Parse notes
ReversingLabs found over a dozen malicious npm packages mimicking the roblox.js gaming API wrapper. The packages drop Luna, an info stealer malware, into the code. This attack is a continuation of a campaign seen in 2021. It targets Roblox community developers and highlights npm supply chain risks.
The mass exploitation of MOVEit's Transfer software has rapidly cemented itself as the largest hack of the year so far. While the full impact of the attack will likely remain unknown for months to come, there are now more than 1,000 known victims of the MOVEit breach, according to cybersecurity company Emsisoft. This report looks into the MOVEit attack by the numbers.
Duolingo suffered a data breach when a public API endpoint leaked non-public profile information such as email addresses. The dataset was released on BreachForums for the equivalent of $2.13.
This blog post showcases how researchers at CyberArk used Static Code Analysis tools to find a Pre-Auth Remote DoS vulnerability (CVE-2023-0122) caused by a NULL Pointer Dereference in the NVMe driver of the Linux kernel.
This write-up explains how Facebook's Two-Factor Authentication was bypassed during Meta’s bug bounty Researchers conference in Seoul, South Korea, in 2023. The author was awarded $25,300 and ranked 2nd place on the conference Leaderboard.
An exploration of the different AWS mechanisms that an attacker that has gained privileged access to an AWS account can use to establish persistence. This is part three of a series - the previous two parts focus on escalating privileges on a compromised AWS account.
Cerby has received capital to secure non-standard applications. Research has found that 52% of organizations have experienced cybersecurity incidents caused by their inability to secure these kinds of applications. Applications are defined as nonstandard if they do not support common identity and security standards such as SAML and SCIM.
A blazing-fast, thread-safe, straightforward, and zero memory allocation tool for swiftly generating alternative IP(v4) address representations in Go.
Villain is a high-level C2 framework that can handle multiple TCP sockets and HoaxShell-based reverse shells. It features payload generation and file uploads. Villain was added to the Kali Linux repository in the most recent update.
This document is a comprehensive overview of modern cybersecurity. It discusses the various threats that exist in the digital realm, such as ransomware, phishing, and various forms of social engineering. It also explores the role of nation-states in cyber warfare and the importance of fortifying one's digital stronghold. The document emphasizes the ongoing nature of cybersecurity and the need for vigilance and continuous learning.
Researchers at Spin.AI assessed 300,000 Chromium browser extensions and found that 51% of all installed extensions were high risk and had the potential to cause extensive damage to the organizations using them. The extensions all had the ability to capture sensitive data from enterprise apps, run malicious JavaScript, and surreptitiously send protected data, including banking details and login credentials, to external parties.
An 18-year-old from Oxford has been found guilty of being a part of an international cyber-crime gang responsible for a hacking spree against major tech firms such as Uber, Nvidia, and Rockstar Games.
Meta has once again reaffirmed its plans to roll out support for end-to-end encryption by default for one-to-one chats on Messenger by the end of the year.
Microsoft’s digital keys have been hijacked to sign yet more malware for use by a previously unknown threat actor in a supply-chain attack that infected roughly 100 carefully selected victims.
Prime Trust is a crypto startup designed to help other startups provide crypto retirement funds. It had to file for bankruptcy after losing the password to a physical crypto wallet with $38.9 million in it.
AWS Systems Manager Session Manager (SSM) allows for IAM users to access EC2 instances. One common use case for this is port forwarding to other services such as RDS. The SSM-SessionManagerRunShell document may be implicitly granted to the user. This article details how to fix this.