Cybersec Sentinel - Cybersec Sentinel (Page 10)

Cybersec Sentinel

Cybersec Sentinel: 30+ years of IT expertise, delivering clear, actionable cyber security insights.

Hadooken Malware Becomes a Growing Threat to WebLogic Infrastructure

Hadooken Malware Becomes a Growing Threat to WebLogic Infrastructure

Threat Group: Unclear attribution, though linked to prior infrastructure used by TeamTNT and 8220 Gang. Threat Type: Cryptominer and Botnet, with potential future ransomware connections. Exploited Vulnerabilities: Weak credentials and misconfigured Oracle WebLogic servers. Malware Used: Hadooken (deploys both a cryptominer and Tsunami botnet). Threat Score: High (7.5/10)

The Scattered Spider Group Ramps Up Cloud Attacks

The Scattered Spider Group Ramps Up Cloud Attacks

Threat Group: Scattered Spider Threat Type: Cybercrime Group (Focused on Cloud Environments, Ransomware) Exploited Vulnerabilities: Azure Cross-Tenant Synchronization, Federated Identity Providers, Cloud Platforms Malware Used: AlphV ransomware Threat Score: High (8.8/10) — Due to its sophisticated exploitation of cloud-based systems, privilege escalation methods, and use of advanced tools for

RansomHub Affiliate NoName Group Launches ScRansom Attacks

RansomHub Affiliate NoName Group Launches ScRansom Attacks

Threat Group: NoName (formerly known as CosmicBeetle) Threat Type: Ransomware (Part of the Spacecolon malware family) Exploited Vulnerabilities: CVE-2017-0144 (EternalBlue), CVE-2023-27532 (Veeam Backup), CVE-2020-1472 (ZeroLogon), and others Malware Used: ScRansom, LockBit variants, RansomHub Threat Score: High (8.5/10) – Due to its focus on SMBs and evolving encryption methods Last

Mustang Panda Expands Global Espionage with FDMTP and PUBLOAD

Mustang Panda Expands Global Espionage with FDMTP and PUBLOAD

Threat Group: Mustang Panda (also known as Earth Preta, Bronze President, HoneyMyte) Threat Type: Cyber-Espionage Exploited Vulnerabilities: Phishing, DLL Side-loading, Removable Media Propagation Malware Used: PUBLOAD, FDMTP, PTSOCKET, HIUPAN Worm Threat Score: Critical (9.0/10) — Due to widespread targeting of government entities, advanced data exfiltration techniques, and consistent evolution

Configuring FIDO2 Keys for Passwordless Authentication in Entra ID

Configuring FIDO2 Keys for Passwordless Authentication in Entra ID

Complete Guide to Implementing Passwordless Authentication with FIDO2 in an Entra ID and Intune Environment for Windows 10 and 11 Devices Contents 1. Introduction 2. Prerequisites 3. Step 1: Enable FIDO2 Security Keys in Entra ID 4. Step 2: Restrict FIDO2 Key Models Based on AAGUIDs 5. Step 3: Enable

Make Cybersecurity Easier with Bulk IoC Importing into Microsoft Defender for Endpoints

Make Cybersecurity Easier with Bulk IoC Importing into Microsoft Defender for Endpoints

Step-by-Step Instructions for Importing IoCs: 1. Log in to Microsoft 365 Defender: * Go to the Microsoft 365 Defender portal at security.microsoft.com and log in with your administrator credentials. 2. Access the Indicators Section: * Navigate to Settings -> Rules -> Indicators. This section allows you to manage

Fake LinkedIn Job Offers Hide Dangerous Malware

Fake LinkedIn Job Offers Hide Dangerous Malware

Threat Type: Malware (Dropper and Payload) Exploited Vulnerabilities: macOS systems, social engineering (LinkedIn) Malware Used: COVERTCATCH Threat Score: High (8.2/10) — Targeting macOS and Web3 developers with sophisticated social engineering tactics. Last Threat Observation: September 7, 2024, reported by Vumetric, Mandiant, and other platforms. Overview: A new malware campaign,

Angry Stealer Malware - A Sophisticated Data Theft Tool on the Rise

Angry Stealer Malware - A Sophisticated Data Theft Tool on the Rise

Threat Group: Unknown Threat Type: Info-stealing malware Exploited Vulnerabilities: User accounts, browser data, cryptocurrency wallets Malware Used: Stepasha.exe, MotherRussia.exe Threat Score: High (8.0/10) — Due to its ability to exfiltrate sensitive data stealthily via Telegram and the comprehensive data it targets. Last Threat Observation: September 2024, observed

Minecraft Under Siege: Record-Breaking 3.15 Billion Packet DDoS Attack Marks a New Era of Cyber Threats

Minecraft Under Siege: Record-Breaking 3.15 Billion Packet DDoS Attack Marks a New Era of Cyber Threats

Threat Details: * Threat Group: Unknown (Utilised multiple botnets) * Threat Type: Distributed Denial of Service (DDoS) * Exploited Vulnerabilities: Devices vulnerable to CVE-2023-2231 (e.g., DrayTek Vigor routers, Hikvision IP cameras) * Malware Used: Not specified, but botnets were leveraged * Threat Score: High (9/10) — Due to the unprecedented packet rate and multi-vector

Rust-Based Cicada3301 Targets Virtual Machines and Critical Systems

Rust-Based Cicada3301 Targets Virtual Machines and Critical Systems

Threat Group: Cicada3301 Ransomware Operators Threat Type: Ransomware-as-a-Service (RaaS) Exploited Vulnerabilities: Poorly secured VMware ESXi systems, Weak Passwords, Brute-forcing via Brutus botnet Malware Used: Cicada3301 Ransomware Threat Score: High (8.5/10) — Due to its focus on critical infrastructure (VMware ESXi), advanced encryption techniques, and cross-platform targeting capabilities. Overview Cicada3301