Inteligência de ameaças

CloudSEK Threat A Intel detectou um agente de ameaças vendendo uma lista de sistemas na Internet que são vulneráveis ao CVE-2018-13379, que é uma vulnerabilidade de travessia de caminhos VPN SSL da Fortinet.

Consultoria de inteligência de ameaças da CloudSEK sobre o ransomware Conti: operado por humanos e possível sucessor do Ryuk, com recursos avançados.

Consultoria de inteligência de ameaças da CloudSEK sobre UNC1945, grupo de hackers que utiliza a falha crítica CVE-2020-14871 para comprometer redes corporativas

CloudSEK’s Threat Research team has analyzed the MS Office RCE 0day vulnerability that has been dubbed as Follina and has been given the CVE-2022-30190. The attack vector and the vulnerability very closely resembles CVE-2021-40444.

Andrastea threat actor group announced a data breach from MBDA, a European missile manufacturer having ties to NATO. Military sketches, documents underlying NATO’s requirements, and SOPs were exposed.

Gitpaste-12 is a wormable malware which has the ability to form a network of bots for crypto-mining which is now targeting Multiple Known Vulnerabilities.

CloudSEK researchers reveal the names of users who dumped the data and the timestamps of the files that confirms the data is old.

Upgraded version of Generaly OTP bot advertised on a cybercrime forum. The bot has a dedicated Telegram channel to capture & display information. Captured OTP can be used to bypass 2FA and gain complete access to bank accounts.