Sys-Admin & InfoSec Channel. Страница 3

Storm-0978 attacks reveal financial and espionage motives | Microsoft Security Blog

Microsoft has identified a phishing campaign conducted by the threat actor tracked as Storm-0978 targeting defense and government entities in Europe and North America. The campaign involved the abuse of CVE-2023-36884, which included a zero-day remote code execution vulnerability exploited via Microsoft Word documents.

None

Tailing Big Head Ransomware’s Variants, Tactics, and Impact

Cisco Security Advisory: Cisco ACI Multi-Site CloudSec Encryption Information Disclosure Vulnerability

A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, remote attacker to read or modify intersite encrypted traffic. This vulnerability is due to an issue with the implementation of the ciphers that are used by the CloudSec encryption feature on affected switches. An attacker with an on-path position between the ACI sites could exploit this vulnerability by intercepting intersite encrypted traffic and using cryptanalytic techniques to break the encryption. A successful exploit could allow the attacker to read or modify the traffic that is transmitted between the sites. Cisco has not released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX

Hunting for Nginx Alias Traversals in the wild

Nginx, a versatile web server pivotal to numerous internet infrastructures, has held a dominant market share since its inception in 2004, with widespread adoption across websites and Docker containers. This article delves into the intricacies of Nginx, focusing on the location and alias directives that are central to how Nginx

GitHub - Octoberfest7/TeamsPhisher: Send phishing messages and attachments to Microsoft Teams users

Send phishing messages and attachments to Microsoft Teams users - GitHub - Octoberfest7/TeamsPhisher: Send phishing messages and attachments to Microsoft Teams users

Ghostscript bug could allow rogue documents to run system commands

Even if you’ve never heard of the venerable Ghostscript project, you may have it installed without knowing.

The DPRK strikes using a new variant of RUSTBUCKET

A DPRK campaign using a new variant of the RUSTBUCKET malware is underway with updated capabilities and reduced signature detection.

Spear Phishing: How it works and why you should care

Everything you need to know about phishing! Learn who is behind phishing attacks, how you can spot an email, and what you should do about it.

AiTM/ MFA phishing attacks in combination with "new" Microsoft protections (2023 edition)

Adversary-in-the-middle phishing attacks are still more common in use. Since the removal of basic authentication from Exchange Online more and more attackers are using more modern attacks like adversary-in-the-middle phishing, cookie theft, and other used attacks. Last year I blogged about several modern...

Zyxel security advisory for pre-authentication command injection vulnerability in NAS products | Zyxel Networks

Active Directory Lab Setup Tool

A neat use case of using Out-GridView with PassThru.

Malvertising Used as Entry Vector for BlackCat Actors Also Leverage SpyBoy Terminator

We found that malicious actors used malvertising to distribute malware via cloned webpages of legitimate organizations. The distribution involved a webpage of the well-known application WinSCP, an open-source Windows application for file transfer. We were able to identify that this activity led to a BlackCat (aka ALPHV) infection, and actors also used SpyBoy, a terminator that tampers with protection provided by agents.