IoCs - Cloud Security Alliance News Clipping Site

Krebs on Security: Fintech Giant Finastra Investigating Data Breach

Nov 20, 2024

—

by

Source URL: https://krebsonsecurity.com/2024/11/fintech-giant-finastra-investigating-data-breach/ Source: Krebs on Security Title: Fintech Giant Finastra Investigating Data Breach Feedly Summary: The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world’s top 50 banks, notified customers of…

The Register: China-linked group abuses Fortinet 0-day with post-exploit VPN-credential stealer

Nov 19, 2024

—

by

system automation

in Uncategorized

Source URL: https://www.theregister.com/2024/11/19/china_brazenbamboo_fortinet_0day/ Source: The Register Title: China-linked group abuses Fortinet 0-day with post-exploit VPN-credential stealer Feedly Summary: No word on when or if the issue will be fixed Chinese government-linked snoops are exploiting a zero-day bug in Fortinet’s Windows VPN client to steal credentials and other information, according to memory forensics outfit Volexity.… AI…

Cloud Blog: Empowering Gemini for Malware Analysis with Code Interpreter and Google Threat Intelligence

Nov 19, 2024

—

by

system automation

in Uncategorized

Source URL: https://cloud.google.com/blog/topics/threat-intelligence/gemini-malware-analysis-code-interpreter-threat-intelligence/ Source: Cloud Blog Title: Empowering Gemini for Malware Analysis with Code Interpreter and Google Threat Intelligence Feedly Summary: One of Google Cloud’s major missions is to arm security professionals with modern tools to help them defend against the latest threats. Part of that mission involves moving closer to a more autonomous, adaptive…

Cisco Talos Blog: New PXA Stealer targets government and education sectors for sensitive information

Nov 14, 2024

—

by

system automation

in Uncategorized

Source URL: https://blog.talosintelligence.com/new-pxa-stealer/ Source: Cisco Talos Blog Title: New PXA Stealer targets government and education sectors for sensitive information Feedly Summary: Cisco Talos discovered a new information stealing campaign operated by a Vietnamese-speaking threat actor targeting government and education entities in Europe and Asia. AI Summary and Description: Yes Summary: The text discusses a threat…

Microsoft Security Blog: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files

Nov 1, 2024

—

by

system automation

in Uncategorized

Source URL: https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/ Source: Microsoft Security Blog Title: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files Feedly Summary: Since October 22, 2024, Microsoft Threat Intelligence has observed Russian threat actor Midnight Blizzard sending a series of highly targeted spear-phishing emails to individuals in government, academia, defense, non-governmental organizations, and other sectors. This activity is…

Cisco Talos Blog: Threat actors use copyright infringement phishing lure to deploy infostealers

Oct 31, 2024

—

by

system automation

in Uncategorized

Source URL: https://blog.talosintelligence.com/threat-actors-use-copyright-infringement-phishing-lure-to-deploy-infostealers/ Source: Cisco Talos Blog Title: Threat actors use copyright infringement phishing lure to deploy infostealers Feedly Summary: Cisco Talos has observed an unknown threat actor conducting a phishing campaign targeting Facebook business and advertising account users in Taiwan. The decoy email and fake PDF filenames are designed to impersonate a company’s legal department,…

Alerts: Fortinet Updates Guidance and Indicators of Compromise following FortiManager Vulnerability Exploitation

Oct 30, 2024

—

by

system automation

in Uncategorized

Source URL: https://www.cisa.gov/news-events/alerts/2024/10/30/fortinet-updates-guidance-and-indicators-compromise-following-fortimanager-vulnerability Source: Alerts Title: Fortinet Updates Guidance and Indicators of Compromise following FortiManager Vulnerability Exploitation Feedly Summary: Fortinet has updated their security advisory addressing a critical FortiManager vulnerability (CVE-2024-47575) to include additional workarounds and indicators of compromise (IOCs). A remote, unauthenticated cyber threat actor could exploit this vulnerability to gain access to sensitive…

Cloud Blog: Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575)

Oct 24, 2024

—

by

system automation

in Uncategorized

Source URL: https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575/ Source: Cloud Blog Title: Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575) Feedly Summary: Written by: Foti Castelan, Max Thauer, JP Glab, Gabby Roncone, Tufail Ahmed, Jared Wilson Summary In October 2024, Mandiant collaborated with Fortinet to investigate the mass exploitation of FortiManager appliances across 50+ potentially compromised FortiManager devices in various industries. The vulnerability,…

Cisco Talos Blog: Highlighting TA866/Asylum Ambuscade Activity Since 2021

Oct 23, 2024

—

by

system automation

in Uncategorized

Source URL: https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/ Source: Cisco Talos Blog Title: Highlighting TA866/Asylum Ambuscade Activity Since 2021 Feedly Summary: TA866 (also known as Asylum Ambuscade) is a threat actor that has been conducting intrusion operations since at least 2020. AI Summary and Description: Yes Summary: The text provides an extensive analysis of the threat actor TA866 (Asylum Ambuscade),…

Cisco Talos Blog: UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants

Oct 17, 2024

—

by

system automation

in Uncategorized

Source URL: https://blog.talosintelligence.com/uat-5647-romcom/ Source: Cisco Talos Blog Title: UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants Feedly Summary: By Dmytro Korzhevin, Asheer Malhotra, Vanja Svajcer and Vitor Ventura. Cisco Talos has observed a new wave of attacks active since at least late 2023, from a Russian speaking group we track as “UAT-5647”, against Ukrainian…

Tag: IoCs