Parse notes
A hacker going by the name IntelBroker claimed to have breached HPE. The hacker is selling an archive that allegedly contains certificates (private and public keys), Zerto and iLO source code, Docker builds, and old user personal information used for deliveries. HPE disabled relevant credentials but claimed that it had not discovered any evidence of a breach.
A hacking group called DoNot Team has been linked to a new Android malware named Tanzeem that targets specific individuals for intelligence collection. The malware masquerades as a chat app but actually collects sensitive data and establishes connections to a command-and-control server. Cyfirma notes that the group uses push notifications to deploy additional malware and ensure persistence on targeted devices for ongoing intelligence gathering.
A new phishing kit called Sneaky 2FA targets Microsoft 365 accounts using evasion tactics and a Telegram platform. The kit is offered as a service on Telegram and incorporates techniques to avoid detection, posing a significant threat to cybersecurity. Organizations are advised to monitor threats closely and enhance their security measures to combat this growing risk.
A group of researchers tested spear-phishing emails that were created by AI agents based on Claude 3.5 Sonnet and GPT-4o which crawled the Internet for information on the targets. The researchers achieved a click-through rate (CTR) of 54% with the AI agents compared to 12% in the control group. Human-crafted spear-phishing emails also achieved a 54% CTR but at 30x the cost of the AI-generated ones, whereas emails crafted with AI and human input achieved a CTR of 56% with 4x the cost.
AWS detected unauthorized encryption activities in Amazon S3 due to malicious actors with valid credentials. Customers can prevent such incidents by using short-term credentials, implementing data recovery procedures, and monitoring access patterns. AWS notes that blocking of use of SSE-C encryption can also enhance security against unauthorized access.
Michał Zalewski reverse-engineered a suspicious RJ45 dongle from China and revealed it was not malicious, but rather a device using a software-defined CD-ROM feature to install drivers. The device contained a chip that emulated a CD-ROM to simplify driver installation, dispelling concerns of potential malware. The investigation highlighted the importance of research and patience in understanding complex hardware systems.
An AWS IAM simulator that provides detailed explanations of how a policy was evaluated. It supports various IAM features like identity policies, resource policies, and more. The simulator automatically validates inputs and will soon include additional features like session policies and support for anonymous requests.
Roles is a tool written in Golang for testing unauthenticated AWS IAM role enumeration.
GitXRay is a security tool for GitHub repositories that uses public GitHub APIs for various purposes like OSINT and Forensics. It can detect sensitive information, identify threat actors, and find fake or infected repositories. Users can install and run GitXRay easily to enhance repository security and gather valuable insights.
Microsoft has released a fix for a bug that was causing Windows Server 2022 systems with two or more NUMA nodes to fail at startup. NUMA nodes are commonly used to optimize CPU and memory usage. Microsoft also announced that it is working on a fix for a Windows Server 2025 issue that is causing iSCSI environments to fail to boot.
This blog discusses a simulation of an attack by the Venomous Bear APT group that targeted countries like the USA and Germany from at least 2020. The attackers used a fake Microsoft Windows Time service to install a backdoor that allowed them to exfiltrate files and communicate with a command and control server. The simulation includes stages for installing the backdoor using a .bat file, developing the backdoor DLL, and creating a listener script for receiving commands from the backdoor.
In this blog post, the Google security team describes their security approach, which involves automated threat detection with a focus on minimizing dwell time. Collaboration and building an asset inventory are key strategies to enhance threat detection capabilities. Security engineering is essential, and Google emphasizes writing code for effective threat response.
Lina Khan's FTC banned General Motors from sharing car owners' personal data for five years even if consumers gave consent.
Microsoft has shared a script to revert to an older version of Outlook that was crashing when writing emails.
While passkeys aren't perfect, a coalition of government and private efforts is making them better.