Daniel Fírvida

"These APT actors are having considerable success using publicly known CVEs to gain access to networks, so organizations are strongly encouraged to prioritize patching in a way that is proportionate to this threat, such as by sequencing patches to address the highest risks first." 🥳🥳

Spyware startup Variston is losing staff — some say it's closing | TechCrunch The Barcelona-based startup's malware has been used to target iPhones, Android devices and PCs running Windows Defender.

Barcelona-based spyware maker Variston seems to be shutting down. The company is comprised mainly of Israelis and their best-known customer is UAE. Do I expect all these folks to be working together under another name soon? Yes.

techcrunch.com/2024/02/15/v...

ℹ️ INFORMACIÓN DE INTERÉS PÚBLICO
Cómo sacarse el certificado digital de la FNMT en 5 minutos desde el sofá:

Resulta que la FNMT ha sacado una app móvil para poder hacerlo rápido y fácil... Y FUNCIONA. Es que sigo sin creérmelo. 🥹

🔗 El link con la info, aquí:
www.sede.fnmt.gob.es/certificados...

China mala.. new age. Como nadie más tiene vulnerabilidades... 🤔

GitHub - cisagov/ScubaGear: Automation to assess the state of your M365 tenant against CISA's baselines Automation to assess the state of your M365 tenant against CISA's baselines - cisagov/ScubaGear

Agencies will also have to run CISA's SCuBA tool to audit their Microsoft 365 tenants for common misconfigurations. Agencies will have to integrate the tool's result feeds with CISA's monitoring solutions by April 25.

github.com/cisagov/Scub...

CISA has ordered federal government agencies to review and secure their Microsoft cloud environments.

Federal agencies will be required to inventory and report all their cloud infrastructure to CISA by February 21, next year: www.cisa.gov/news-events/...

YouTube video by Virus Bulletin The Mask has been unmasked again - Georgy Kucherin & Marc Rivero López

Russian security firm Kaspersky says it spotted new activity from Careto, one of the oldest known APT groups.

Also known as The Mask, the group was first seen in 2007 and is believed to operate from a Spanish-speaking country.

securelist.com/careto-is-ba...

www.youtube.com/watch?v=d3DS...

Exploiting Device Authentication Vulns in Cloud-Managed IoT Devices

Zero Day Initiative — SolarWinds Access Rights Manager: One Vulnerability to LPE Them All Some time ago, I spent some time researching a core SolarWinds product, SolarWinds Platform (previously Orion Platform). At that time, I hadn’t been aware of the SolarWinds Access Right Manager produc...

In his latest blog, @chudypb.bsky.social covers a pre-auth Arbitrary File Deletion bug he discovered in the SolarWinds Access Rights Manager (ARM). It may not sound exciting, but it can lead to an LPE on domain-joined Windows machines. Read the details at www.zerodayinitiative.com/blog/2024/12...

GitHub - muditmathur2020/RansomwareDetection: Ransomware Detection using Machine Learning Models and Ensemble Technique Ransomware Detection using Machine Learning Models and Ensemble Technique - muditmathur2020/RansomwareDetection

Ransomware Detection Using ML Models
github.com/muditmathur2...
#ransomware #ml #detectionengineering #threathunting #threatdetection #infosec #cybersecurity

Romania's cybersecurity agency says the Lynx ransomware is behind the attack on the country's largest electricity provider

dnsc.ro/citeste/aler...

Per PAN, Lynx is allegedly a rebrand of the old INC gang: unit42.paloaltonetworks.com/inc-ransomwa...

For those of you involved in the energy sector (and indeed all others) here are the IOCs and YARA rules relating to the Lynx ransomware incident at the Romanian utility Electrica

dnsc.ro/citeste/aler...

Hola mundo. Aquí estamos a ver si este es un lugar más "limpio"