Parse notes
MongoDB reported that its corporate systems were breached in a cyberattack, resulting in the exposure of customer data. The breach was detected by the company on December 13th and investigations are underway. MongoDB believes that customer data stored in MongoDB Atlas was not accessed, but the attackers had unauthorized access to its systems for some time before being discovered.
Russian-backed hackers have been exploiting a critical vulnerability in JetBrains’ TeamCity servers since September, infiltrating the servers via authorization bypass and arbitrary code execution. The threat actor, CozyBear, has affected more than 30,000 JetBrains customers, compromising dozens of companies and more than a hundred devices in the United States, Europe, Asia, and Australia. JetBrains recommends updating on-premises servers to version 2023.05.4 or later to prevent exploitation.
A new botnet called KV-botnet is targeting firewalls and routers from Cisco, DrayTek, Fortinet, and NETGEAR for covert data transfer by advanced persistent threat actors, including the China-linked threat actor Volt Typhoon. The botnet consists of two activity clusters, KY and JDY, which work together to access high-profile victims and establish covert infrastructure.
A group of researchers have developed a tool called Fuzzomatic that automatically fuzzes Rust projects using AI. The tool attempts to find sample usage to generate a fuzz target by checking the project’s README, any source files under an examples directory, unit tests, benchmarks, or public functions in the project. The researchers tested their tool on 37 of the top 50 starred GitHub projects written in Rust and found new bugs in 14 of them.
This post shares a dataset of Cobalt Strike Beacon payloads and their extracted configurations going back to November 2021. Analysis of the dataset shows that 88.97% of payloads leverage the CreateThread API call for process injection. Nearly 62.81% of the samples in the dataset have the default sleep time of 60,000 milliseconds.
Microsoft has created a downloadable guide called "Navigating the Maze of Incident Response" that focuses on the key factors of people and process in effective incident response. The guide helps organizations structure their incident response teams and define roles and responsibilities, including the need for non-technical support from leadership and other parts of the business.
Sponsored
Join cybersecurity experts in this live webinar as they uncover how
to prioritize threats and shape strategies for risk acceptance. Throughout the webinar, they will discuss how to use Vulnerability Threat Intelligence to gauge the true impact of vulnerabilities, shift from patch prioritization to an informed strategy, and preemptively tackle zero-day vulnerabilities and other imminent cyber threats.
SessionProbe is a multi-threaded tool to check which URLs from a list of URLs that a session token can access. The tool is designed to be used with Burp Suite.
A Python script to analyze CloudTrail data of a given AWS account and generate a summary of recently active IAM principals, API calls they made, and regions that they were active in. The summary is written to a JSON file and can be optionally visualized as a PNG file.
Kunai is a Rust-based threat-hunting project that aims to bring various monitoring tasks, ranging from security monitoring to Threat Hunting, to Linux-based systems.
Most modern Smart TVs are sold with Automatic Content Recognition enabled by default. This technology is used to collect data on everything you view and store it in a proprietary database for ad targeting. This article contains steps to disable Automatic Content Recognition on Roku, Samsung, and LG Smart TVs.
This article discusses what to do after receiving an unprompted MFA OTP code. Assume that the credentials for the site have been compromised and reset passwords for affected sites. Do not click any links in such messages and go directly to the site's URL.
The Cybersecurity and Infrastructure Security Agency (CISA) has released the draft Secure Cloud Business Applications (SCuBA) Google Workspace (GWS) Secure Configuration Baselines for public comment. The draft baselines provide minimum viable security configurations for various GWS services. CISA is encouraging federal agencies and other organizations to adopt these baselines, tailored to their needs, and provide feedback.
KrebsOnSecurity first reported on a data breach affecting Target perpetrated by a cybercriminal known as Rescator in 2013. This retrospective details the research that KrebsOnSecurity has compiled over the past 10 years on uncovering the identity of Rescator.
AWS Service Control Policies have strict character limits that include whitespace. However, Terraform does not automatically minimize whitespace, which could lead to character count issues.
China's Ministry of Industry and Information Technology (MIIT) has introduced a color-coded action plan to address data security incidents in the country.