Parse notes
HP Enterprise reported to the SEC that its cloud-based email system was breached and emails belonging to employees were accessed. The attackers are believed to be Russia’s Cozy Bear/Midnight Blizzard, which was also responsible for the recent Microsoft breach. HPE is still investigating the scope of the breach but reported that no operations were interrupted.
A massive data leak, known as the Mother of all Breaches (MOAB), has exposed over 26 billion records from numerous previous breaches. It has data from platforms like LinkedIn, Twitter, Weibo, and Tencent. The leaked dataset contains a staggering 12 terabytes of information and is likely the largest ever discovered. While it mainly consists of information from past data breaches, it is believed to also contain new data that has not been published before.
A financially motivated threat actor is targeting Mexican banks and cryptocurrency trading entities with a modified version of the AllaKore RAT. The RAT payload allows the threat actors to send stolen banking credentials and authentication information to a command-and-control server for financial fraud. Based on the large number of Mexico Starlink IPs used in the campaign and the addition of Spanish-language instructions to the modified RAT payload, the threat actor is believed to be based in Latin America.
Orca has discovered a new vulnerability, dubbed Sys:All, which impacts an estimated 250,000 GKE clusters. Orca researchers said that the vulnerability stems from a misunderstanding whereby users believe that the system:authenticated group in GKE includes only verified and deterministic identities as opposed to any Google authenticated account. This means that any Google user can obtain an OAuth bearer token and utilize it to authenticate to the GKE cluster and obtain any overly permissive permissions granted to the system:authenticated group.
Microsoft has released more information about the nation-state attack on its corporate infrastructure as well as guidance on how to respond to such attacks. The threat actor employed techniques such as password spray attacks, malicious use of OAuth applications, collection via Exchange Web Services, and the use of residential proxy infrastructure to obfuscate their activity. Microsoft also offers detection and hunting guidance for identifying similar attack tactics and techniques.
Arctic Wolf Labs has discovered a new loader called "CherryLoader" that is written in Go and has been used in recent intrusions. This loader allows threat actors to swap exploits without recompiling code. Arctic Wolf has provided technical analysis and indicators of compromise related to CherryLoader.
Galah is an LLM-powered web honeypot that is able to mimic various applications and respond to HTTP requests. It is compatible with OpenAI and utilizes a cache to reduce API costs.
pfuzz is a web fuzzer that outputs requests to stdout in the httpipe format instead of sending them. It is inspired by tools such as ffuf.
SSH-Snake is a tool designed to perform automatic network traversal using SSH private keys found on a system. SSH-Snake is self-replicating, self-propagating, and fileless. The repository links to a blog post that provides further details on how the tool works.
France’s privacy watchdog CNIL has fined Amazon €32 million due to invasive employee surveillance that it argues violates GDPR. Amazon utilizes its barcode scanning system to track interruptions of as little as one minute and requires employees to justify any breaks. Amazon says that it may appeal the ruling.
The Blackwood hacking group has been using advanced malware called NSPX30 to conduct cyberespionage attacks against companies and individuals since at least 2018. The group's activities align with Chinese state interests. Its targets are located in China, Japan, and the United Kingdom. Blackwood has been delivering the malware through the update mechanisms of legitimate software, including WPS Office, Tencent QQ, and Sogou Pinyin.
A recent robocall in New Hampshire marks the first instance of AI-generated audio disinformation targeting American voters. The proliferation of AI systems and the relative ease with which a person can be mimicked using deepfake technology means that the New Hampshire robocall is probably indicative of what is to come over the course of the 2024 election.
Two malicious npm modules, warbeast2000 and kodiak2k, were found to have garnered over 1500 downloads on npm before being removed. The malicious packages ran a post-install script that searched for SSH keys and then uploaded them to a GitHub repository.
This website tracks cybersecurity incidents reported in an entity’s 8-K. Users can subscribe for alerts.
The SEC confirmed that the recent X hack was the result of a "SIM swap" attack - scammers tricked cellphone provider staff into giving them control of the account’s registered phone number.