Parse notes
CloudNordic, a large Danish cloud provider, has suffered a ransomware attack that encrypted all customer data. The company cannot and will not meet the ransom demands and advises customers to consider their data lost. CloudNordic doesn’t believe that any data was accessed by the attackers.
Cloud credentials stealing campaigns continue to grow. Cloud service credentials are increasingly targeted because teams are finding more ways to profit from them. One actor has expanded its tooling from AWS to target Azure and Google Cloud Platform. This report dives into how the tooling interacts with the cloud providers and what is new with the latest version.
Secureworks researchers witnessed the Smoke Loader botnet dropping a custom Wi-Fi scanning executable to infected systems. The researchers named the malware ‘Whiffy Recon’. It triangulates infected systems' positions using nearby Wi-Fi access points and Google's geolocation API.
Snowflake's popularity makes it an attractive target, requiring vigilance against emerging threats. This post explores using built-in logging to enhance security operations. It covers ten threat scenarios, relevant exposed data, and a script for quick threat hunting.
BitLocker's protection depends on its configuration, so with a discrete Trusted Platform Module and no password, the BitLocker decryption gets bound to the hardware. This article navigates through how to use physical hacking to obtain the decryption key and hack into a BitLocker-protected computer.
This X thread shares strategies for finding Server Side Request Forgery (SSRF) attacks for bug bounties. These include trying different URL schemes, stealing NT LAN Manager hashes with Responder, trying alternative representations of IP addresses, and searching for references to Kubernetes and hitting its API. The author of the thread suggests being aware of a target's technologies and using open redirects to find SSRF vulnerabilities.
Google Workspace has announced 11 new defensive controls to protect against social engineering attacks. Multi-party approval will require sensitive enterprise actions to be approved by a separate admin than the one that initiated the change. Other features include DLP, AI, and logging support.
The Infection Monkey is an open source security tool for testing a data center's resiliency to perimeter breaches and internal server infection. It uses various methods to self propagate across a data center and reports success to a centralized Monkey Island server.
IAMbic is designed to be a version control system for IAM systems. IAMbic monitors IAM sources for any changes and makes a commit to a git repository containing the details of the change. At present, AWS, Azure AD, Google Workspace, and Okta are supported.
Bots can solve captchas nearly instantly and with high accuracy. In a recent study, humans solved captchas with a 50-84% accuracy, taking between 9-15 seconds, while bots had an accuracy rate of 85-100% and solved captchas in less than a second.
US prosecutors have charged two of the developers of the crypto mixer, Tornado Cash, with money laundering. The prosecutors allege that Roman Semenov and Roman Storm facilitated the anonymization of hacked funds on the platform while knowing that the funds were stolen.
The FBI has warned that the patches Barracuda recently released for an Email Security Gateway (ESG) vulnerability were not effective and that the flaw is still being targeted in the wild. It is advising organizations to remove all affected ESG appliances immediately and scan their networks for abnormal activity.
This blog post describes an instance where 40% of their users directly copied an example domain from their documentation when setting up custom DNS zones as well as other places where examples were given in documentation. This can lead to more easily identifiable canaries. The post concludes with lessons learned about the dangers of defaults and examples.
The FBI published 6 cryptocurrency wallets linked to North Korean hackers, holding ~$40M+ in likely stolen funds. The cryptocurrency was stolen by the Democratic People’s Republic of Korea's TraderTraitor-affiliated actors (also known as the Lazarus Group and APT38).
Microsoft has discovered a Chinese government-backed APT actor called Flax Typhoon that targets Taiwanese organizations with minimal malware use and stealthily persists by exploiting legitimate software tools. Flax Typhoon uses known vulnerabilities in public-facing servers and legitimate tools built into the Windows operating system to quietly remain in these networks, making it challenging to detect and mitigate the attack.