Cisco Talos discovered the malicious campaign in August 2022
Data samples contain email addresses, hashed passwords and user IDs, other PII
La Commission des valeurs mobilières de Hong Kong (SFC) a blâmé et sanctionné Six Fook Securities (ou Luk Fook Securities) pour des lacunes importantes dans ses mesures de cybersécurité. L'incident, une attaque par ransomware survenue en septembre 2022, a causé des perturbations majeures aux infrast...
PwC study finds organizations have a long way to go on security
Report reveals surging cloud bills for crypto-jacking victims
All about the new look for Hacking The Cloud v2.
Tax agency says automated tools are to blame
This could reflect threat actors shifting their tactics to rely on more elusive malware
On a network and need credentials? Try password spraying the domain controller directly.
A few years ago, I wrote this password spray tool called gospray that was used succesfully in a couple of engagements since. It does an LDAP bind directly against the domain controller to validate credentials. T...
Key activities are data leaking and selling, including officials' phone numbers and emails
The breach seems related to the hack of Fast Company's website on Sunday afternoon
In October 2019, a security researcher found a devastating vulnerability in Tornado.cash, a decentralized, non-custodial mixer on the Ethereum network. Tornado.cash uses zero-knowledge proofs (ZKPs) to allow its users to privately deposit and withdraw funds. The proofs are supposed to guarantee that...
Subject Access Requests experiencing significant delays
Many are operating under a false sense of security
En septembre 2022, Toulouse INP a été victime d'une cyberattaque avec le ransomware AvosLocker. L'attaque a été déclenchée via un compte étudiant compromis et a bloqué l'annuaire, les mécanismes d'authentification et les capacités d'accès physique aux bâtiments. Des mesures ont été prises pour rétab...
Chinese network targeting US mid-terms also closed down
They claimed responsibility for the attack and said they had deleted the stolen data
This week I learned about a design flaw with pip download, which allows an adversary to run arbitrary code.
I assumed that running pip install means anything could happen, but pip download seems a bit surprising.
Both seem useful for red teaming though.
Background This post from Yehuda Gelb named Au...
The new attacks would be a new instance of a campaign spotted by ESET and Malwarebytes in August
Most phishing attack vectors observed involved clicking a direct link to a phishing page