#attack13 / #WhisperGate All-in-One YARA-rules, tools, samples, papers: https://lab.dobergroup.org.ua/-/snippets/41
Kir
boosted
Destructive malware targeting Ukrainian organizations: technical blog post by #MSTIC : https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
Kir
boosted
Samples of #WhisperGate (VXUG) aka #attack13 (DG) aka DEV-0586 (MSTIC) - the MBR Overwriter targeting Gov #Ukraine https://samples.vx-underground.org/APTs/2022/2022.01.15/Samples/ (pass "infected")
Kir
boosted
New official version: not a #vulnerability in OctoberCMS but supply chain attack. https://cip.gov.ua/ua/news/derzhspeczv-yazku-z-yasuvala-yak-khakeri-zlamali-saiti-derzhustanov-sho-stalosya (currently UA only, sorry). Company not named, but rumored to be Kitsoft Ukraine
Kir
boosted
CVE-2021-32648 (Score 6.4) - attacker can request an account password reset and then gain access to the account using a specially crafted request.
CVE Publish Date: 26.08.2021
OctoberCMS Patch Commit Date: 07.04.2021
Total disgrace
Kir
boosted
15 gov sites in Ukraine - all using OctoberCMS - have been defaced, incl Min of Foreign Affairs, Cabinet of Ministers, Min of Ed, Emergency Services, Treasury, Environmental Protection. Looks like the attackers used CVE-2021-32648 in all cases.
CVE-2021-32648 (Score 6.4) - attacker can request an account password reset and then gain access to the account using a specially crafted request.
CVE Publish Date: 26.08.2021
OctoberCMS Patch Commit Date: 07.04.2021
Total disgrace
15 gov sites in Ukraine - all using OctoberCMS - have been defaced, incl Min of Foreign Affairs, Cabinet of Ministers, Min of Ed, Emergency Services, Treasury, Environmental Protection. Looks like the attackers used CVE-2021-32648 in all cases.
Kir
boosted
More Russian Cyber Operations against Ukraine https://www.schneier.com/blog/archives/2022/01/more-russian-cyber-operations-against-ukraine.html #Uncategorized #cyberwar #Ukraine #Russia
My mom told me i could be anything i want when i grow up. Turns out this is called Identity Theft.
Kir
boosted
I see the problem with #NSO groups not in that they "have been selling to everyone".
It is that they have NOT been selling to everyone, just to some obscure group of assholes they felt confident with.
Considering the fact that miners would go unnoticed for several months and #Mirai worm itself is quiet enough... So this is not the end of #log4j
https://ioc.exchange/@gsc/107477757176746776
Kir
boosted
#VXUnderground published a first worm sample that uses a #Log4Shell to install Monero-miner.
Self-propagating #Mirai-bot identified by security researcher 1ZRR4H@twitter.com
A group of unidentified hackers have compromised one of the #FBI’s email servers and have sent out a massive wave of spam emails containing a warning about a (fake) cyberattack that was allegedly taking place.
https://therecord.media/official-fbi-email-server-hacked-used-to-send-fake-threat/
#VXUnderground have aggregated a sample of #Lazarus Groups trojanized IDA Pro installer.
You can download it here: https://vx-underground.org/apts
#APT's and #CyberCrime analyst
Joined Dec 2018
