Season 3 · Episode 110
#110 - Intel Chat: Lazarus Group, tunnelling with QEMU, ScreenConnect & CISA breach
The Cybersecurity Defenders Podcast · Christopher
March 15, 202434m 43s
Audio is streamed directly from the publisher (podcast.wistia.com) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.
Show Notes
In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.
- North Korean threat actors known as the Lazarus Group exploited a zero-day in the Windows AppLocker driver to gain kernel-level access and turn off security tools, allowing them to bypass noisy Bring Your Own Vulnerable Driver techniques.
- Researchers observed threat actors run the Angry IP Scanner, followed by some Mimikatz functions, and then the kicker, the open-source QEMU hardware emulator and virtualizer.
- Threat actors have been observed installing RMM tools as a means of maintaining persistence within a compromised organization.
- Hackers breached some of the systems belonging to CISA in February through some known vulnerabilities in Ivanti products.