yaracroft @venom@nanao.cybtex.fr

Poisoned proxy PACs - The #NPM package with a network-wide security hole #vuln

https://nakedsecurity.sophos.com/2021/09/06/poisoned-proxy-pacs-the-npm-package-with-a-network-wide-security-hole/

Gardaí have seized cyber infrastructure used by the gang involved in the HSE #cyber attack earlier this year #ransomware

https://www.irishtimes.com/news/crime-and-law/gardaí-seize-infrastructure-from-hse-cyber-attack-gang-1.4665454

(CVE-2021-26084) X-Confluence-Request-Time #vuln #informatique

https://censys.io/blog/cve-2021-26084-confluenza/

La NSA sélectionne Hewlett Packard Enterprise (HPE) pour traiter ses gros volumes de données (#bigdata) #usa #cyber #surveillance #renseignement

https://www.fedscoop.com/nsa-awards-2b-greenlake-contract-to-hewlett-packard-enterprise/

Burp Suite RCE #vuln #informatique

http://noahblog.360.cn/burp-suite-rce/

The company Autodesk confirmed that it was hit by the same #malware as the large-scale #cyber scam that attacked SolarWinds servers from Orion Network Management #software. The company is one of the most renowned in the field of #digital creation and #design software, including programs such as AutoCAD #architects #blueprints #architecture #plans #threats #informatique

https://www.somagnews.com/autodesk-was-victim-of-hacker-attack-by-solarwinds/

TrickBot

https://news.kbs.co.kr/news/view.do?ncd=5270878

Indonesian authorities have admitted that the #COVID-19 vaccination certificate of the nation's President (Joko Widodo aka Jokowi) has circulated #online and tried to explain that it's an indication of admirable transparency, rather than lamentable security #indonesia #health #covid #informatique

https://www.theregister.com/2021/09/06/joko_widodo_vaccination_certificate_leak/

BrakTooth : commercial Bluetooth stacks used in billions of devices are vulnerables #bluetooth #threats #informatique

https://asset-group.github.io/disclosures/braktooth/

BrakTooth RCE on ESP32 #bluetooth #threats

https://www.youtube.com/watch?v=F7VjuOiUsNk

Backdoor #Microsoft Office365 and Microsoft #Azure AD by stealing AD FS certificate/key pair. Golden SAML attack will allow an attacker to:

• Bypass MFA to Azure / Office365
• Logon as any AD user regardless of password resets
• Method is usually valid for a year

https://www.inversecos.com/2021/09/backdooring-office-365-and-active.html

John Donovan, CISO at Malwarebytes (malwarebytes.com) about the impact stress has on information security teams

https://www.youtube.com/watch?v=x82U3hMR5hY

Investigation into recent attacks by a #Conti affiliate reveals that that the attackers initially accessed targeted organizations' networks with ProxyShell, an exploit of vulnerabilities in #Microsoft Exchange that have been the subject of multiple critical updates over the past several months. #ransomware

https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/

Rapidly Search & Hunt through #Microsoft #Windows Event Logs #rust

https://github.com/Countercept/chainsaw

This PoC in #Python generates payload when exploited for a 0-day of GhostScript 9.50. This exploit affect to ImageMagick with the default settings from #Linux Ubuntu repository #vuln #informatique #

https://github.com/duc-nt/RCE-0-day-for-GhostScript-9.50

Anatomy & Disruption of Metasploit Shellcode #informatique

https://blog.nviso.eu/2021/09/02/anatomy-and-disruption-of-metasploit-shellcode/

JetBrains Datalore - An attacker could take over a user's JWT token & gain access to its Datalore account. #vuln

https://infosecwriteups.com/eye-for-an-eye-unusual-single-click-jwt-token-takeover-2e58f88cf44d

#BlackMatter #Ransomware v2.0

https://chuongdong.com/reverse%20engineering/2021/09/05/BlackMatterRansomware/

Les systèmes informatiques de la Société de transport de l'Outaouais (sto.ca) paralysés suite à une attaque #informatique #canada #ransomware

https://ottawa.ctvnews.ca/sto-targeted-by-cyberattack-1.5574455