DrWhaxThe United States state department issues a visa ban to 13 people and some of their family members. Reason is the proliferation of spyware. https://www.state.gov/promoting-accountability-for-the-misuse-of-commercial-spyware/
Not Simon
@simontsui@infosec.exchange
- 1.2K Followers
- 112 Following
- 687 Posts
This is not Simon. Opinions are made by a screaming goat and do not express the views or opinions of his goatherder.
The RecordCrushFTP urges customers to patch file transfer tool ‘ASAP’ https://therecord.media/crushftp-file-transfer-vulnerability-patch-asap
Shoutout to @h4sh for getting a CVE ID assigned to this actively exploited zero-day CrushFTP vulnerability: CVE-2024-4040 (reported by Simon Garrelou, of Airbus CERT). https://www.cve.org/CVERecord?id=CVE-2024-4040
VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.
#zeroday #eitw #activeexploitation #CrushFTP #vulnerability #CVE_2024_4040
Kevin BeaumontWall Street Journal has a leak from the Change Healthcare ransomware incident
- Initial entry was via a remote access system without MFA
- Dwell time was 9 days
- They paid the ransom, then got held to ransom again and had data leaked anyway
Jenkins security advisory from 17 April 2024 patched against the Terrapin Attack vulnerability CVE-2023-48795 🔗 https://www.jenkins.io/security/advisory/2024-04-17/
Microsoft reported that APT28 (Fancy Bear, Forest Blizzard) used a custom tool to elevate privileges and steal credentials in compromised networks. This GooseEgg tool leveraged CVE-2022-38028 (7.8 high, disclosed 11 October 2022 by Microsoft; Windows Print Spooler Elevation of Privilege Vulnerability) as a zero-day since at least June 2020 (possibly as early as April 2019) which was 2 years 4 months. APT28 is publicly attributed to Russian General Staff Main Intelligence Directorate (GRU). IOC provided. 🔗 https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
cc: @serghei @campuscodi @briankrebs @jwarminsky
#APT28 #cyberespionage #Russia #FancyBear #ForestBlizzard #CVE_2022_38028 #eitw #activeexploitation #GooseEgg
Analyzing Forest Blizzard’s custom post-compromise tool for exploiting CVE-2022-38028 to obtain credentials | Microsoft Security Blog
Since 2019, Forest Blizzard has used a custom post-compromise tool to exploit a vulnerability in the Windows Print Spooler service that allows elevated permissions. Microsoft has issued a security update addressing this vulnerability as CVE-2022-38028.
New York Times: A report by Stanford researchers cautions that the National Center for Missing and Exploited Children doesn’t have the resources to help fight a new flood of child sexual abuse material created by artificial intelligence. https://www.nytimes.com/2024/04/22/technology/ai-csam-cybertipline.html
The Record: UK arrests 2 for breaching the Official Secrets Act on behalf of China. Germany arrests 3 for obtaining information on innovative technologies with military uses for China's Ministry of State Security. 🔗 https://therecord.media/germany-arrests-spies-lasers-china
SANS ISC notes that the number of industrial control system devices accessible from the internet rose by 30,000: 🔗 https://isc.sans.edu/diary/rss/30860
SafeBreach revealed that the DOS-to-NT path conversion process could be exploited by threat actors to achieve rootkit-like capabilities to conceal and impersonate files, directories, and processes. "During this conversion process, a known issue exists in which the function removes trailing dots (referring to this as "MagicDot") from any path element and any trailing spaces from the last path element. This action is completed by most user-space APIs in Windows." This resulted in multiple CVEs: CVE-2023-36396 (7.8 high, RCE), CVE-2023-32054 (7.3 high, EoP write), and CVE-2023-42757 (unpublished DoS). Microsoft declined to fix an Elevation of Privilege delete vulnerability. 🔗 https://www.safebreach.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/
