エピソード
-
Top Headlines:
Elastic Security Labs | Declawing PUMAKIT: https://www.elastic.co/security-labs/declawing-pumakitXLab | Glutton: a New Zero-Day Detection PHP Backdoor from Winnti Targets Cybercriminals: https://blog.xlab.qianxin.com/glutton_stealthily_targets_mainstream_php_frameworks-en/Claroty | Inside a New OT/IoT Cyberweapon: IOCONTROL - https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrolSecureList | Careto is Back: What's New After 10 Years of Silence?: https://securelist.com/careto-is-back/114942/
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
Top Headlines:
Embrace The Red | DeepSeek AI: From Prompt Injection to Account Takeover: https://embracethered.com/blog/posts/2024/deepseek-ai-prompt-injection-to-xss-and-account-takeover/Huntress | Cleo Software Actively Being Exploited in the Wild: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wildZscaler | Unveiling RevC2 and Venom Loader: https://www.zscaler.com/blogs/security-research/unveiling-revc2-and-venom-loaderCyble | Threat Actor Targets Manufacturing Industry with Malware: https://cyble.com/blog/threat-actor-targets-manufacturing-industry-with-malware/?&web_view=true
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
エピソードを見逃しましたか？
-
Welcome to Out of the Woods: The Threat Hunting Podcast! In this episode, "The Ideal Outcome: The Gift of a Well-Crafted Threat Hunt," our expert team dives into what it means to reach the “ideal outcome” as a threat hunter, offering actionable insights to help you build an effective and enduring approach.
This episode discussed:
Long-Term Impact: Discover how a structured threat hunt can benefit both hunters and their organizations, reinforcing stronger security measures and insights that last.Security Stack Essentials: Learn about the ideal tools and technologies that make up a robust security stack, empowering you to align hunting efforts with broader security goals.Integration and Team Synergy: Find out how to integrate threat hunting with security operations teams, fostering collaboration to create a well-rounded defense approach.Skills for the Future: We’ll also discuss the critical skills and techniques that help threat hunters stay effective in an evolving threat landscape.
Interesting Artifacts: https://gptzero.me/https://atomicgen.io/https://securitydatasets.com/introduction.html
🔗 Join us on Discord: https://discord.gg/Ka6tsEc3
----
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
**Out of the Woods: The Threat Hunting Podcast [LIVE EPISODE]
December 5, 2024 | 12:00 - 1:30 PM EST
Sign Up Here: https://intel471.com/resources/podcasts/the-ideal-outcome-the-gift-of-a-well-crafted-threat-hunt
----------
In this episode of Out of the Woods: The Threat Hunting Podcast, host Scott Poley speaks with Dr Joshua Scarpino, VP of Information Security at TrustEngine and CEO of Assessed.Intelligence, during the Information Security Summit in Cleveland. Josh shares insights from his extensive career in IT and security, diving into responsible technology deployment and the challenges of managing AI systems.
Learn how organizations can implement guardrails to mitigate risks, tackle scope creep, and build foundational frameworks like the NIST AI Risk Management Framework (RMF). Josh also emphasizes the importance of addressing unknown risks and the need for diverse perspectives in AI system development to ensure fairness and accountability.
Tune in to gain practical strategies for assessing risks, establishing governance, and driving secure innovation in today’s evolving tech landscape.
*Connect with Dr. Joshua Scarpino: https://www.linkedin.com/in/joshuascarpino/
----
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
**Out of the Woods: The Threat Hunting Podcast [LIVE EPISODE]
December 5, 2024 | 12:00 - 1:30 PM EST
Sign Up Here: https://intel471.com/resources/podcasts/the-ideal-outcome-the-gift-of-a-well-crafted-threat-hunt
----------
Top Headlines:
We Live Security | Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine: https://www.welivesecurity.com/en/eset-research/unveiling-wolfsbane-gelsemiums-linux-counterpart-to-gelsevirine/Phylum Research | Python Crypto Library Updated to Steal Private Keys: https://blog.phylum.io/python-crypto-library-updated-to-steal-private-keys/?&web_view=trueCensys | The 2024 State of the Internet Report: Internet-Connected Industrial Control System: https://go.censys.com/rs/120-HWT-117/images/2024SOTIR.pdfHunters Security | Unmasking VEILDrive: Threat Actors Exploit Microsoft Services for C2: https://www.hunters.security/en/blog/veildrive-microsoft-services-malware-c2?&web_view=true
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
In this episode of Out of the Woods: The Threat Hunting Podcast, Scott Poley sits down with Brian Hill, a cybersecurity leader with a rich background in law enforcement, military service, and corporate security. Brian shares his journey from major crimes detective and forensics expert to building and managing Security Operations Centers (SOCs) at organizations like Arctic Wolf and Black Cloak. The discussion highlights challenges in scaling SOCs, the importance of balancing specialized expertise with cross-functional training, and unique threats faced by high-profile individuals, such as SIM swapping and personal device vulnerabilities. Brian also explores broader trends like artificial intelligence and deepfake technology, emphasizing the need for education and proactive measures to stay ahead of evolving cyber threats.
*Connect with Brian Hill: https://www.linkedin.com/in/brian-hill-776b50100/
----
Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
In this episode of Out of the Woods: The Threat Hunting Podcast, Scott Poley catches up with Violet Sullivan, cyber services lead for insurance carrier Crum and Forester, at the Information Security Summit in Cleveland. Violet dives into the evolving world of cyber insurance, shedding light on the often-overlooked layers of coverage that go beyond cyber events, including system outages and privacy litigation. She explains the shifting focus from ransomware to privacy issues, and how the rising importance of privacy is impacting both insurance policies and legal frameworks.
They discuss the nuanced world of privacy litigation and emerging technologies like privacy scans, which scrutinize website data collection practices. Violet also addresses the current debate on AI training data, ownership, and privacy, offering insights into the challenges and implications for companies and individuals alike. If you’re interested in the intersection of cyber insurance, privacy, and AI, this episode offers a compelling look at how these fields are rapidly converging.
*Connect with Violet Sullivan: https://www.linkedin.com/in/txcyberlawyer/
----
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
**Threat Hunting Workshop: Hunting for Discovery
November 20, 2024 | 12:00 – 1:00 PM EST
Sign Up Here: https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-discovery
**Out of the Woods: The Threat Hunting Podcast [LIVE EPISODE]
December 5, 2024 | 12:00 - 1:30 PM EST
Sign Up Here: https://intel471.com/resources/podcasts/the-ideal-outcome-the-gift-of-a-well-crafted-threat-hunt
----------
Top Headlines:
Sophos News | Bengal cat lovers in Australia get psspsspss’d in Google-driven Gootloader campaign: https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/?amp=1Wiz Blog | Investigating 0ktapus: Phishing Analysis & Detection: https://www.wiz.io/blog/unmasking-phishing-strategies-for-identifying-0ktapus-domains?&web_view=trueFortiGuard Labs | New Campaign Uses Remcos RAT to Exploit Victims: https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victimsCado Security Labs | GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry: https://www.cadosecurity.com/blog/guloader-targeting-european-industrial-companies
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
In this bonus episode of Out of the Woods, Scott Poley sits down with John DiMaria, Director of Operations Excellence at the Cloud Security Alliance (CSA), live from the Information Security Summit in Cleveland. DiMaria discusses his pivotal role in developing CSA’s STAR (Security, Trust, Assurance, and Risk) program and shares insights on cloud security, the evolution of the STAR program, and its alignment with CSA's Cloud Controls Matrix (CCM).
They also explore the future of STAR in the AI landscape, the crucial role of shared responsibility models in cloud security, and the importance of continuous monitoring and compliance in securing cloud infrastructure. DiMaria highlights his experience and CSA's ongoing efforts to provide businesses with practical resources and tools to manage cloud and AI security risks.
Perfect for anyone looking to understand the landscape of cloud security and CSA’s impact on the field, this episode offers a deep dive into the essential frameworks guiding secure cloud practices today. Tune in for this engaging and informative conversation!
*Connect with John DiMaria: https://www.linkedin.com/in/johndimaria/
-----
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
**Threat Hunting Workshop: Hunting for Discovery
November 20, 2024 | 12:00 – 1:00 PM ET
Sign Up Here: https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-discovery
----------
Top Headlines:
Unit 42 | Jumpy Pisces Engages in Play Ransomware: https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/Help Net Security | Sophos Mounted Counter-Offensive Operation to Foil Chinese Attackers: https://www.helpnetsecurity.com/2024/10/31/sophos-china-defensive-operation/?web_view=trueProject Zero | From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code: https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html?m=1The Cyber Express | HeptaX: Uncovering Cyberespionage Operations Through Unauthorized RDP Connections: https://thecyberexpress.com/heptax-cyberattack/?&web_view=true
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
*Join our Threat Hunting Workshop: Hunting for Discovery*
November 20, 2024 | 12:00 - 1:00 PM ET
Sign Up Here: https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-discovery
----
In this live episode of Out of the Woods: The Threat Hunting Podcast, we dive into essential threat hunting techniques and the journey to mastering the craft.
Join us as we discuss:
Building resilience through community insights and shared resourcesPractical threat hunting tips with the latest from GitHub repositories and threat actor techniquesManaging the grind and balancing detection with proactive hunting strategiesEnhancing skill sets by embracing the unknowns in the journey
Interesting Artifacts:
https://github.com/BushidoUKhttps://github.com/salesforce/logai?tab=readme-ov-file#documentationhttps://opensource.salesforce.com/logai/latest/intro.htmlhttps://detect.fyi/have-you-been-keeping-up-with-your-low-confidence-detections-494c742202e4
🔗 Join our Discord to interact with us at our next live session: https://discord.gg/Ka6tsEc3
#ThreatHunting #CyberSecurity #OutOfTheWoods #Podcast -
**[LIVE] Out of the Woods: The Threat Hunting Podcast
October 24, 2024 | 7:00 – 8:30 PM ET
Sign Up > https://intel471.com/resources/podcasts/blood-sweat-and-threats-carving-the-perfect-threat-hunter
----------
Top Headlines:
Aqua | perfctl: A Stealthy Malware Targeting Millions of Linux Servers: https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/ Cisco Talos Blog | Threat Actor Believed to be Spreading New MedusaLocker Variant in Europe and South America: https://blog.talosintelligence.com/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/?&web_view=trueProofpoint US | Security Brief: Royal Mail Lures Deliver Open Source Prince Ransomware: https://www.proofpoint.com/us/blog/threat-insight/security-brief-royal-mail-lures-deliver-open-source-prince-ransomwareSecurity Affairs | Kyiv's Hackers Launched an Unprecedented Cyber Attack on Russian State Media VGTRK on Putin's Birthday: https://securityaffairs.com/169486/cyber-warfare-2/kyivs-hackers-hit-russian-state-media.html?web_view=true
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
**Threat Hunting Workshop: Hunting for Collection
October 2, 2024 | 12:00 - 1:00 PM ET
Sign Up > https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-collection
**[LIVE] Out of the Woods: The Threat Hunting Podcast
October 24, 2024 | 7:00 – 8:30 PM ET
Sign Up > https://intel471.com/resources/podcasts/blood-sweat-and-threats-carving-the-perfect-threat-hunter
----------
Top Headlines:
The Hacker News | Critical Linux CUPS Printing System Flaws Could Allow Remote Command Execution: https://thehackernews.com/2024/09/critical-linux-cups-printing-system.html?m=1The DFIR Report | Nitrogen Campaign Drops Silver and Ends With BlackCat Ransomware: https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/Netskope | DCRat Targets Users with HTML Smuggling: https://www.netskope.com/blog/dcrat-targets-users-with-html-smugglingCISA Analysis: Fiscal Year 2023 Risk and Vulnerability Assessments: https://www.cisa.gov/sites/default/files/2024-09/FY23_RVA_Analysis_508.pdf
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
**Threat Hunting Workshop: Hunting for Collection
October 2, 2024 | 12:00 - 1:00 PM ET
Sign Up > https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-collection
**[LIVE] Out of the Woods: The Threat Hunting Podcast
October 24, 2024 | 7:00 – 8:30 PM ET
Sign Up > https://intel471.com/resources/podcasts/blood-sweat-and-threats-carving-the-perfect-threat-hunter
----------
In this episode of Out of the Woods: The Threat Hunting Podcast, Scott Poley and Tom Kastura explore the latest threat-hunting insights, starting with UNC 2970, a North Korean-linked group using trojanized PDF readers to target industries like energy and finance. They discuss how the group's phishing tactics exploit job openings and the use of telemetry to detect malicious activity. The episode also covers a campaign leveraging CAPTCHA pages to deliver the Luma Stealer malware and dives into the risk of poisoned Python packages compromising supply chains. Tune in for strategies to stay proactive against advanced threats and enhance your hunting techniques.
Top Headlines:
Unit 42 | Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors: https://unit42.paloaltonetworks.com/gleaming-pisces-applejeus-poolrat-and-pondrat/?web_view=trueCloudSEK | Unmasking the Danger: Lumma Stealer Malware Exploits Fake CAPTCHA Pages: https://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages?&web_view=trueGoogle Cloud | An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader: https://cloud.google.com/blog/topics/threat-intelligence/unc2970-backdoor-trojanized-pdf-readerDarkReading | For $20, Researchers Seize Part of Net Infrastructure: https://www.darkreading.com/cyber-risk/researchers-seize-internet-infrastructure-for-20?&web_view=true
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
**Threat Hunting Workshop: Hunting for Collection
October 2, 2024 | 12:00 - 1:00 PM ET
Sign Up > https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-collection
In this episode of Out of the Woods: The Threat Hunting Podcast, Scott and Lee discuss four key topics: North Korea’s social engineering attacks on the crypto industry, the rise of the malicious Chrome extension Luma C2 Stealer, a phishing and doxxing campaign by Russian threat actors targeting NGOs, and hacktivist attacks on Russian and Belarusian institutions using ransomware and common tools. They highlight the growing sophistication of these tactics and stress the importance of vigilance and proactive threat hunting to defend against these increasingly complex threats.
Top Headlines:
1. FBI | Public Service Announcement - North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks: https://www.ic3.gov/Media/Y2024/PSA240903
2. Cybersecurity News | Beware the Drive-By Download: LummaC2 Stealer and Malicious Chrome Extension Wreak Havoc: https://securityonline.info/beware-the-drive-by-download-lummac2-stealer-and-malicious-chrome-extension-wreak-havoc/?&web_view=true
3. The Hacker News | North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Scams: https://thehackernews.com/2024/09/north-korean-threat-actors-deploy.html
4. SecureList | Head Mare: Adventures of a Unicorn in Russia and Belarus: https://securelist.com/head-mare-hacktivists/113555/
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
In this episode of "Out of the Woods: The Threat Hunting Podcast," Scott and Tom dive into the latest threat hunting headlines for the week of September 2nd, 2024. They explore how basic techniques are being repurposed in advanced ways, such as using Google Sheets for command and control in a suspected espionage campaign and employing web dev to enhance phishing attacks. The discussion also covers a new wave of skimming attacks targeting e-commerce sites and a deep dive into APT32’s advanced persistence tactics in a long-term intrusion. Scott and Tom offer insights and strategies for threat hunters to detect and counter these evolving threats.
Top Headlines:
1. Huntress | Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders: https://www.huntress.com/blog/advanced-persistent-threat-targeting-vietnamese-human-rights-defenders?&web_view=true
2. Objective-See | A Surreptitious Cryptocurrency Miner in the Mac App Store?: https://objective-see.org/blog/blog_0x2B.html
3. Malwarebytes | Hundreds of Online Stores Hacked in New Campaign: https://www.malwarebytes.com/blog/news/2024/08/hundreds-of-online-stores-hacked-in-new-campaign?web_view=true
4. Proofpoint US | The Malware That Must Not Be Named: Suspected Espionage Campaign Delivers "Voldemort": https://www.proofpoint.com/us/blog/threat-insight/malware-must-not-be-named-suspected-espionage-campaign-delivers-voldemort
----------
Stay in Touch!Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/ -
In this episode of the "Out of the Woods Threat Hunting Podcast," Scott and Tom break down the top threat hunting stories for the week of August 26, 2024. They dive into SetXP, a stealthy Linux malware that manipulates UDEV rules to evade detection, and explore why it’s not yet on the MITRE ATT&CK radar. The duo also covers PeakLight, a new memory-only dropper, and Stick Stealer, a malware targeting browser data and crypto wallets. Wrapping up with insights from a BlackSuit ransomware breach, they discuss how attackers often reuse old techniques in new ways. This episode challenges the notion of what truly makes an execution unique, offering practical tips for staying ahead of evolving threats.
1. AON | Unveiling "sedexp": A Stealthy Linux Malware Exploiting udev Rules: https://www.aon.com/en/insights/cyber-labs/unveiling-sedexp
2. The DFIR Report | BlackSuit Ransomware: https://thedfirreport.com/2024/08/26/blacksuit-ransomware/
3. Check Point Research | Unmasking Styx Stealer: How a Hacker’s Slip Led to an Intelligence Treasure Trove: https://research.checkpoint.com/2024/unmasking-styx-stealer-how-a-hackers-slip-led-to-an-intelligence-treasure-trove/
4. Google Cloud Blog | PEAKLIGHT: Decoding the Stealthy Memory-Only Malware: https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/?&web_view=true
Stay in Touch!Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Discord: https://discord.gg/DR4mcW4zBr
TikTok: https://www.tiktok.com/@cyborgsecinc -
In this week's Top 5 Threat Hunting Headlines, Scott and Tom discuss top cybersecurity threats, including Kaspersky's Tusk InfoStealer campaign, a cloud extortion campaign exploiting AWS environments, APT41's advanced tactics against a Taiwanese research institute, and the Banshee InfoStealer targeting macOS. They also explore the impact of AI on cybersecurity, emphasizing the need for SOCs to evolve with new talent and strategies to address emerging threats. The episode underscores the importance of staying vigilant and adapting to the rapidly changing threat landscape.
Top 5 Threat Hunting Headlines - 19 Aug 2024
1. Secure List | Tusk Campaign Uses Infostealers and Clippers for Financial Gainhttps://securelist.com/tusk-infostealers-campaign/113367/2. Unit 42 | Leaked Environment Variables Allow Large-Scale Extortion Operation of Cloud Environmentshttps://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/3. Cisco Talos Blog | APT41 Likely Compromised Taiwanese Government-Affiliated Research Institute with ShadowPad and Cobalt Strikehttps://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/?&web_view=true4. Elastic Security Labs | Beyond the Wail: Deconstructing the BANSHEE Infostealerhttps://www.elastic.co/security-labs/beyond-the-wail5. Help Net Security | 74% of IT Professionals Worry That AI Tools Will Replace Themhttps://www.helpnetsecurity.com/2024/08/15/it-professionals-ai-worry/?web_view=true
-----
Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Discord: https://discord.gg/DR4mcW4zBr
TikTok: https://www.tiktok.com/@cyborgsecinc -
Top 5 Threat Hunting Headlines - 12 Aug 2024
1. DarkReading | SaaS Apps Present an Abbreviated Kill Chain for Attackershttps://www.darkreading.com/application-security/saas-apps-present-abbreviated-kill-chain-for-attackers?&web_view=true2. ReasonLabs | Enterprise Grade Security to All of Your Personal Deviceshttps://reasonlabs.com/research/new-widespread-extension-trojan-malware-campaign3. DFIR | Threat Actors' Toolkit: Leveraging Silver, PoshC2 & Batch Scriptshttps://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts/4. SafeBreach | Downgrade Attacks Using Windows Updateshttps://www.safebreach.com/blog/downgrade-attacks-using-windows-updates/5. Cyble | Double Trouble: Latrodectus and ACR Stealer Observed Spreading Via Google Authenticator Phishing Sitehttps://cyble.com/blog/double-trouble-latrodectus-and-acr-stealer-observed-spreading-via-google-authenticator-phishing-site/?&web_view=true
-----
Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Discord: https://discord.gg/DR4mcW4zBr
TikTok: https://www.tiktok.com/@cyborgsecinc -
Threat Hunting Workshop: Hunting for Command and Control
31 July 2024 | 12:00 - 1:00 pm ETRegister Here!Black Hat 2024 Training with Lee Archinal
"A Beginner's Guide to Threat Hunting: How to Shift Focus from IOCs to Behaviors and TTPs" | Secure your spot now at a discounted rate:3-4 Aug 2024: Sign Up Here!5-6 Aug 2024: Sign Up Here!-----
Top 5 Threat Hunting Headlines - 29 July 2024
1. Bleeping Computer | Acronis Warns of Cyber Infrastructure Default Password Abused in Attackshttps://www.bleepingcomputer.com/news/security/acronis-warns-of-cyber-infrastructure-default-password-abused-in-attacks/?&web_view=true2. Guardio Labs | “EchoSpoofing” – A Massive Phishing Campaigns Exploiting Proofpoint’s Email Protevtion to Dispatch Millions of Perfectly Spoofed Emailshttps://labs.guard.io/echospoofing-a-massive-phishing-campaign-exploiting-proofpoints-email-protection-to-dispatch-3dd6b5417db6?gi=b32e776ffab33. Esentire | Introducing Gh0stGambit: A Dropper for Deploying Gh0st RAThttps://www.esentire.com/blog/a-dropper-for-deploying-gh0st-rat?&web_view=true4. Check Point Research | Stargazers Ghost Networkhttps://research.checkpoint.com/2024/stargazers-ghost-network/5. Help Net Security | Most CISO’s Feel Unprepared for New Compliance Regulationshttps://www.helpnetsecurity.com/2024/07/26/cisos-compliance-regulations-preparedness/?web_view=true-----
Follow Us!
Twitter: https://twitter.com/CyborgSecInc
LinkedIn: https://www.linkedin.com/company/cyborg-security/
YouTube: https://www.youtube.com/cyborgsecurity
Discord: https://discord.gg/DR4mcW4zBr
TikTok: https://www.tiktok.com/@cyborgsecinc - もっと表示する
