[Referências do Episódio]

Threat Group FIN7 Targets the U.S. Automotive Industry - https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry

DuneQuixote campaign targets Middle Eastern entities with “CR4T” malware - https://securelist.com/dunequixote/112425/

#StopRansomware: Akira Ransomware - https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware.pdf

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Unearthing APT44: Russia’s Notorious Cyber Sabotage Unit Sandworm - https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm

Ivanti fixed two critical flaws in its Avalanche MDM - https://securityaffairs.com/161952/security/ivanti-avalanche-mdm-critical-flaws.html

Cisco warns of large-scale brute-force attacks against VPN services - https://www.bleepingcomputer.com/news/security/cisco-warns-of-large-scale-brute-force-attacks-against-vpn-services/

Cisco Integrated Management Controller CLI Command Injection Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-mUx4c5AJ

Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters - https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

- Exploit released for Palo Alto PAN-OS bug used in attacks, patch now - https://www.bleepingcomputer.com/news/security/exploit-released-for-palo-alto-pan-os-bug-used-in-attacks-patch-now/#google_vignette 

- LeackyCLI: AWS and Google Cloud Command-Line Tools Can Expose Sensitive Credentials in Build Logs - https://orca.security/resources/blog/leakycli-aws-google-cloud-command-line-tools-can-expose-sensitive-credentials-build-logs/ 

- PuTTY vulnerability vuln-p521-bias - https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html

[Referências do Episódio]

SteganoAmor campaign: TA558 mass-attacking companies and public institutions all around the world - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/steganoamor-campaign-ta558-mass-attacking-companies-and-public-institutions-all-around-the-world/#id0

From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering - https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) - https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/

CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect - https://security.paloaltonetworks.com/CVE-2024-3400

Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 - https://unit42.paloaltonetworks.com/cve-2024-3400/

XenServer and Citrix Hypervisor Security Update for CVE-2023-46842, CVE-2024-2201 and CVE-2024-31142 - https://support.citrix.com/article/CTX633151/xenserver-and-citrix-hypervisor-security-update-for-cve202346842-cve20242201-and-cve202431142

Credit Card Skimmer Hidden in Fake Facebook Pixel Tracker - https://blog.sucuri.net/2024/04/credit-card-skimmer-hidden-in-fake-facebook-pixel-tracker.html

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect Gateway -

https://security.paloaltonetworks.com/CVE-2024-3400

[Referências do Episódio]

Entendendo operações de ransomware-as-a-service a partir da perspectiva de um afiliado - https://www.sidechannel.blog/entendendo-operacoes-de-ransomware-as-a-service-a-partir-da-perspectiva-de-um-afiliado/

Security Brief: TA547 Targets German Organizations with Rhadamanthys Stealer - https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-organizations-rhadamanthys-stealer

New Technique to Trick Developers Detected in an Open Source Supply Chain Attack- https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

InSpectre Gadget: Inspecting the Residual Attack Surface of Cross-privilege Spectre v2 - https://www.vusec.net/projects/native-bhi/

eXotic Visit campaign: Tracing the footprints of Virtual Invaders - https://www.welivesecurity.com/en/eset-research/exotic-visit-campaign-tracing-footprints-virtual-invaders/

Raspberry Robin Now Spreading Through Windows Script Files - https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Microsoft April 2024 Patch Tuesday fixes 150 security flaws, 67 RCEs - https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2024-patch-tuesday-fixes-150-security-flaws-67-rces/

[FortiClient Linux] Remote Code Execution due to dangerous nodejs configuration - https://fortiguard.fortinet.com/psirt/FG-IR-23-087

Security update available for Adobe Commerce | APSB24-18 - https://helpx.adobe.com/security/products/magento/apsb24-18.html

Vulnerabilities Identified in LG WebOS - https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/

RUBYCARP: A Detailed Analysis of a Sophisticated Decade-Old Botnet Group - https://sysdig.com/blog/rubycarp-romanian-botnet-group/

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

It Was Not Me! Malware-Initiated Vulnerability Scanning Is on the Rise - https://unit42.paloaltonetworks.com/malware-initiated-scanning-attacks/

ScrubCrypt Deploys VenomRAT with an Arsenal of Plugins - https://www.fortinet.com/blog/threat-research/scrubcrypt-deploys-venomrat-with-arsenal-of-plugins

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia