SANS Internet Storm Center's Daily Network Security News Podcast

SANS ISC Stormcast, Jan 13, 2025: Defender Updates, Ivanti RCE, Apple USB-C Hack and more In today's episode, we cover the latest updates in cybersecurity: Windows Defender Enhances Chrome Extension Detection Microsoft's Defender now catalogs Chrome extensions to identify malicious ones. Learn how this improves enterprise security. https://isc.sans.edu/diary/Windows%20Defender%20Chrome%20Extension%20Detection/31574 Multi-OLE Analysis in Malicious Documents A look at how attackers embed OLE files in Office documents to evade detection and the tools to combat it. https://isc.sans.edu/diary/Multi-OLE/31580 Ivanti Connect Secure RCE Vulnerability (CVE-2025-0282) Details of a critical vulnerability affecting Ivanti products and the patching timelines. https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/ Apple USB-C Controller Compromised Researchers hacked Apple's ACE3 USB-C controller, highlighting hardware security challenges. https://cybersecuritynews.com/apples-new-usb-c-controller-hacked/ IRS Pushes for IP PIN Enrollment Protect yourself from tax-related identity theft by securing your IP PIN for the 2025 tax season. https://www.irs.gov/newsroom/irs-encourages-all-taxpayers-to-sign-up-for-an-ip-pin-for-the-2025-tax-season keywords: irs; ip; pin; apple; usb-c; ivanty; rce; ole; ooxml; extensions; chrome; defender

Cryptomining Malware, Fake PoC Exploit, Malicious Browser Extensions, and Palo Alto Vulnerabilities In this episode, we explore the following stories: "Examining Redtail: Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics" Overview of Redtail's multi-architecture cryptomining malware exploiting vulnerabilities and deploying persistence techniques. URL: Examining Redtail: Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics "Information Stealer Masquerades as LDAPNightmare PoC Exploit" A malware disguised as a PoC exploit targets users seeking to test vulnerabilities like LDAPNightmare. URL: Information Stealer Masquerades as LDAPNightmare PoC Exploit "How Extensions Trick CWS Search" Research reveals how malicious browser extensions manipulate Chrome Web Store search to appear legitimate. URL: How Extensions Trick CWS Search "Palo Alto Networks' Expedition Vulnerabilities (PAN-SA-2025-0001)" Multiple vulnerabilities in the deprecated Expedition tool can expose credentials and lead to unauthorized file and command execution. URL: Palo Alto Networks' Expedition Vulnerabilities (PAN-SA-2025-0001) keywords: palo alto; chrome web store; extensions; chrome; google; fake exploits; ldap; cryptomining; redtail

SANS ISC Stormcast, Jan 9, 2025: Critical Vulnerabilities in Ivanti, Aviatrix, and Hijacked Backdoors in Compromised Systems In this episode, we discuss critical vulnerabilities in Ivanti Connect Secure and Policy Secure, command injection risks in Aviatrix Network Controllers, and the risks posed by hijacked abandoned backdoors. Episode Links and Topics: More Governments Backdoors in Your Backdoors https://labs.watchtowr.com/more-governments-backdoors-in-your-backdoors/ Researchers reveal how expired domains linked to abandoned backdoors can be hijacked, exposing systems to further compromise. Security Update: Ivanti Connect Secure, Policy Secure, and Neurons for ZTA Gateways https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways Ivanti addresses critical vulnerabilities (CVE-2025-0282, CVE-2025-0283) in their secure gateway products, with active exploitation in the wild. CVE-2024-50603: Aviatrix Network Controller Command Injection Vulnerability https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/ A command injection vulnerability in Aviatrix Network Controllers allows unauthenticated code execution, posing severe risks to network environments. keywords: aviatrix; ivanti; backdoors; domains; dumpster diving;

SANS ISC Stormcast, Jan 8, 2025: Critical Vulnerabilities in SonicWall, Moxa, and Windows BitLocker – Plus, Malware Targets PHP Servers and the Launch of U.S. Cyber Trust Mark In this episode, we dive into active exploitation of a zero-day in SonicWall SSL-VPN, privilege escalation vulnerabilities in Moxa devices, and a BitLocker bypass in Windows 11. We also cover cryptocurrency mining malware hitting PHP servers and the White House's launch of the U.S. Cyber Trust Mark to secure connected devices. Episode Links and Topics: PacketCrypt Classic Cryptocurrency Miner on PHP Servers https://isc.sans.edu/diary/PacketCrypt%20Classic%20Cryptocurrency%20Miner%20on%20PHP%20Servers/31564 Malware exploiting PHP servers to mine PacketCrypt Classic cryptocurrency. SonicOS Affected By Multiple Vulnerabilities https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003 A zero-day vulnerability in SonicWall SSL-VPN devices is under active attack. Privilege Escalation and OS Command Injection Vulnerabilities in Moxa Devices https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241155-privilege-escalation-and-os-command-injection-vulnerabilities-in-cellular-routers,-secure-routers,-and-netwo Critical vulnerabilities in Moxa routers and security appliances allow privilege escalation and OS command injection. White House Launches U.S. Cyber Trust Mark https://www.whitehouse.gov/briefing-room/statements-releases/2025/01/07/white-house-launches-u-s-cyber-trust-mark-providing-american-consumers-an-easy-label-to-see-if-connected-devices-are-cybersecure/ A new cybersecurity labeling program for connected devices aims to help consumers choose secure products. Windows BitLocker: Screwed without a Screwdriver https://media.ccc.de/v/38c3-windows-bitlocker-screwed-without-a-screwdriver#t=761 (video in English) A two-year-old vulnerability in Windows 11 allows bypassing BitLocker encryption. keywords: bitlocker; windows; cyber trust mark; moxa; sonicos; packetcrypt; php

SANS ISC Stormcast Jan 7th 2025: Make Malware Happy and Critical Vulnerabilities in OpenSSH, BeyondTrust, and Nuclei In this episode of the SANS Internet Storm Center's Stormcast, we cover critical vulnerabilities affecting OpenSSH, BeyondTrust, and Nuclei, including the newly discovered "RegreSSHion" flaw and a bypass vulnerability in Nuclei. We also discuss how malware evasion techniques can impact analysis environments and highlight the dangers of fake exploits targeting researchers. Tune in for insights on patching, mitigation strategies, and staying ahead of emerging threats. Topics Covered: Make Malware Happy https://isc.sans.edu/diary/Make%20Malware%20Happy/31560 A look at how malware adapts and detects analysis environments, and why replicating operational settings is critical during malware analysis. Nuclei Signature Verification Bypass (CVE-2024-43405) https://www.wiz.io/blog/nuclei-signature-verification-bypass A critical vulnerability in Nuclei allows malicious templates to bypass signature verification, risking arbitrary code execution. Critical Vulnerability in BeyondTrust (CVE-2024-12356) https://censys.com/cve-2024-12356/ A high-risk flaw in BeyondTrust products allows unauthenticated OS command execution, posing a significant threat to privileged access systems. RegreSSHion Code Execution Vulnerability (CVE-2024-6387) https://cybersecuritynews.com/regresshion-code-execution-vulnerability/ OpenSSH vulnerability "RegreSSHion" enables remote code execution, and fake exploits targeting security researchers are in circulation. keywords: openssh, regresshion, beyondtrust, nuclei, malware, evasion, rce

PPUnit and Androxgh0st; Session Smart Router Attack; FortiWLM Patch; BadBox Update; Beyond Trust Advisory PHPUnit and Androxgh0st https://isc.sans.edu/diary/Command%20Injection%20Exploit%20For%20PHPUnit%20before%204.8.28%20and%205.x%20before%205.6.3%20%5BGuest%20Diary%5D/31528 Mirai Attacks Session Smart Routers https://supportportal.juniper.net/s/article/2024-12-Reference-Advisory-Session-Smart-Router-Mirai-malware-found-on-systems-when-the-default-password-remains-unchanged?language=en_US FortiWLM Unauthenticated limited file read vulnerability https://fortiguard.fortinet.com/psirt/FG-IR-23-144 https://securityonline.info/kaspersky-uncovers-active-exploitation-of-fortinet-vulnerability-cve-2023-48788/ Beyond Trust Security Advisory https://www.beyondtrust.com/trust-center/security-advisories/bt24-10 BadBox Update https://www.bitsight.com/blog/badbox-botnet-back keywords: badbox; beyond trust; fortiwlm; fortinet; mirai; phpunit; androxgh0st

TeamTNT Deep Diver; Complex RDP Attacks; Okta Social Engineering; TP-Link Ban A Deep Dive into TeamTNT and Spinning YARN https://isc.sans.edu/diary/%5BGuest%20Diary%5D%20A%20Deep%20Dive%20into%20TeamTNT%20and%20Spinning%20YARN/31530 Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks https://www.trendmicro.com/en_us/research/24/l/earth-koshchei.html Okta Social Engineering Impersonation Report https://sec.okta.com/articles/2024/okta-social-engineering-report-response-and-recommendation US considers banning TP-Link routers over cybersecurity risks https://www.bleepingcomputer.com/news/security/us-considers-banning-tp-link-routers-over-cybersecurity-risks/ CISA Releases Best Practice Guidance for Mobile Communications https://www.cisa.gov/news-events/alerts/2024/12/18/cisa-releases-best-practice-guidance-mobile-communications keywords: cisa; mobile; tp-link; okta; koshchei; rdp; teamtnt; yarn;

Python Installs Anydesk; Vishing, Teams and Anydesk; SS7 Attacks; CrushFTP Vuln; Python Delivering AnyDesk Client as RAT https://isc.sans.edu/diary/Python+Delivering+AnyDesk+Client+as+RAT/31524/ Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion https://www.trendmicro.com/en_us/research/24/l/darkgate-malware.html SS7 Attacks https://www.404media.co/email/ac709882-1e4b-42fc-bcca-cf7ce4793716/ CrushFTP Vulnerability https://crushftp.com/crush11wiki/Wiki.jsp?page=Update keywords: crushftp; ss7; vishing; teams; python; anydesk;

MUT-1244 Targeting Offensive Actors; Golang SSH Issue; Meeten Malware MUT-1244 Targeting Offensive Actors https://securitylabs.datadoghq.com/articles/mut-1244-targeting-offensive-actors/ Golang Crypto Vulnerability https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows https://www.cadosecurity.com/blog/meeten-malware-threat keywords: meeten; malware; voip; video conference; golang; crypto; mut-1244;

Struts 2 Exploited; Citrix Password Spraying; 6 Day Certs; Certified Pre-Pw0n3d Exploit Attempts Inspired by Recent Struts 2 File Upload Vulnerability https://isc.sans.edu/diary/Exploit%20attempts%20inspired%20by%20recent%20Struts2%20File%20Upload%20Vulnerability%20%28CVE-2024-53677%2C%20CVE-2023-50164%29/31520 Citrix Netscaler Password Spraying Mitigation https://www.citrix.com/blogs/2024/12/13/password-spraying-attacks-netscaler-december-2024/ Let's Encrypt Six Day Certifiates https://letsencrypt.org/2024/12/11/eoy-letter-2024/ Devices in Germany Arrived Pre-Pw0n3d https://cybersecuritynews.com/30000-devices-in-germany-discovered-with-pre-installed-malware-badbox/ keywords: germany; badbox; lets encrypt; citrix;

Windows 11 and TPM; Azure MFA Bypass; Struts 2 Vuln; Secret Blizzard vs Ukraine Windows 11 and TPM https://techcommunity.microsoft.com/blog/windows-itpro-blog/tpm-2-0-%E2%80%93-a-necessity-for-a-secure-and-future-proof-windows-11/4339066 https://www.forbes.com/sites/zakdoffman/2024/12/12/microsoft-warns-400-million-windows-users-do-not-update-your-pc/ Microsoft Azure MFA Bypass https://www.oasis.security/resources/blog/oasis-security-research-team-discovers-microsoft-azure-mfa-bypass Struts 2 Arbitrary File Upload CVE-2024-53677 https://cwiki.apache.org/confluence/display/WW/S2-067 Russian actor Secret Blizzard using tools of other groups to attack Ukraine https://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/ keywords: secret blizzard; ukraine; struts; azure; mfa; windows 11; tpm

vSphere Scans; Apple Updates; Cleo Vuln; Vulnerability Symbiosis: vSphere's CVE-2024-38812 and CVE-2024-38813 https://isc.sans.edu/diary/Vulnerability%20Symbiosis%3A%20vSphere%3Fs%20CVE-2024-38812%20and%20CVE-2024-38813%20%5BGuest%20Diary%5D/31510 Apple Updates Everything (iOS, iPadOS, macOS, watchOS, tvOS, visionOS) https://isc.sans.edu/diary/Apple+Updates+Everything+iOS+iPadOS+macOS+watchOS+tvOS+visionOS/31514/ Widespread exploitation of Cleo file transfer software (CVE-2024-50623) https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild https://labs.watchtowr.com/cleo-cve-2024-50623/ keywords: cleo; apple; vsphere; vmware

MSFT Patch Tuesday; Ivanti Vuln; Visual Studio Code Tunnels; Mitigating NTLM Relay Attacks Microsoft Patch Tuesday December 2024 https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%3A%20December%202024/31508 Ivanty Security Advisory https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773?language=en_US Visual Studio Code Tunnels https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/ Mitigating NTLM Relay Attacks https://msrc.microsoft.com/blog/2024/12/mitigating-ntlm-relay-attacks-by-default/ keywords: ntlm; ivanti; visual studio code; microsoft; patch; tuesday

CURLing DDoS; OpenWRT Vuln; Android Update; RCS Not Always Encrypted CURLing for Crypto on Honeypots https://isc.sans.edu/diary/CURLing%20for%20Crypto%20on%20Honeypots/31502 Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection https://flatt.tech/research/posts/compromising-openwrt-supply-chain-sha256-collision/ Android Monthly Update https://source.android.com/docs/security/bulletin/pixel/2024-12-01 RCS Not Always Encrypted https://daringfireball.net/linked/2024/12/04/shame-on-google-messages keywords: rcs; android; openwrt; curl; ddos; crypto

Version Cookies; URL File NTLM Leak; Ultralytics Miner; DaMAgeCard Bypassing WAFs with the Phantom Version Cookie https://portswigger.net/research/bypassing-wafs-with-the-phantom-version-cookie URL File NTLM Hash Disclosure https://blog.0patch.com/2024/12/url-file-ntlm-hash-disclosure.html Ultralytics Library Infected with Miner https://github.com/ultralytics/ultralytics/issues/18027#issuecomment-2521578169 DaMAgeCard attack targets memory directly thru SD card reader https://swarm.ptsecurity.com/new-dog-old-tricks-damagecard-attack-targets-memory-directly-thru-sd-card-reader/ keywords: damagecard; ultralytics; miner; ntml; url file; waf; version; cookie

BEC Step by Step; Mital MiCollab PoC; Lorex Camera, HPE Aruba Vuln; Business E-Mail Compromise https://isc.sans.edu/diary/%5BGuest%20Diary%5D%20Business%20Email%20Compromise/31474 Where There's Smoke, There's Fire - Mitel MiCollab CVE-2024-35286, CVE-2024-41713 And An 0day https://labs.watchtowr.com/where-theres-smoke-theres-fire-mitel-micollab-cve-2024-35286-cve-2024-41713-and-an-0day/ https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 Lorex 2K Indoor Wi-Fi Security Camera https://www.rapid7.com/globalassets/_pdfs/research/pwn2own-iot-2024-lorex-2k-indoor-wi-fi-security-camera-research.pdf https://www.lorex.com/products/2k-indoor-wi-fi-security-camera HPE Aruba Vulnerabilities https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04761en_us&docLocale=en_US Alan Paller Inducted into the Cybersecurity Hall of Fame https://cybersecurityhalloffame.org/ keywords: alan paller; lorex; hp; aruba; hpe; mitel; micollab; bec

Importance of Data Analysis; Stop using SMS; Identity IQ vuln; Solana web3.js Backdoor Data Analysis: The Unsung Hero of Cybersecurity Expertise https://isc.sans.edu/diary/Data%20Analysis%3A%20The%20Unsung%20Hero%20of%20Cybersecurity%20Expertise%20%5BGuest%20Diary%5D/31494 FBI Warns iPhone and Android Users Stop Sending Texts https://www.forbes.com/sites/zakdoffman/2024/12/03/fbi-warns-iphone-and-android-users-stop-sending-texts/ IdentityIQ Improper Access Control Vulnerability – CVE-2024-10905 https://www.sailpoint.com/security-advisories/identityiq-improper-access-control-vulnerability-cve-2024-10905 Solana web3.js Backdoor https://socket.dev/blog/supply-chain-attack-solana-web3-js-library keywords: data analysis; fbi; sms; rcs; identityiq; solana; web3.js; encryption; backdoor

Files in Word; Sat Receiver DDoS Agent; Veeam Vuln; CVE-2024-49039 PoC; Extracting Files Embedded Inside Word Documents https://isc.sans.edu/diary/Extracting%20Files%20Embedded%20Inside%20Word%20Documents/31486 Korea arrests CEO for adding DDoS feature to satellite receivers https://www.bleepingcomputer.com/news/security/korea-arrests-ceo-for-adding-ddos-feature-to-satellite-receivers/ Veeam Vulnerabilities https://www.veeam.com/kb4679 WPTaskScheduler Presistence and CVE-2024-49039 PoC https://github.com/je5442804/WPTaskScheduler_CVE-2024-49039 keywords: word; satteliter; korea; receiver; ddoc; veeam; wptaksscheduler; scheduler;

Credential Guard; AWS Key Rotation; Corrupt Document Phishing; IBM Security Verify Access Appliance vuln; Credential Guard and Kerberos delegation https://isc.sans.edu/diary/Credential%20Guard%20and%20Kerberos%20delegation/31488 The Day We Unveiled the Secret Rotation Illusion https://www.clutch.security/blog/the-day-we-unveiled-the-secret-rotation-illusion Corrupt Word Documents used in Phshing https://x.com/anyrun_app/status/1861024182210900357 IBM Security Verify Access Appliance Vulnerabilities https://www.ibm.com/support/pages/security-bulletin-multiple-security-vulnerabilities-were-found-ibm-security-verify-access-appliance-cve-2024-49803-cve-2024-49804-cve-2024-49805-cve-2024-49806 keywords: ibm; credentials; static; word; corrupt; aws; keys; apis; credential guard;

AWS Honeypot+SIEM; Obfuscated Infostealer; Magento Skimmer; LogoFAIL Exploit; AWS DShield Sensor + DShield SIEM https://isc.sans.edu/diary/SANS%20ISC%20Internship%20Setup%3A%20AWS%20DShield%20Sensor%20%2B%20DShield%20SIEM%20%5BGuest%20Diary%5D/31480 From a Regular Infostealer to its Obfuscated Version https://isc.sans.edu/diary/From%20a%20Regular%20Infostealer%20to%20its%20Obfuscated%20Version/31484 Credit Card Skimmer Malware Targeting Magento Checkout Pages https://blog.sucuri.net/2024/11/credit-card-skimmer-malware-targeting-magento-checkout-pages.html LogoFAIL Exploited to Deploy Bootkitty, the first UEFI bootkit for Linux https://www.binarly.io/blog/logofail-exploited-to-deploy-bootkitty-the-first-uefi-bootkit-for-linux Stickers: https://isc.sans.edu/stickers.html (code PODCAST) keywords: stickers; logofail; bootkitty; skimmer; magento; infostealer; obfuscation; aws; dshield; sensor; siem

Network Detection for Redtail; Next Neighbor; NachoVPN; Keycloak, PAN and Patches Using Zeek, Snort, and Grafana to Detect Crypto Mining Malware https://isc.sans.edu/diary/%5BGuest%20Diary%5D%20Using%20Zeek%2C%20Snort%2C%20and%20Grafana%20to%20Detect%20Crypto%20Mining%20Malware/31472 The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/ Introducing NachoVPN: One VPN Server to Pwn Them All https://blog.amberwolf.com/blog/2024/november/introducing-nachovpn---one-vpn-server-to-pwn-them-all/ Keycloak Patches https://github.com/keycloak/keycloak/security/advisories/GHSA-93ww-43rr-79v3 Palo Alto Networks Global Protect App https://security.paloaltonetworks.com/CVE-2024-5921 PHP Updates https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff keywords: php; pan; keycloak; nachovpn; miner; wifi; next neighbor

Quick JS Deobfuscation; PDFs with Passwords; Less Russian Servers; QNAP Bug; 7-ZIP Bug; Quick & Dirty Obfuscated JavaScript Analysis https://isc.sans.edu/diary/Quick%20%26%20Dirty%20Obfuscated%20JavaScript%20Analysis/31468 Decrypting a PDF With a User Password https://isc.sans.edu/diary/Decrypting%20a%20PDF%20With%20a%20User%20Password/31466 The strange case of disappearing Russian servers https://isc.sans.edu/diary/The%20strange%20case%20of%20disappearing%20Russian%20servers/31476 QNAP Buggy Firmware Update https://community.qnap.com/t/firmware-qts-5-2-2-2950-build-20241114-released/254 7-ZIP Zstandard Decompression Integer Underflow https://www.zerodayinitiative.com/advisories/ZDI-24-1532/ https://7-zip.org/download.html keywords: 7zip; qnap; russia; servers; shodan; pdf; javascript

SVG Phishing; FortiClient VPN Logging; Needrestart Vuln; Increase In Phishing SVG Attachments https://isc.sans.edu/diary/Increase%20In%20Phishing%20SVG%20Attachments/31456 Logging blind spot revealed in FortiClient VPN https://pentera.io/blog/FortiClient-VPN_logging-blind-spot-revealed/ Needrestart Vulnerability https://www.qualys.com/2024/11/19/needrestart/needrestart.txt keywords: needrestart; logging; forticlient; phishing; svg

Apple Patches; Oracle PLM Vulns; OFBiz Patches; D-Link EOL Product Vulns Apple Patches Two Exploited Vulnerabilities https://isc.sans.edu/diary/Apple%20Fixes%20Two%20Exploited%20Vulnerabilities/31452 Oracle Patch for Agile Product Lifecycle Management CVE-2024-21287 https://www.oracle.com/security-alerts/alert-cve-2024-21287.html OFBiz Patches CVE-2024-47208 CVE-2024-48962 https://nvd.nist.gov/vuln/detail/CVE-2024-47208 https://seclists.org/oss-sec/2024/q4/95 D-Link Warns of Vulnerability in EOL Devices https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10415 keywords: ofbiz; d-link; oracle; apple

Unpatched Citrix Vuln Exploited; Microsoft Power Pages Issues; Manageengine ADAudit Plus SQL Injection Exploit attempts for unpatched Citrix vulnerability CVE-2024-8068/CVE-2024-8069 https://isc.sans.edu/diary/Exploit+attempts+for+unpatched+Citrix+vulnerability/31446 https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US Microsoft Power Pages: Data Exposure Reviewed https://appomni.com/ao-labs/microsoft-power-pages-data-exposure-reviewed/ Zohocorp ManageEngine ADAudit Plus Vulnerable To SQL Injection Attacks CVE-2024-49574 https://www.manageengine.com/products/active-directory-audit/cve-2024-49574.html keywords: zohocorp; manageengine; adaudit; microsoft; power pages; ctrix

Ancient Vulns; GitHub Impersonations; PaloAlto and Fortinet still not secure Ancient TP-Link Backdoor Discovered by Attackers https://isc.sans.edu/diary/Ancient%20TP-Link%20Backdoor%20Discovered%20by%20Attackers/31442 GitHub Projects Targeted with Malicious Commits To Frame Researchers https://www.bleepingcomputer.com/news/security/github-projects-targeted-with-malicious-commits-to-frame-researcher/ PaloAlto and Fortinet Vulnerabilities https://labs.watchtowr.com/hop-skip-fortijump-fortijumphigher-cve-2024-23113-cve-2024-47575/ https://security.paloaltonetworks.com/PAN-SA-2024-0015 https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata/ keywords: paloalto; pan; fortinet; github; impersonation; tp-link;

Microsoft Patch Tuesday; CISA Top Exploited Vulns; APT Embeds Malware Using Flutter Microsoft November 2024 Patch Tuesday https://isc.sans.edu/diary/Microsoft%20November%202024%20Patch%20Tuesday/31438 CISA Top Routinely Exploited Vulnerabilities https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-317a APT Actors Embed Malware within macOS Flutter Applications https://www.jamf.com/blog/jamf-threat-labs-apt-actors-embed-malware-within-macos-flutter-applications/ keywords: apt; macos; flutter; cisa; microsoft; patches

PDF Phish Analysis; Mazda Vulns; Ruby SAML Vuln Details; Veeam Vuln; Fake FBI EDRs; PDF Object Streams https://isc.sans.edu/diary/PDF%20Object%20Streams/31430 Mazda Infotainment Vulnerabilities https://www.zerodayinitiative.com/blog/2024/11/7/multiple-vulnerabilities-in-the-mazda-in-vehicle-infotainment-ivi-system Ruby SAML CVE-2024-45409: As bad as it gets and hiding in plain sight https://workos.com/blog/ruby-saml-cve-2024-45409 Veeam Backup Enterprise Manager Vulnerability https://www.veeam.com/kb4682 Security Update for Dell Enterprise SONiC Distribution Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities Easy Access to Information for Conducting Fraudulent Emergency Data Requests Impacts US-Based Companies and Law Enforcement Agencies https://www.ic3.gov/CSA/2024/241104.pdf keywords: fbi; dell; sonic; veeam; workos; ruby; saml; pdf; pdfid; pdf-parser

zipdump and PKZIP; Am I Isolated; iOS Lock Reboot; PAN Bulletin; D-Link Vulns zipdump and pkzip records https://isc.sans.edu/diary/zipdump%20%26%20PKZIP%20Records/31428 Am I Isolated https://github.com/edera-dev/am-i-isolated Locked iPhones Reboot https://www.404media.co/police-freak-out-at-iphones-mysteriously-rebooting-themselves-locking-cops-out/ https://x.com/naehrdine/status/1854896392797360484 Palo Alto Networks Bulletin https://security.paloaltonetworks.com/PAN-SA-2024-0015 D-Link Vulnerability https://netsecfish.notion.site/Command-Injection-Vulnerability-in-name-parameter-for-D-Link-NAS-12d6b683e67c80c49ffcc9214c239a07 keywords: dlink; palo alto networks; pan; pan-os; iphones; docker; isolated; zipbdump; pkzip

Malicious Steam Bruteforcer; Cisco and Veem Patches; ZIP file issues; File Upload Dangers; Steam Account Checker Poisoned with Infostealer https://isc.sans.edu/diary/Steam%20Account%20Checker%20Poisoned%20with%20Infostealer/31420 Cisco Ultra Reliable Wireless Backhaul Vulnerability https://www.cisco.com/site/us/en/products/networking/industrial-wireless/ultra-reliable-wireless-backhaul/index.html Breaking Down Multipart Parsers: File upload validation bypass https://blog.sicuranext.com/breaking-down-multipart-parsers-validation-bypass/ Evasive ZIP Concatenation: Trojan Targets Windows Users https://perception-point.io/blog/evasive-concatenated-zip-trojan-targets-windows-users/ Veeam Backup Enterprise Manager Vulnerability (CVE-2024-40715) https://www.veeam.com/kb4682 SANS Holiday Hack Challenge https://www.sans.org/mlp/holiday-hack-challenge-2024 keywords: holiday; hack; challenge; sans; veeam; backup; zip; concatentation; file upload; parser; cisco; steam;

Web Attack Surge; Air Fryer Privacy; Pygmy Goat Malware; Apple Vuln PoC; HPE Aruba critical vuln Insights from August Web Traffic Surge https://isc.sans.edu/forums/diary/%5BGuest%20Diary%5D%20Insights%20from%20August%20Web%20Traffic%20Surge/31408/ Talkative Air Fryer https://www.which.co.uk/policy-and-insight/article/why-is-my-air-fryer-spying-on-me-which-reveals-the-smart-devices-gathering-your-data-and-where-they-send-it-a9Fa24K6gY1c Pygmy Goat Malware Report https://www.ncsc.gov.uk/section/keep-up-to-date/malware-analysis-reports Apple CVE-2024-44258 PoC Exploit https://github.com/ifpdz/CVE-2024-44258 HPE Arruba vulnerabilities https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US keywords: hpe; arruba; apple; Poc; pygmy; goat

Python RAT Screen Share; Android Security Bulletin; VMs Delivery Malware; Fake Docusign Invoices Python RAT with a Nice Screensharing Feature https://isc.sans.edu/diary/Python%20RAT%20with%20a%20Nice%20Screensharing%20Feature/31414 Android Security Bulletin November 2024 https://source.android.com/docs/security/bulletin/2024-11-01 Malware Delivered as Virtual Machine https://www.securonix.com/blog/crontrap-emulated-linux-environments-as-the-latest-tactic-in-malware-staging/ Fake Docusign Invoices https://lab.wallarm.com/attackers-abuse-docusign-api-to-send-authentic-looking-invoices-at-scale/ keywords: docusign; malware; vm; android; november; python; rat; screensharing

Analyzing Encrypted PDFs; Okta Passwordless Password Leak; QuRouter Patch; Google AI Tool finds SQLite vuln Analyzing an Encrypted Phishing PDF https://isc.sans.edu/diary/Analyzing%20an%20Encrypted%20Phishing%20PDF/31404 Okta Verify Desktop MFA For Windows Password Less Login CVE-2024-9191 https://trust.okta.com/security-advisories/okta-verify-desktop-mfa-for-windows-passwordless-login-cve-2024-9191/ QNAP QuRouter Vulnerability and Patch https://www.qnap.com/en/security-advisory/qsa-24-45 From Naptime to Big Sleep https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html Authenticated SQL injection vulnerability - ManageEngine ADManager Plus CVE-2024-48878 https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2024-48878.html keywords: zoho; manage engine; admanager; naptime; big sleep; qnap; qurouter; Okta; PDF; qpdf; pdf-parser;

Odd SSH Username; QPDF; Okta bcrypt issue; Synology Patches; Fake Lastpass Reviews; October Activity with Username chenzilong https://isc.sans.edu/diary/October%202024%20Activity%20with%20Username%20chenzilong/31400 qpdf Extracting PDF Streams https://isc.sans.edu/diary/qpdf%3A%20Extracting%20PDF%20Streams/31406 Okta bcrypt issue https://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username/ https://medium.com/@rajat29gupta/how-bcrypts-limitations-contributed-to-okta-s-vulnerability-a-lesson-for-developers-39425c644ed5 Synology Vulnerabilities https://www.synology.com/de-de/security/advisory/Synology_SA_24_19 https://www.synology.com/de-de/security/advisory/Synology_SA_24_18 Lastpass Fake Reviews https://blog.lastpass.com/posts/fake-web-store-reviews-attempting-to-steal-customer-data keywords: lastpass; synology; brcrypt; okta; chenzilong; qpdf;

RDP Gateway Scans; CyberPanel Exploited; QNAP Patches; Facebook Malvertising Scans for RDP Gateways https://isc.sans.edu/diary/Scans%20for%20RDP%20Gateways/31398 CyberPanel Exploited https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/ Windows Themes Files Spoofing CVE-2024-38030 https://blog.0patch.com/2024/10/we-patched-cve-2024-38030-found-another.html QNAP Patches CVE-2024-50388, CVE-2024-50387 https://www.qnap.com/en/security-advisory/qsa-24-41 Facebook Malvertising https://www.bitdefender.com/en-us/blog/labs/unmasking-the-sys01-infostealer-threat-bitdefender-labs-tracks-global-malvertising-campaign-targeting-meta-business-pages/ keywords: facebook; malvertising; bussiness pages; meta; qnap; patches; windows themes; cyberpanel; NTLM; RDP; gateway; scans

CyberPanel RCE; Spring WebFlux Vuln; MSFT Implements DANE; Attackers Enable RDP Critical RCE Vulnerabilty in Cyberpanel https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce Spring WebFlux Vulnerability https://access.redhat.com/security/cve/cve-2024-38821 https://spring.io/security/cve-2024-38821 Inbound SMTP DANE with DNSSEC for Exchange Online https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-general-availability-of-inbound-smtp-dane-with-dnssec/ba-p/4281292 HeptaX: Unauthorized RDP Connections for Cyberespionage Operations https://cyble.com/blog/heptax-unauthorized-rdp-connections-for-cyberespionage-operations/ keywords: heptax; dane; dnssec; rdp; spring; webflux; rce; cyberpanel

Apple Updates; HTML File Phishing via Telegram; ChatGTP-4o Encoding Evasion Apple Update Everything https://isc.sans.edu/diary/Apple%20Updates%20Everything/31390 Selfcontained HTML Phishing Attachment Using Telegram to Exfiltrate Credentials https://isc.sans.edu/diary/Selfcontained+HTML+phishing+attachment+using+Telegram+to+exfiltrate+stolen+credentials/31388/ ChatGPT-4o Guardrail Jailbreak: Hex Encoding for Writing CVE Exploits https://0din.ai/blog/chatgpt-4o-guardrail-jailbreak-hex-encoding-for-writing-cve-exploits keywords: chatgpt; guardrails; apple; html phishing

Old Ivanti Vulns Exploited; Arcadyan Wifi RCE; Okta iOS Vuln; TeamTNT Docker Hunt Two currently (old) exploited Ivanti vulnerabilities https://isc.sans.edu/diary/Two%20currently%20%28old%29%20exploited%20Ivanti%20vulnerabilities/31384 Arcadyan FMIMG51AX000J (WiFi Alliance) RCE CVE-2024-41992 https://ssd-disclosure.com/ssd-advisory-arcadyan-fmimg51ax000j-wifi-alliance-rce/ Okta iOS App Vulnerability CVE-2024-10327 https://trust.okta.com/security-advisories/okta-verify-for-ios-cve-2024-10327/ Threat Alert TeamTNT's docker gatling gun campaign https://www.aquasec.com/blog/threat-alert-teamtnts-docker-gatling-gun-campaign/ keywords: teamtnt; docker; miner; okta; ios; arcadyan; wifi; alliance; ivanti

Dev Features in Prod; Cisco VPN DOS and Authenticed RCE; Hard Coded Cloud Credentials Development Features Enabled in Production https://isc.sans.edu/diary/Development%20Features%20Enabled%20in%20Prodcution/31380 Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials https://blog.talosintelligence.com/large-scale-brute-force-activity-targeting-vpns-ssh-services-with-commonly-used-login-credentials/ Cisco Secure Firewall Management Center Software Command Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inj-v3AWDqN7 Exposing the Danger Within: Hardcoded Cloud Credentials in Popular Mobile Apps https://www.security.com/threat-intelligence/exposing-danger-within-hardcoded-cloud-credentials-popular-mobile-apps keywords: cloud; mobile app; cisco; ssh; dos; vpn; development

Shell Scripts; Fortimanager Mess; Sharepoint Exploit; OpenSSL Patch; Reduced Cert Lifetime Everybody Loves Bash Scripts Including Attackers https://isc.sans.edu/diary/Everybody%20Loves%20Bash%20Scripts.%20Including%20Attackers./31376 Fortimanager Exploited Vulnerability https://www.fortiguard.com/psirt/FG-IR-24-423 Sharepoint Exploit https://www.cisa.gov/news-events/alerts/2024/10/22/cisa-adds-one-known-exploited-vulnerability-catalog https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC OpenSSL Vulnerability https://openssl-library.org/news/secadv/20241016.txt Reduced Certificate Lifetime https://github.com/cabforum/servercert/pull/553 keywords: certificate; openssl; cisa; sharepoint; fortinet; fortimanager; bash; scripts;

HTTP vs. HTTPS; VMware, Unifi, Roundgroup, Atlassian, OneDev Patches, Vulnerability and Exploits How much HTTP (not HTTPS) Traffic is Traversing Your Perimeter? https://isc.sans.edu/diary/How%20much%20HTTP%20%28not%20HTTPS%29%20Traffic%20is%20Traversing%20Your%20Perimeter%3F/31372 VMSA-2024-0019:VMware vCenter Server updates address heap-overflow and privilege escalation vulnerabilities (CVE-2024-38812, CVE-2024-38813) https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968 Unifi Security Advisory Bulletin 043 https://community.ui.com/releases/Security-Advisory-Bulletin-043-043/28e45c75-314e-4f07-a4f3-d17f67bd53f7 Fake attachment. Roundcube mail server attacks exploit CVE-2024-37383 vulnerability. https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/fake-attachment-roundcube-mail-server-attacks-exploit-cve-2024-37383-vulnerability Atlassian Security Bulletin - October 15 2024 https://confluence.atlassian.com/security/security-bulletin-october-15-2024-1442910972.html OneDev Arbitrary file reading for unauthenticated user https://github.com/theonedev/onedev/security/advisories/GHSA-7wg5-6864-v489 keywords: onedev; atlassian; roundcube; unifi; vmware; vcenter; http; https; tls

Emergency Preparedness; HM Surf Exploited; Fortinet and ScienLogic Vague Patches A Network Nerd's Take on Emergency Preparedness https://isc.sans.edu/diary/A%20Network%20Nerd%27s%20Take%20on%20Emergency%20Preparedness/31356 HM Surf Vulnerability Access to Camera Exploited CVE-2024-44133 https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/ Fortinet releases patches for undisclosed critical FortiManager vulnerability https://www.helpnetsecurity.com/2024/10/21/fortimanager-critical-vulnerability/ ScienceLogic Vulnerability https://rackspace.service-now.com/system_status?id=detailed_status&service=4dafca5a87f41610568b206f8bbb35a6 https://docs.sciencelogic.com/latest/Content/Web_Admin_and_Accounts/System_Administration/sys_admin_system_upgrade.htm keywords: sciencelogic; rackspace; fortinet; fortimanager; hm surf; apple;

Lost MSFT 365 Logs; Broken Cloud Storage; ESET Branded Malware; Synology, Spring and Grafana Updates Microsoft 365: Partially incomplete log data due to monitoring agent issue https://m365admin.handsontek.net/multiple-services-partially-incomplete-log-data-due-to-monitoring-agent-issue/ End-to-End Encrytped Cloud Storage in the Wild: A Broken Ecosystem https://brokencloudstorage.info/paper.pdf ESET Branded Malware https://x.com/ESETresearch/status/1847192384448172387 Synology Update https://www.synology.com/en-us/security/advisory/Synology_SA_24_17 Spring Framework Update CVe-2024-38819 CVE-2024-38820 https://spring.io/blog/2024/10/17/spring-framework-cve-2024-38819-and-cve-2024-38820-published Grafana Security Release CVE-2024-9264 https://grafana.com/blog/2024/10/17/grafana-security-release-critical-severity-fix-for-cve-2024-9264/ keywords: grafana; spring; synology; eset;

AWS Scans; Gatekeeper Bypass; Oracle CPU; Cisco ATA 190 Patch; SAP Code Injection; Dept of Commerce Advertises Drugs; Scanning Activity from Subnet 15.184.0.0/16. https://isc.sans.edu/diary/Scanning%20Activity%20from%20Subnet%2015.184.0.0%2016/31362 Gatekeeper Bypass /unit42.paloaltonetworks.com/gatekeeper-bypass-macos/ Oracle Critical Patch Update https://www.oracle.com/security-alerts/cpuoct2024.html Cisco ATA 190 Series Analog Telephone Adapter Firmware Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy SAP Vulnerability https://redrays.io/blog/poc-sap-note-3433192-code-injection-vulnerability-in-sap-netweaver-as-java/ Dept. of Commerce Sites Advertising Medication https://x.com/tliston/status/1833542884047654984 keywords: doc; commerce; cisco; ata; oracle;

Not so Common Passwords; Security Bad Practices; Kubernetes Image Builder Vuln; Solarwinds Helpdesk Exploited; noexec bypass The Top 10 Not So Common SSH Usernames and Passwords https://isc.sans.edu/diary/The%20Top%2010%20Not%20So%20Common%20SSH%20Usernames%20and%20Passwords/31360 CISA Product Security Bad Practices https://www.cisa.gov/resources-tools/resources/product-security-bad-practices Kubernetes Image Builder Vulnerability CVE-2024-9486 CVE-2024-9594 https://discuss.kubernetes.io/t/security-advisory-cve-2024-9486-and-cve-2024-9594-vm-images-built-with-kubernetes-image-builder-use-default-credentials/30119 Solarwinds Hardcoded Password Exploited CVE-2024-28987 https://www.bleepingcomputer.com/news/security/solarwinds-web-help-desk-flaw-is-now-exploited-in-attacks/ Bypassing noexec and executing arbitrary binaries https://iq.thc.org/bypassing-noexec-and-executing-arbitrary-binaries Workshop Website: https://www.sansapi.com/ https://www.sansapi.com/docs keywords: api; workdshop; noexec; solarwinds; kubernetes; cisa;

Demo Script Exploits; Angular-base64-upload Demo Script Exploited https://isc.sans.edu/diary/Angular-base64-upload%20Demo%20Script%20Exploited%20%28CVE-2024-42640%29/31354 Quantum Annealing Public Key Cryptographic Attack Algorithm Based on D-Wave Advantage http://cjc.ict.ac.cn/online/onlinepaper/wc-202458160402.pdf EDRSilencer https://github.com/netero1010/EDRSilencer Synchronizing Passkeys https://fidoalliance.org/specifications-credential-exchange-specifications/ keywords: passkeys; edrsilencer; quantum annealing; quantum computing; crypto; quantum; angular; base64; upload