In a predicted future
Joined August 2007
- Tweets4K
- Following1.2K
- Followers653
- Likes1.8K
CMMC deadline is 16 December. All the resources, tools and expertise you need are right here at Trusted Internet.
There's a no-cost virtual workshop in two days, link below. Highly recommend it!
Remember: CMMC is now applicable to vendors selling to ALL Fed Gov. See below:
Check out our Blog: lnkd.in/gMQ-XHS4
Register for our Free Workshop: lnkd.in/gwNdHczN
cyAIber retweeted
🔴 CVE-2024-47575: FortiManager fgfmd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests (critical) / aka #FortiJump.
Vulnerability used in zero-day attacks 🔥
Reported malicious IPs:
- 45.32.41.202
- 104.238.141.143
- 158.247.199.37
- 45.32.63.2
[+] doublepulsar.com/burning-zer…
[+] fortiguard.com/psirt/FG-IR-2…
cyAIber retweeted
INTRODUCING: Agentic Security - LLM Security Scanner! 🔍
🔑 Features:
Scans for prompt injections, jailbreaking & more.
Provides detailed reports & options to customize attack rules.
🔗access the GitHub Link ↓
cyAIber retweeted
Ransomware attacks on the health care sector are rising and putting lives at risk, led by Iranian hackers, Microsoft said in a report Tuesday. scoopmedia.co/3YfcqHA
cyAIber retweeted
🧵Threat 1/ BREAKING: Windows Installer Sample Goes UNDETECTED!
IP Linked to #Cicada3301 & #Ransomware Infra 🚨
🚨 August 2024: Under the Radar!
In August, I discovered a new Windows Installer being tested with only 1 detection in VirusTotal 🛑.
By September? Zero detections, a stealthy installer lurking undetected 👀. This wasn’t just any sample...
💥Hash: 65103ed62bf26e5bab1b56756771bc129d2c6ff6a419cab858d29d0ff233bef2
💥File Name: 4c16a3.msi, Trend.msi
💥First Seen: 2024-09-19 00:44:21 UTC
💥Detection: 0/94 in VirusTotal
Earlier sample:
💥Hash: 2dc8e6c63948dd6c313ef14bf14f0fecabb8384a7a310b771e81d4cc776d2cc4
💥File Name: 697ed6.msi, TrendSizeLow.msi
💥First Seen: 2024-03-14 10:46:56 UTC
💥Detection: 1/62 in VirusTotal
Both connect to:
💥datasmetric[.]com (0/94 in VirusTotal)
💥hosted on 193.29.13.167 (13/94 in VirusTotal)....
These samples were flying under the radar and the connected IP has a series of interesting links 🚨.....
cyAIber retweeted
Today the United States Securities and Exchange Commission charged four companies for intentionally misleading investors about the severity of the SolarWinds breach.
In or around September 2019, APT29 a/k/a Cozy Bear a/k/a Turla Group compromised United States-based network monitoring company SolarWinds. The compromise resulted in one of the largest Supply-Chain attacks in history when the state-sponsored group began slipstreaming malicious payloads into the SolarWinds Orion toolset updates.
The United States Securities and Exchange Commission has issued the following fines:
- Unisys, an information technology service and consulting company : $4,000,000 fine
- Avaya, a company with provides cloud services and workplace collaboration services: $1,000,000 fine
- Check Point Software, a provider for hardware and software cyber security solutions: $995,000 fine
- Mimecast, a cloud-based email management company: $990,000 fine
cyAIber retweeted
BREAKING: Someone just hacked a voting machine within seconds live on PBD's podcast. He only used a preprogrammed USB stick that gave him total access to do whatever he wanted, including flipping or creating votes out of thin air
"If this would have been an election, I could have gone to the database and for example change the votes."
PBD: "How much of it could you have changed?"
"Anything, add new candidate who was not even on a ballot, it doesn't matter, because if you have total control over the system, you can do anything you want."
Via: @patrickbetdavid
This was such a wild moment. It's like when Professor J. Alex Halderman used a pen to hack a Dominion machine in front of a federal judge a few months ago. I pray for the day when we will finally ditch these machines and start hand-counting all our votes like a serious country.
And here we thought humans were better at machines in thinking outside of the box during a red team...
Fucking wild.
@OpenAI's new o1 model was tested with a Capture The Flag (CTF) cybersecurity challenge. But the Docker container containing the test was misconfigured, causing the CTF to crash. Instead of giving up, o1 decided to just hack the container to grab the flag inside.
This stuff will get scary soon.
cyAIber retweeted
The new publication from @DefSecSentinel explores the DPRK’s use of Python and social engineering for initial access. Check out the detailed breakdown here: go.es.io/3ZtSYsS
#ElasticSecurityLabs #DPRK #Python
Why is no one talking about how, if the comms supply chain was THAT compromised on so many levels, how that likely impacted the confidentiality and geo locations of Hezbollah just as much as this kinetic attack?
Probably more than just explosives put in those devices.
After 30 years of cyber, I can say that someday on my gravestone, I hope someone spray paints a groundhog.
cyAIber retweeted
Ransomware Operator Claims - Week 3 2024
dbdigest.com/2024/01/ransomw…
#databreach #databreaches #databreachesdigest #dataprivacy #GDPR #cybersec #cybersecurity #infosec #informationsecurity #cyberattack #hacked #malware #phishing #ransomware #ROCreport
cyAIber retweeted
Update: Over 1,700 Ivanti VPN appliances have been hit by zero-day attacks, including government, military, telecom, defense, tech, finance, consulting, aerospace, and engineering sectors.
Read: thehackernews.com/2024/01/na…
#infosec
cyAIber retweeted
Took some time to put the discussion from the thread below into a more coherent and digestible format.
TL;DR - If you're interested how UWP and Windows desktop apps (store and other) are able to start on startup of windows without touching the Run key or any typical persistence method.
Read More -> github.com/nasbench/Misc-Res…
I also took the time to write a quick PowerShell script to enumerate the TaskID / Executables / EntryPoint of these task based on information stored in their manifest.
Can be useful to potentially find potential rogue AppX packages that perhaps are making use of this in a malicious way for persisting on startup.
Small update :)
While the tangent we went on was good, I think I found the real culprit.
WindowsApps (Appx) have a special key to create startup tasks. Its in "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\[Package Name]"
Inside you'll find a key that contains a combination of the package name and one of the keywords start/task... but it'll contain the following values (see ss)
I tested the "phone app", "windows terminal" and the "xbox app" and they all enable startup execution like this :)
I guess this is a new finding :)
