Everything We Learned From the LAPSUS$ Attacks

Everything We Learned From the LAPSUS$ Attacks,

In recent months, a cybercriminal gang known as LAPSUS$ has claimed responsibility for a number of high-profile attacks against technology companies, including:

T-Mobile (April 23, 2022)
Globant 
Okta
Ubisoft
Samsung
Nvidia
Microsoft
Vodafone

In addition to these attacks, LAPSUS$ was also able to successfully launch a ransomware attack against the Brazilian Ministry of Health.
While

,

In recent months, a cybercriminal gang known as LAPSUS$ has claimed responsibility for a number of high-profile attacks against technology companies, including:

T-Mobile (April 23, 2022)
Globant 
Okta
Ubisoft
Samsung
Nvidia
Microsoft
Vodafone

In addition to these attacks, LAPSUS$ was also able to successfully launch a ransomware attack against the Brazilian Ministry of Health.
While

, ,
https://thehackernews.com/2022/05/everything-we-learned-from-lapsus.html

Government Agencies Warn of Increase in Cyberattacks Targeting MSPs

Government Agencies Warn of Increase in Cyberattacks Targeting MSPs,

Multiple cybersecurity authorities from Australia, Canada, New Zealand, the U.K., and the U.S. on Wednesday released a joint advisory warning of threats targeting managed service providers (MSPs) and their customers.
Key among the recommendations include identifying and disabling accounts that are no longer in use, enforcing multi-factor authentication (MFA) on MSP accounts that access customer

,

Multiple cybersecurity authorities from Australia, Canada, New Zealand, the U.K., and the U.S. on Wednesday released a joint advisory warning of threats targeting managed service providers (MSPs) and their customers.
Key among the recommendations include identifying and disabling accounts that are no longer in use, enforcing multi-factor authentication (MFA) on MSP accounts that access customer

, ,
https://thehackernews.com/2022/05/government-agencies-warned-of-increase.html

Hackers Deploy IceApple Exploitation Framework on Hacked MS Exchange Servers

Hackers Deploy IceApple Exploitation Framework on Hacked MS Exchange Servers,

Researchers have detailed a previously undocumented .NET-based post-exploitation framework called IceApple that has been deployed on Microsoft Exchange server instances to facilitate reconnaissance and data exfiltration.
« Suspected to be the work of a state-nexus adversary, IceApple remains under active development, with 18 modules observed in use across a number of enterprise environments, as

,

Researchers have detailed a previously undocumented .NET-based post-exploitation framework called IceApple that has been deployed on Microsoft Exchange server instances to facilitate reconnaissance and data exfiltration.
« Suspected to be the work of a state-nexus adversary, IceApple remains under active development, with 18 modules observed in use across a number of enterprise environments, as

, ,
https://thehackernews.com/2022/05/hackers-deploy-iceapple-exploitation.html

L’anti-malware de Gmail, bientôt activé dans Docs, Sheets et Slides

L’anti-malware de Gmail, bientôt activé dans Docs, Sheets et Slides,

Avec l’augmentation du télétravail, les pirates ont multiplié les scénarios d’attaque fondés sur les documents partagés. Une tendance que Google veut étouffer dans l’œuf.

,

Avec l’augmentation du télétravail, les pirates ont multiplié les scénarios d’attaque fondés sur les documents partagés. Une tendance que Google veut étouffer dans l’œuf.

, ,
https://www.01net.com/actualites/l-anti-malware-de-gmail-bientot-active-dans-docs-sheets-et-slides-2056216.html

Piratage Viasat : l’Union européenne et ses alliés pointent la Russie du doigt

Piratage Viasat : l’Union européenne et ses alliés pointent la Russie du doigt,

Les alliés occidentaux se sont appuyés sur des données de renseignement pour déterminer l’origine de l’attaque qui a mis en berne des dizaines de milliers de terminaux satellitaires en Europe.

,

Les alliés occidentaux se sont appuyés sur des données de renseignement pour déterminer l’origine de l’attaque qui a mis en berne des dizaines de milliers de terminaux satellitaires en Europe.

, ,
https://www.01net.com/actualites/piratage-viasat-l-union-europeenne-et-ses-allies-pointent-la-russie-du-doigt-2056211.html

CISA Urges Organizations to Patch Actively Exploited F5 BIG-IP Vulnerability

CISA Urges Organizations to Patch Actively Exploited F5 BIG-IP Vulnerability,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the recently disclosed F5 BIG-IP flaw to its Known Exploited Vulnerabilities Catalog following reports of active abuse in the wild.
The flaw, assigned the identifier CVE-2022-1388 (CVSS score: 9.8), concerns a critical bug in the BIG-IP iControl REST endpoint that provides an unauthenticated adversary with a method to

,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the recently disclosed F5 BIG-IP flaw to its Known Exploited Vulnerabilities Catalog following reports of active abuse in the wild.
The flaw, assigned the identifier CVE-2022-1388 (CVSS score: 9.8), concerns a critical bug in the BIG-IP iControl REST endpoint that provides an unauthenticated adversary with a method to

, ,
https://thehackernews.com/2022/05/cisa-urges-organizations-to-patch.html

Bitter APT Hackers Add Bangladesh to Their List of Targets in South Asia

Bitter APT Hackers Add Bangladesh to Their List of Targets in South Asia,

An espionage-focused threat actor known for targeting China, Pakistan, and Saudi Arabia has expanded to set its sights on Bangladeshi government organizations as part of an ongoing campaign that commenced in August 2021.
Cybersecurity firm Cisco Talos attributed the activity with moderate confidence to a hacking group dubbed the Bitter APT based on overlaps in the command-and-control (C2)

,

An espionage-focused threat actor known for targeting China, Pakistan, and Saudi Arabia has expanded to set its sights on Bangladeshi government organizations as part of an ongoing campaign that commenced in August 2021.
Cybersecurity firm Cisco Talos attributed the activity with moderate confidence to a hacking group dubbed the Bitter APT based on overlaps in the command-and-control (C2)

, ,
https://thehackernews.com/2022/05/bitter-apt-hackers-add-bangladesh-to.html

Ces hackers découpent et cachent leurs malwares… dans les logs de Windows

Ces hackers découpent et cachent leurs malwares… dans les logs de Windows,

Pour rester sous les radars, des pirates découpent leur code malveillant en petits bouts de 8 ko et les éparpillent dans les logs Windows de la machine infectée. C’est la première fois qu’une telle technique est observée.

,

Pour rester sous les radars, des pirates découpent leur code malveillant en petits bouts de 8 ko et les éparpillent dans les logs Windows de la machine infectée. C’est la première fois qu’une telle technique est observée.

, ,
https://www.01net.com/actualites/les-malwares-peuvent-aussi-se-planquer-dans-les-logs-de-windows-2056195.html

Researchers Warn of Nerbian RAT Targeting Entities in Italy, Spain, and the U.K

Researchers Warn of Nerbian RAT Targeting Entities in Italy, Spain, and the U.K,

A previously undocumented remote access trojan (RAT) written in the Go programming language has been spotted disproportionately targeting entities in Italy, Spain, and the U.K.
Called Nerbian RAT by enterprise security firm Proofpoint, the novel malware leverages COVID-19-themed lures to propagate as part of a low volume email-borne phishing campaign that started on April 26, 2022.
« The newly

,

A previously undocumented remote access trojan (RAT) written in the Go programming language has been spotted disproportionately targeting entities in Italy, Spain, and the U.K.
Called Nerbian RAT by enterprise security firm Proofpoint, the novel malware leverages COVID-19-themed lures to propagate as part of a low volume email-borne phishing campaign that started on April 26, 2022.
« The newly

, ,
https://thehackernews.com/2022/05/researchers-warn-of-nerbian-rat.html

Malicious NPM Packages Target German Companies in Supply Chain Attack

Malicious NPM Packages Target German Companies in Supply Chain Attack,

Cybersecurity researchers have discovered a number of malicious packages in the NPM registry specifically targeting a number of prominent companies based in Germany to carry out supply chain attacks.
« Compared with most malware found in the NPM repository, this payload seems particularly dangerous: a highly-sophisticated, obfuscated piece of malware that acts as a backdoor and allows the

,

Cybersecurity researchers have discovered a number of malicious packages in the NPM registry specifically targeting a number of prominent companies based in Germany to carry out supply chain attacks.
« Compared with most malware found in the NPM repository, this payload seems particularly dangerous: a highly-sophisticated, obfuscated piece of malware that acts as a backdoor and allows the

, ,
https://thehackernews.com/2022/05/malicious-npm-packages-target-german.html