZluHVNgRO4zZatnL7buz5efHxD/MpKtR59pa7xdHTVsXP9hJ9oDuir
Irdb/gjAhFYp6kT97nH5mpSmQ0ZC2ZVI8iJkN8fBGanh+k05NNRbEDsH38MynTRo
mLdgCKaevA+d7qQ9sPLEolziHazcdo+6Fw5lm4ypPYIRXaTvn9hSDNVrk6jduD38
Pm6cstiMWF8w63TFQIbwNCGFzVO4pzbP3d9k7DE7fCWrOMVCvzd4Ez4R+p2+R+PD
VFkEbnWQT6Jru65sYkQwGZgXQd3HTz6pOO3sMtJdQZaDZ92llx62nc5VeZMQa0/t
BDkV8YPLzDooom3JHfEXlea8NmdMjUtNBNZ+VWm9h9SAyxP7I/jllk39hjxioRTN
sRAo/fg5gJ3q1azjxi34CcCqW1M0V9ls8BYTBB6SUJ8GYBj6X/Z3iNEciRZiJtKe
/9r+olw5y0Y=
=7Yu2
—–END PGP SIGNATURE—–

Read More

The post ESB-2021.1839 – [Appliance] AmegaView: Multiple vulnerabilities appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/esb-2021-1839-appliance-amegaview-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1839-appliance-amegaview-multiple-vulnerabilities

ESB-2021.1840 – [SUSE] nginx: Multiple vulnerabilities

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2021.1840
Security update for nginx
28 May 2021

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: nginx
Publisher: SUSE
Operating System: SUSE
Impact/Access: Execute Arbitrary Code/Commands — Remote/Unauthenticated
Denial of Service — Remote/Unauthenticated
Access Confidential Data — Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-23017

Reference: ESB-2021.1833
ESB-2021.1817
ESB-2021.1802

Original Bulletin:
https://www.suse.com/support/update/announcement/2021/suse-su-20211792-1

– ————————–BEGIN INCLUDED TEXT——————–

SUSE Security Update: Security update for nginx

______________________________________________________________________________

Announcement ID: SUSE-SU-2021:1792-1
Rating: important
References: #1186126
Cross-References: CVE-2021-23017
Affected Products:
SUSE Linux Enterprise Server for SAP 15
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise High Performance Computing 15-ESPOS
______________________________________________________________________________

An update that fixes one vulnerability is now available.

Description:

This update for nginx fixes the following issues:

o CVE-2021-23017: nginx DNS resolver off-by-one heap write (bsc#1186126)

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or “zypper patch”.
Alternatively you can run the command listed for your product:

o SUSE Linux Enterprise Server for SAP 15:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2021-1792=1
o SUSE Linux Enterprise Server 15-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-2021-1792=1
o SUSE Linux Enterprise High Performance Computing 15-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2021-1792=1
o SUSE Linux Enterprise High Performance Computing 15-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2021-1792=1

Package List:

o SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):
nginx-1.16.1-3.15.1
nginx-debuginfo-1.16.1-3.15.1
nginx-debugsource-1.16.1-3.15.1
o SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):
nginx-1.16.1-3.15.1
nginx-debuginfo-1.16.1-3.15.1
nginx-debugsource-1.16.1-3.15.1
o SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):
nginx-1.16.1-3.15.1
nginx-debuginfo-1.16.1-3.15.1
nginx-debugsource-1.16.1-3.15.1
o SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):
nginx-1.16.1-3.15.1
nginx-debuginfo-1.16.1-3.15.1
nginx-debugsource-1.16.1-3.15.1

References:

o https://www.suse.com/security/cve/CVE-2021-23017.html
o https://bugzilla.suse.com/1186126

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYLA/A+NLKJtyKPYoAQiX0A//VSFaEYxw/I34UK6BJSfOb3JjvbdeLO9N
bp33egT1d6ANjYh4VHP10y/aVIi7JAt7Hy++qz4HEa6TYQq48esv45bUaIeLmvM8
AWtc9Z6sODFJ54lNj0iI4otKAKDPzG0NuBWl4c/Di0qID6Xia9YvfCP4zgm8IU4r
VwB7CuERxf2B7JFytmlIi/LndrK7vYapazfCKcDmsDnT3DIj/V+1xu49AyP9t60u
0cZRGpLO+55p175+qaFnrP0TDEMvwhlVSjUPnMYwGBq4bclU1QVd56wGqgY/17i8
stLCe9zzTCKSx0u+IIGXzFHfHRXqu/iUFL5P3dUC8Bc63uuAs/CHRujuKJyAnFVa
KyoZvJL7h4PHoWUmmI6FP5DYgaF+ybmg13qa6C81Ybom0U9f2V5mwNiQDn8CORxi
CPvFY9m3aet1rcpzPVbR7wKjwvFBoj0Rpw9OVBOF0KQlfBjfIuh8b/z35vuwIlsU
bz/hDTZbB1wkMw9nDU7no4XDQE6pKcQcywfe9OtrKAXEbw1xCDsGY2Qkdk56pXeX
bcLNRrzg2uj07wO+FZK/Dtm7AyrgIqUwHyKgrgkwSJY3OGAw9OBUMEeHwWbAvNHX
pPjf2bRjxdHjwqaInPZhjD060RMhb3GwvNt9PZ/H1vpuqNBPzHgrzZsM3ooYyCsM
xqX0Zt3S5gs=
=33gu
—–END PGP SIGNATURE—–

Read More

The post ESB-2021.1840 – [SUSE] nginx: Multiple vulnerabilities appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/esb-2021-1840-suse-nginx-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1840-suse-nginx-multiple-vulnerabilities

Cybersecurity Canon – Rick Howard – PSW #696

Rick Howard joins to talk about his Cybersecurity Canon project, the rock and roll hall of fame for Cybersecurity literature! The Cybersecurity Canon Committee has announced it’s hall of winners for 2021.

Segment Resources:

https://icdt.osu.edu/cybercanon
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw696

The post Cybersecurity Canon – Rick Howard – PSW #696 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/cybersecurity-canon-rick-howard-psw-696-2/?utm_source=rss&utm_medium=rss&utm_campaign=cybersecurity-canon-rick-howard-psw-696-2

Cybersecurity Canon – Rick Howard – PSW #696

Rick Howard joins to talk about his Cybersecurity Canon project, the rock and roll hall of fame for Cybersecurity literature! The Cybersecurity Canon Committee has announced it’s hall of winners for 2021.

Segment Resources:

https://icdt.osu.edu/cybercanon
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw696

The post Cybersecurity Canon – Rick Howard – PSW #696 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/cybersecurity-canon-rick-howard-psw-696/?utm_source=rss&utm_medium=rss&utm_campaign=cybersecurity-canon-rick-howard-psw-696

Polarity’s Power-up Sessions, Add an Ability in 15 Minutes – Paul Battista – PSW #696

Training is critical but it is tough to break away from the day to day. Polarity is running free 15 minute training sessions that leverage our community edition to leave you with a new ability to automate search and save time. Examples include, how to write basic regular expressions, how to find exploit code faster, basics of cyberchef, or how to read a malware sandbox report.

Segment Resources:

Sign up page: https://polarity.io/ctt/
Past 15min session with GreyNoise: https://youtu.be/sEWQbRU4Duc
Teaser for future session on searching malware sandboxes: https://youtu.be/qo3GxeVSdGg
Teaser for future session on searching for exploit code: https://youtu.be/mGcA8_8dPfg
Teaser for future session on searching for YARA rules: https://youtu.be/Fx8d_fIeFy8

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw696

The post Polarity’s Power-up Sessions, Add an Ability in 15 Minutes – Paul Battista – PSW #696 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/28/polaritys-power-up-sessions-add-an-ability-in-15-minutes-paul-battista-psw-696/?utm_source=rss&utm_medium=rss&utm_campaign=polaritys-power-up-sessions-add-an-ability-in-15-minutes-paul-battista-psw-696