All posts in Uncategorized

■■■■■ Ransomware team ‘unseizes’ its site and issues new threats after FBI takedown Ransomware team ‘unseizes’ its site and issues new threats after the FBI takedown. The FBI, working with international authorities, says it has offered to help decrypt data for hundreds of victims of ALPHV / Blackcat team. https://www.theverge.com/2023/12/19/24008093/alphv-blackcat-ransomware-gang-site-seized-fbi-doj https://t.me/cKure/13371

■■■□□ BlackCat hacks accounting software provider Tipalti and threatens Roblox and Twitch. The operators of the BlackCat (ALPHV) ransomware said they had hacked accounting software provider Tipalti and stolen 256GB of data, including information from the company’s clients like Roblox and Twitch, which the hackers intend to blackmail separately. Representatives of Tipalti reported that they…

■■■□□ AlphvBlackCat ransomware. https://www.justice.gov/opa/pr/justice-department-disrupts-prolific-alphvblackcat-ransomware-variant https://t.me/cKure/13369

■■□□□ Unmasking Business Email Compromise: Safeguarding Organizations in the Digital Age. https://trustedsec.com/blog/unmasking-business-email-compromise-safeguarding-organizations-in-the-digital-age https://t.me/cKure/13368

Bad Zip and new Packer for Android/BianLian. https://cryptax.medium.com/bad-zip-and-new-packer-for-android-bianlian-5bdad4b90aeb https://t.me/cKure/13366

■■■■■ Remote Code execution at ws1.aholdusa.com — Compromising logins of Ahold Delhaize USA employees for >3.5 years (or even 18 years?). https://medium.com/@jonathanbouman/remote-code-execution-at-ws1-aholdusa-com-compromising-logins-of-ahold-delhaize-usa-employees-c7c9aca7e05d https://t.me/cKure/13365

■■■□□ Observed Exploitation Attempts of Struts 2 S2-066 Vulnerability (CVE-2023-50164). https://www.akamai.com/blog/security-research/apache-struts-cve-exploitation-attempts https://t.me/cKure/13364

■■■■□ Data-Leak: United States nuclear research lab data breach impacts 45,000 people. https://www.bleepingcomputer.com/news/security/us-nuclear-research-lab-data-breach-impacts-45-000-people/ https://t.me/cKure/13363

Whatsapp Spoofing impersonate of reply message All official WhatsApp clients, upon receiving a “Message Reply” payload (QuotedMessage), do not validate whether the “ContextInfo” of this “QuotedMessage” is valid/exists (“StanzaId” and “Participant”). This allows a malicious actor to send in private chats or groups a “QuotedMessage” of a message that never existed on behalf of another…

■■■■□ Bulk Analysis of Cobalt Strike’s Beacon Configurations. https://www.archcloudlabs.com/projects/bulk-cs-analysis/ https://t.me/cKure/13360