The group reportedly developed customized versions of Trochilus, Gh0st RAT and 9002 RAT
APT groups have leveraged Notepad++ plugins for nefarious purposes in the past
In October 2019, a security researcher found a devastating vulnerability in Tornado.cash, a decentralized, non-custodial mixer on the Ethereum network. Tornado.cash uses zero-knowledge proofs (ZKPs) to allow its users to privately deposit and withdraw funds. The proofs are supposed to guarantee that...
RedLine can steal usernames, passwords, cookies, bank card details and autofill data from browsers
Experts urge the public not to fall for classic scams
En septembre 2022, Toulouse INP a été victime d'une cyberattaque avec le ransomware AvosLocker. L'attaque a été déclenchée via un compte étudiant compromis et a bloqué l'annuaire, les mécanismes d'authentification et les capacités d'accès physique aux bâtiments. Des mesures ont été prises pour rétab...
Report reveals there’s no honor among thieves
UK parents concerned about repercussions of soaring inflation
This week I learned about a design flaw with pip download, which allows an adversary to run arbitrary code.
I assumed that running pip install means anything could happen, but pip download seems a bit surprising.
Both seem useful for red teaming though.
Background This post from Yehuda Gelb named Au...
ISACA's State of Digital Trust 2022 report highlights increasing importance of digital trust across businesses
The flaws affected the Flexlan FX3000 and FX2000 series wireless LAN devices made by Contec
Background If you haven’t done so yet, read my first Zix exploitation article: Spear Phishing with Zix: An Undisclosed Red Team Method for the Hungry APT, which established baselines to abuse the native organizational trust that Zix provides to perform spear phishing on the affected company. Shortly...
Eset also said the same university was targeted during student protests in May 2020
The report also suggested the Android spyware Joker took third place in the mobile index
Background If you haven’t done so yet, read my first Zix exploitation article: Spear Phishing with Zix: An Undisclosed Red Team Method for the Hungry APT, which established baselines to abuse the native organizational trust that Zix provides to perform spear phishing on the affected company. Shortly...
Data leaks, breaches and intrusions caused headaches over past year
Overall incidents fell in H1 2022, according to FOI data
2.5 million people were affected, in a breach that could spell more trouble down the line.
Redmond passes 1000 CVEs for the year already
iOS 16 supports iPhone devices starting from the iPhone 8