Parse notes
StopCrypt is an incredibly prolific ransomware that targets individuals with smaller ransomware payments as opposed to targeting businesses for larger payments. A newer variant has been found that uses advanced techniques like dynamically constructed API calls and process hollowing to evade detection.
More than 70 million records from an unspecified division of AT&T were leaked on the Breached hacking forum. The legitimacy of the stolen data has been verified, though its source remains uncertain, possibly linked to a third-party organization.
Researchers have identified a new data leakage vulnerability called GhostRace which affects modern CPUs that support speculative execution. This vulnerability allows attackers to extract data from the processor through speculative executable code paths, posing a significant security risk.
This article is about the risks of insider threats in open-source projects that use GitHub Actions. Users with write access to a repository can push and immediately delete malicious Git tags. This vulnerability can be mitigated by enabling Tag protection so that these commits don’t trigger malicious actions.
Obsidian can be used for performing live correlations and statistics at scale using private Cyber Threat Intelligence datasets. Due to the local nature of Obsidian, this setup can provide privacy and security. Additional features like plugins can help extend the tool with features like diagrams, mind maps, statistics, and charts.
Sponsored
Organizations are inundated with alerts and potential vulnerabilities, making it crucial to sift through the noise and prioritize responses efficiently.
DNS-Tunnel-Keylogger is a tool for lightweight exfiltration and persistence, with properties that prevent detection. It uses DNS tunneling/exfiltration to bypass firewalls and avoid detection.
GitDoorCheck is a static analyzer for GitHub repositories powered by OpenAI-compatible LLMs. The tool uses GPT-4 or other compatible LLMs to scan repositories for backdoors and output the results as a JSON. It can be added to CI/CD pipelines.
Indicator of Canary is a collection of PoCs gathered from research on identifying canaries in various file formats.
Android malware targeting the elderly was sent out as fabricated wedding invitations. The victims, believing the APK to contain more details about a free wedding, installed the malware and ended up having their SMS data stolen. The malware used a Telegram bot as its command and control server.
As the publishers of CVEs, the NVD is a core part of many security systems. The NVD recently posted an announcement that it is establishing a consortium to address challenges within the organization. This has led to 90% of proposed CVEs going unassigned and the association of CPEs, CVSS, and CWEs to CVEs to be severely halted. This author proposes a few alternatives to the NVD.
Researchers from Augusta University have developed a new acoustic side-channel attack that can deduce user input based on typing patterns. The attack leverages the distinctive sound emissions of different keystrokes and users' typing patterns. The method can reach a typing prediction accuracy of 43% on average, even in poor conditions such as environments with noise, and does not require controlled recording conditions.
The NSA has released a collection of ten guides for improving Cloud Security posture.
The US Department of Justice is recovering $2.3 million in cryptocurrency from a "pig butchering" fraud scheme that targeted at least 37 people across the United States.
The International Monetary Fund (IMF) disclosed a cyber incident detected in February after unknown attackers breached 11 IMF email accounts hosted on Microsoft's Office 365 platform.