Paweł Maziarz

🚨Threat Campaign Alert - UAC-0099 Targets Ukrainian Government with Espionage Campaign Using WinRAR Exploit (CVE-2023-38831) and LONEPAGE Malware🚨 Summary: The UAC-0099 threat group has targeted Ukrainian government organizations with phishing emails exploiting WinRAR vulnerability (CVE-2023-38831) and deploying LONEPAGE malware for espionage. Attackers adapted their tactics, using encrypted files and .NET programs to execute PowerShell payloads. Threat Actor/Threat Group: UAC-0099 Malware: LONEPAGE Targeted Countries: Ukraine Targeted Industries: Government,forestry, forensic examination institutions, factories Targeted Applications/CVE: WinRAR vulnerability CVE-2023-38831 Impact: Espionage, data breach, device compromise IOC: Ip Addr and Domain 45[.]61.157.118, newyorktlimes[.]life, webappapiservice[.]life, 160[.]119.251.83, 172[.]86.117.53, captcha-challenge[.]com, URL's hXXps://captcha-challenge[.]com/message/getsecretnumber, hXXps://captcha-challenge[.]com/message/[0-9]{20}/message[0-9]+/, hXXps://captcha-challenge[.]com/message/message[0-9]+, hXXps://newyorktlimes[.]life/api/values/uid, SHA-256 6161be2016a1fd8096b6b43544eb5df97cd3fa73a820b5e0a44618389897d733, 16f809cd9fb1a06f07bb947ea8b6a27f66cfca0947e29666c34ae7b35b6e471b, d4eafc11cd0e4fe417c59db804ca6e8bd8bf9c0d0886627f15165937fcb68395, eb08f96acba2b316408f66ef0c4f45a42eb207e43c605476405324726e97f9e3, 7a0ae128961a6239a2e10059305bb83fa64251bb3f0b44162ec6efdde10fd1e8, 5441cb26f32a433b0abd80dfa98a3a30c78df00ca9d2a0cfc5b20c55f3aaadce, 025b9bdd156b59b18ab08921572501b6386ae45e8c0c0440855a719ae4b4c24a, fbc4fbb3c2926300ee820ff7044f35231c2a1aeeb74d1f49a6caaec7736739c6, 88b64a3eb0dc38e3f8288b977b1cd67af7d4ba959297ac48ef5f06bec3e77560, 8cc89a917ed89a8407aa1e5caa4af585f26946124cf1764e3b178261a27177af, fa331a275d2f966f42a6168f1cb6fdb919d272b32175985c8bf383f2d800ced2, 0af76e87614126042a2c3409d273d606a4562f99cb9f003a9f9ec0596213a35a, 0aaee2882e4a71b25de5722d8936c67d40355e2f79caf994c8e10164468d3272, 0b16ee402ad04a673d61af43f461d475d1e3fcbdaf8714a1183ac35056bbae25, 53f4e38d56946a385a681c66d891d3d70c2b2fee1691ff7e7af317955e0d8b88, 322de3a4e1d356a7db22d6447807bd7576f91ed1910a57d9e8eb6f678ceb6ab4, 4a42bfc95772e2f6ae58ccb37fe74b5e810f6c2973ec7a70e09884e1fe97e794, Mitre ttp: T1193 (Spearphishing Attachment),T1203 (Exploitation for Client Execution),T1059.001 (PowerShell),T1027 (Obfuscated Files or Information),T1573 (Encrypted Channel) Reference: This writing is based on Research Advisory Report published by ‘CERT UA' Team. ------------------------------------------------------------------------------------------ 🚀Join us on our mission to secure the digital world and make cyber defense affordable to everyone! 🌐 Follow "CyberXTron Technologies" for the timely, relevant and actionable cyber threat insights.  Espionage #UAC0099 #LONEPAGE #WinRARExploit #CVE_2023_38831 #CyberAttack #ThreatIntelligence #cyberXTron #uncovertheunknown🛡️🔒

6

Malware Targets Polish Small Businesses In May 2024, hackers hit Polish small and medium-sized companies with smart phishing scams. These attacks put dangerous software like Agent Tesla, Formbook, and Remcos RAT on their systems. The threat spread beyond Poland affecting businesses in Italy and Romania too. This showed how exposed small companies are when they don't have strong cyber defenses. Cybersecurity company ESET has found that the attackers used hacked email accounts and company servers to send harmful emails and gather stolen data. They used DBatLoader, a complex malware loader, to deliver their payloads. This method shows a change from earlier tactics and proves cyber threats have become more advanced. Phishing emails had attachments with malware that when opened, started a multi-step process to install the trojan. The increasing danger to SMBs is worrying, as these companies often fall victim to their weaker cybersecurity defenses. Kaspersky cautions that trojans, which can look like real software create a big risk by getting past normal security measures. To guard against these changing threats small and medium-sized businesses should make email filtering, regular software updates, and thorough phishing awareness training their top priorities. Investing into cutting-edge threat detection tools is also key to spot and stop threats. The latest wave of phishing attacks shows why businesses need to take steps to protect themselves before problems arise. How is your company improving its defenses to handle these kinds of threats? Let us know your plans and thoughts in the comments section. #Phishing #SMBSecurity #Malware #CyberThreats #CyberSecurity

1

Yesterday’s Apocalypse? We are ready to support you. We have already solved Customers issues related to yesterday’s Microsoft / Crowdstrike bug. Currently there is only a manual procedure to adopt. If you need support, please call us. #Microsoft #Crowdstrike #bug #cybersecurity

8

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields. https://lnkd.in/djYk2ZVR #infosec #cybersecurity #pentest #pentesting #hacking #hackers #opensource

3

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields. https://lnkd.in/djYk2ZVR #infosec #cybersecurity #pentest #pentesting #hacking #hackers #opensource

1

Hello Linkedin community!🌐 Cyberthint's April 2024 #ransomware report has been published! At Cyberthint, we closely monitor the activities of ransomware groups and shed light on the latest statistics every month. 📊🔍 In the meantime, some snaps from the report: - #Lockbit victim French hospital "CHC-SV" rejects ransom payment requests - Omni Hotels Hit by Ransomware Attack - Japanese Optical Giant #Hoya Hit by Ransomware Attack In this report you will also find the necessary information to protect your digital assets. 💡🔒 👉 https://lnkd.in/gG2mfZ_c Join us to unravel the complexities of the cyber realm and stay informed. Follow us to stay one step ahead of the game and learn strategies to keep you safe. 💪 Becasuse, we know what information #hackers have on you! #CyberSecurity #ThreatIntelligence #CTI #InformationSecurity

21

This time we focused on USB Forensics - inside you will find three excellent articles on the topic. https://lnkd.in/djYk2ZVR #infosec #cybersecurity #pentest #pentesting #hacking #hackers #opensource

1

📢 New Draft Guidance for NIS2 Compliance Released by ENISA & European Commission The European Union Agency for Cybersecurity (ENISA) and the European Commission have issued draft technical guidance to help EU Member States, DNS providers, TLD registries, cloud providers, data centers, CDNs, managed services, online platforms, and more to align with the #NIS2 cybersecurity requirements, following the latest Commission Implementing Regulation (EU) 2024/2690. What’s inside: 📌Practical Insights: Clear advice on interpreting technical requirements and navigating NIS2 concepts. 📌Compliance Evidence: Examples of documentation that can support compliance. 📌Standards Alignment: Tables matching NIS2 requirements with EU, international, and national standards for easier compliance. You’re invited to contribute with your feedback on this draft by December 9 2024. #Cybersecurity #ENISA #infosec

14

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields. https://lnkd.in/diQr87b6 #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

🚨 Security Advisory: Important CVEs Disclosed 🚨 Hi Envoy Community, We would like to inform you about the following Common Vulnerabilities and Exposures (CVEs) identified in Envoy: 🔒 CVE-2024-45807: oghttp2 crash on OnBeginHeadersForStream 🔒 CVE-2024-45808: Malicious log injection via access logs 🔒 CVE-2024-45806: Potential manipulation of x-envoy headers from external sources 🔒 CVE-2024-45809: JWT filter crash in the clear route cache with remote JWKs 🔒 CVE-2024-45810: Envoy crashes for LocalReply in HTTP async client 🔧 Resolutions Coming Soon: These issues will be addressed in the following Envoy releases: - v1.31.2 - v1.30.6 - v1.29.9 - v1.28.7 🔗 Release Information: The updates will be available on our Releases Page starting today. 📖 Documentation: For detailed guidance, please refer to our Envoy Documentation. 🔄 Upgrade Recommendation: We strongly encourage all users to update to the latest versions of Envoy to ensure security and stability. 🔍 Ongoing Improvements: A pull request addressing these vulnerabilities has been initiated on the main branch. Thank you for your attention and continued support. ♻ REPOST this to help other Envoy users stay on top of Envoy News. #EnvoyProxy #Kubernetes #Security #CVE #DevOps #CloudNative #OpenSource #CyberSecurity

6

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields https://lnkd.in/diQr87b6 #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

Windows PHP server owners patch now - PHP ADDRESSED CRITICAL RCE FLAW POTENTIALLY IMPACTING MILLIONS OF SERVERS Researchers at cybersecurity firm DEVCORE discovered a critical remote code execution (RCE) vulnerability, tracked as CVE-2024-4577, in the PHP programming language. An unauthenticated attacker can exploit the flaw to take full control of affected servers. https://lnkd.in/gq3VMaQp (Thanks Critical Insight for the reminder)

13

5 Comments

Lights, camera, Pen Test! This cybersecurity awareness month, Maciej Markiewicz demystifies Penetration Testing and explains why it is a must-have in your cybersecurity arsenal! 🔒 📁 #cybersecurityawarenessmonth #pentesting #cybersecurity #penetrationtesting

28

1 Comment

This time we gathered some of our best articles and tutorials about programming and exploitation. https://lnkd.in/d-X3cwwS #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

2