Gilles Polin

🎣 Phishing Kit ANTAI - Agence nationale de traitement automatisé des infractions deployed! 👉 As many, this kit exfiltrate stolen data into a Telegram Messenger channel. 🔬 By analyzing this kit (which is done automatically by StalkPhish.io), we can recover the exfiltration configuration cc: Cybermalveillance.gouv.fr ANTAI - Agence nationale de traitement automatisé des infractions -- 👉 Detected by StalkPhish.io - follow us and take a look at our website and data to increase your fraud/phishing/brand impersonation detection. #cybersecurity #fraud #phishingkit #yara #frenchtech

4

2 commentaires

😃check out what security consultants and the business, can do to revise approaches, promote better engagement, build better rapport, bring greater value to the process, along with avoiding some of the common mistakes that we’ve all been known to make! 👀😎

2

✏️[#BlogPost] Return on Security Investment (RoSI): an ally for CISOs in defending their budgets💰 Justifying the cyber security budget remains a challenge, especially as cyber still only accounts for 6.6% of organisations' IT budgets according to 2024 Wavestone report. 📊 And what if the concept of ROSI could unlock the integration between the cyber & financial worlds? By measuring the financial effectiveness of cybersecurity programmes, RoSI enables CISOs to demonstrate the positive impact of their actions and optimise the allocation of resources 📊 👉 With concrete figures, CISOs can better negotiate their future investments and establish themselves as strategic players within their organisation by speaking the same business language as their financial counterparts. 📖 Read our article: https://lnkd.in/ed-PQSS3 Maxime Cartan Julien C. Olivier Hamon Clément Tallec Marie Giesbert

13

3 commentaires

[ hashtag #SQLi ] ⚡️Test for SQL injection and CORRECT SQL injection vulnerabilities Real Time, Automatically, with patented SQLiFixer 👍 🔗 Personalized Demo at https://lnkd.in/e5cqX5uQ ✅ Testing for SQL injection vulnerabilities is crucial, but correction is key to safeguarding your applications. ✨ Why Choose SQLiFixer? SQLiFixer delivers automated, immediate corrections at the source code level. - Automates Security: Transforms risky code into secure scripts instantly. - Seamlessly Integrates: Fits right into your existing Git workflows, enhancing efficiency without disrupting your operations. 📢 Experience SQLiFixer in Action! See how our AI-powered tool can elevate your application security. For a free personalized demo and more info, visit our website. 🔗 Need more details? Reach out at contact@kawansoft.com. https://lnkd.in/eu8Nh8r5

2

🚨 Are you ready for NIS2? 🚨 Senior cybersecurity leaders and compliance professionals: the NIS2 Directive is no longer just a buzzword — it’s a game-changer for organisations across Europe. 🌍 With new obligations on cyber resilience, incident reporting, and supply chain security, NIS2 compliance is a must for any business that wants to thrive in this evolving regulatory landscape. Are you prepared to navigate these challenges? 💡 Introducing NIS2Professional.com — a dedicated course designed specifically for those charged with NIS2 compliance. This course will equip you with the knowledge and tools needed to: ✅ Understand the core requirements of the NIS2 Directive ✅ Build a robust compliance framework for your organization ✅ Mitigate risks and ensure operational resilience Don’t wait until it’s too late! Whether you're leading your organization's cybersecurity strategy or overseeing compliance efforts, this course is essential. 🔗 Learn more and enrol today at nis2professional.com #NIS2 #CyberSecurity #Compliance #RiskManagement #CyberResilience #CyberRisk #NIS2Professional ICTTF - Cyber Security Community, Academy and Events

35

Free, a French telecommunications company and the second largest Internet service provider (ISP) in the country, has disclosed a cyberattack it fell a victim to over the weekend. It's the latest in a line of attacks against ISPs and telcos of late. A threat actor stole information from the company's internal management tool, gathering data on the company's subscribers, and attempted to sell the data on the Dark Web in a cybercrime forum, the ISP confirmed to Agence France-Presse (AFP) on Oct. 26. The hacker, known as "drussellx," posted a message on the forum, putting two databases stolen from the ISP company up for auction. The databases reportedly contained information on more than 19 million customer accounts, and more than 5 million international bank account details. The bad actors gained "unauthorized access to some of the personal data associated with the accounts of certain subscribers," according to Free, which has more than 22 million mobile and fixed subscribers. However, it stressed that no passwords, bank-card information, emails, SMSs, or voicemails were compromised, and that its services were not been impacted. Internet service provider networks are increasingly being targeted by bad actors in attacks to steal data and set up base for new tactics and techniques. Take advanced persistent threat (APT) Salt Typhoon, for example, which has been targeting these networks in the US, likely due to the information they can garner, such as home addresses, billing information, SMSs, and more. #french #isp #cyberattack #databreach #free

4

1 commentaire

#LateralMovement Leading to #ActiveDirectory #Compromise: an example #TrustEverybodyButCutTheCards ***** Summary • #UNC5330 gained #initialaccess to the victim environment by chaining together #Ivanti CVE-2024-21893 and CVE-2024-21887. • leveraged an #LDAP bind account configured on the compromised #IvantiConnectSecure appliance to abuse a vulnerable #WindowsCertificateTemplate • created a computer object • requested a certificate for a #domainadministrator • then impersonated the domain administrator • performed finally subsequent #DCSyncs to extract additional #credential material to move laterally. ***** Windows Certificate Template Abuse UNC5330 used the ldap-ivanti account, configured on the #Ivanti #appliance for LDAP bind operations, to create a domain #computerobject, testComputer$. #UNC5330 used the newly created testComputer$ computer object to request a #certificate from a vulnerable certificate template that provided enrollment rights to Domain Computers. UNC5330 requested a certificate for a #domainadministrator account, obtained a #KerberosTGT using the certificate. Then performed #DCSync attacks to obtain additional domain credentials for enabling #lateralmovement. Once domain admin access was achieved, UNC5330 leveraged #WMI to deploy the #TONERJAM launcher and the #PHANTOMNET #backdoor. ***** WMI Event Consumers WMI was used to perform #lateralmovement and establish #persistence within the victim environment, primarily by creating and executing #scheduledtasks that were subsequently removed. The ActiveScript event consumers performed the following: • Created and registered a scheduled task with trigger type 7 (started the task upon registration) to execute command with #cmd.exe. • Wrote command output to a .log file in C:WindowsTemp. • Deleted the #scheduledtask. The #behavior, as well as the naming convention used for both the #WMI artifacts and output files, is consistent with a recent version of #CrackMapExec that implements DCE/RPC for WMI execution that does not rely on #SMB. ***** TONERJAM #TONERJAM is a #launcher that decrypts and executes a #shellcode #payload, in this case PHANTOMNET, stored as an encrypted local file and decrypts it using an #AES key derived from a #SHA hash of the final 16 bytes of the encrypted payload. TONERJAM maintains #persistence via the Run #registrykey or by #hijacking #COMobjects depending on the #permissions granted to it upon execution. ***** PHANTOMNET #PHANTOMNET is a modular #backdoor that communicates using a custom communication protocol over #TCP. PHANTOMNET's core functionality involves expanding its capabilities through a #plugin management system. The downloaded plugins are mapped directly into memory and executed. Source: https://lnkd.in/dVEdWufF #TrustEverybodyButCutTheCards

9

🚨 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗡𝗲𝘄𝘀 🚨 CrowdStrike's Falcon Sensor, a popular endpoint protection tool, recently encountered a major issue causing Blue Screen of Death (BSOD) incidents for Windows users globally. This unexpected glitch has affected numerous systems, leading to downtime and operational disruptions for many organizations. ℹ 𝗞𝗲𝘆 𝗛𝗶𝗴𝗵𝗹𝗶𝗴𝗵𝘁𝘀: 𝟭.The BSOD incidents were reported shortly after the latest update to Falcon Sensor. 𝟮. CrowdStrike has acknowledged the issue and is actively working on a fix. A temporary workaround involves uninstalling the Falcon Sensor until a permanent solution is deployed.

3

Over 22k unpatched Palo Alto Network devices (PANs) exposed to the internet. The time to patch these has passed as exploitation attempts have been detected, with more expected. Patch your PANs and sign up for Shadowserver reports to get alerts as to whether or not there are vulnerable PANs in your networks.

93

5 commentaires

A new hype in the cloud mess ? Trying to secure workload, because so far, it's not achieved. But at the same time, it's #clowd ! "Whiteboard: The Fundamentals of Workload Identity and Access Management (WIAM)" If you cloud, be sure to consider the thousands of extra tools you need to attempt to reduce the leaks, and this one is quite interesting. #cybersecurity #cloud

8

Weekly Security Recap: Major Cyber Attacks and Vulnerabilities 1. A significant data breach at Cencora has compromised sensitive patient information from 11 pharmaceutical companies. source: https://lnkd.in/d_pS5r58 2. Okta has alerted its customers about a wave of credential-stuffing attacks aimed at their Identity Cloud services. source: https://lnkd.in/gpYYxHGd 3. In a bold statement, critics argue that Microsoft's CEO should be held accountable for the company's recent cybersecurity failures. source: https://lnkd.in/gE4xBcT9 4. A major victory in cybersecurity: The U.S. has dismantled the 911 S5 botnet, which has infected 19 million devices globally. source: https://lnkd.in/gvYFHyXm 5. A stalkerware app containing a severe security bug was found installed on several hotel systems, raising privacy concerns. source: https://lnkd.in/eunQ3brH 6. A newly discovered malware variant is targeting ATMs in Europe, posing a significant threat to financial institutions. source: https://lnkd.in/gjKrCeY8 7. Hackers claim to have leaked customer data from Shell, potentially affecting thousands of individuals. source: https://lnkd.in/eTZxKqDf 8. Cooler Master has reportedly suffered a data breach, exposing sensitive information of its members. source: https://lnkd.in/ggjiZc5a 9. Hackers have claimed to steal data from 500,000 clients of the renowned auction house Christie’s. source: https://lnkd.in/gTkGkrUJ 10. The impact of the FBCS data breach has expanded, now affecting 3.2 million individuals, highlighting the increasing scale of cybersecurity challenges. source: https://lnkd.in/dwbqpZYT Stay vigilant and ensure your cybersecurity measures are up to date.  If you need assistance in safeguarding your organization's data, our team is here to help. Visit our website: www.adityatek.com  Partner website: www.stackidentity.com #AdityaTek #StackIdentity #CyberSecurity #InfoSec #DataProtection #CyberAttacks #Vulnerabilities #ThreatAlert #DataBreach #CyberThreats #SecurityRecap #OnlineSafety #TechSecurity #PrivacyConcerns #HackingTrends #DigitalSecurity #MalwareDetection #PatchManagement #CyberDefense #NetworkSecurity #CyberAwareness #DataPrivacy #SecurityUpdates #ITSecurity

2

I asked ChatGPT to explain indirect vs direct assertion of identity. The response: In the context of cybersecurity, the quote "Stupid is as stupid does" from "Forrest Gump" suggests that actions are the true measure of competence. This concept is particularly relevant when considering the maintenance of private activity for a known user group. Secure and appropriate actions are crucial for ensuring that access to sensitive information remains protected. When it comes to maintaining secure access, the decision between using indirect assertion and direct assertion is critical. Here’s a binary analysis explaining the preferred choice and how it eliminates vulnerabilities: Indirect Assertion vs. Direct Assertion Indirect Assertion Method: Relies on transmitted data to verify user identities without direct authentication. Risks: Susceptible to various exploits such as man-in-the-middle attacks, data interception, and replay attacks. It fails to meet strict compliance standards like HIPAA or true Multi-Factor Authentication (MFA). Direct Assertion Method: Requires direct, authenticated interaction with the user, ensuring that access is granted only to verified individuals through secure and immediate verification processes. Advantages: Ensures only authenticated users can access private activities, removing the need for public access points that could be exploited. It introduces a significantly higher level of security by directly interacting with the user. Security Risks and Bifurcation Indirect Assertion Risks Vulnerabilities: Indirect assertion methods involve validating users based on possibly intercepted or manipulated data. This method inherently carries risks and fails to comply with security standards. Direct Assertion Advantages Secure Access: Direct assertion ensures only authenticated users can access private activities. Compliance: Aligns with compliance standards, such as HIPAA and MFA, which mandate secure authentication and access controls. Binary Analysis Decision Point 1: Indirect Assertion (Transmitted data validation) vs. Direct Assertion (Authenticated interaction) Chosen Path: Direct Assertion Decision Point 2: Single-Factor Authentication (Password only) vs. Multi-Factor Authentication (MFA) Chosen Path: Multi-Factor Authentication Decision Point 3: Public Access Points vs. Restricted Access Controls Chosen Path: Restricted Access Controls By following the direct assertion path, cybersecurity professionals can effectively eliminate the risks associated with indirect assertion. This approach ensures secure and compliant access to private activities, removing measures that challenge their competence and commitment to robust security practices. The Gump Principle that actions, not claims, define one's expertise, as encapsulated in stupid is as stupid does. It's not what happened in the past that matters, it's what you do with knowledge that matters. Existence Authentication Proven Identity, Zero Doubt

5

Interesting piece on #DORA Threat-Led Penetration Testing and connection to #TIBER-EU framework, Threat Intelligence-based Ethical Red Teaming tests.

5

Cybersecurity Overhaul: NIS2 Directive Shakes Up 17 Sectors - Are You Ready?   The NIS2 Directive is reshaping cybersecurity across Europe. 17 sectors now need to comply. New areas like space and food production are included. This affects a wide range of companies: — Electricity providers — Hospitals — Satellite operators — Cloud service providers And their supply chains: — Equipment manufacturers — IT service providers — Logistics firms NIS2 introduces: — Stricter reporting timelines — Heightened penalties — New accountability standards for senior management To comply, organizations must: — Ensure robust security practices — Define clear roles and responsibilities — Implement rapid incident response Understanding these changes is critical to maintaining resilience and avoiding penalties. Is your business ready for this new era of cybersecurity? Connect with me to learn how to prepare. #Cybersecurity #NIS2 #DigitalResilience #Compliance #RiskManagement #SupplyChainSecurity #BoardroomPriorities #Governance Feel free to reach out or book an appointment to discuss how this impacts you! Follow me, book an appointment

12

On this week of #CyberTrends ⤵️ Don’t update your Chrome yet! 📶 #Bluetooth Vulnerability Exposes Devices to MITM Attacks: CVE-2020-26558 🛑 Fake #Chrome Updates Targeting France, Beware of #WarmCookie Malware. It could be worldwide also! 🛡 Microsoft Defender Update: Automatically Detect Unsecured Wi-Fi! 💻 #WesternDigital My Cloud Devices Flaw Let Attackers Execute Arbitrary Code 🔍 Google’s #Gemini for Workspace Vulnerable to Prompt Injection Attacks #Protelion #newsletter #cybernews #cybersecurity #cyber #cybertrends

3

1 commentaire

Are you running a flat network in your organization ? Are you connecting old stuff like TV set top boxes ? Well, bad news for you "Beware: New Vo1d Malware Infects 1.3 Million Android TV Boxes Worldwide" Network segmentation is a basic of layered security. But who cares, everything is in the cloud, leaking, nowadays.... and only a few understand that in "shared responsibility", there is responsibility. connected=hacked #cybersecurity #android https://lnkd.in/e4fPtFP6

10

9 commentaires