[Referências do Episódio]

About the security content of iOS 17.3 and iPadOS 17.3 - https://support.apple.com/en-us/HT214059

Cracked software beats gold: new macOS backdoor stealing cryptowallets - https://securelist.com/new-macos-backdoor-crypto-stealer/111778/

ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals - https://www.sentinelone.com/labs/a-glimpse-into-future-scarcruft-campaigns-attackers-gather-strategic-intelligence-and-target-cybersecurity-professionals/

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard - https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/

Chinese Espionage Group UNC3886 Found Exploiting CVE-2023-34048 Since Late 2021 - https://www.mandiant.com/resources/blog/chinese-vmware-exploitation-since-2021

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware - https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/ 

7777-Botnet Infection Vectors - https://vulncheck.com/blog/ip-intel-7777-botnet  

Ivanti Connect Secure VPN Exploitation: New Observations - https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/ 

Ivanti Connect Secure VPN Exploitation: New Observations - https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/

KB CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways - https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US 

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/ 

LockBit Ransomware Distributed Via Word Files Disguised as Resumes - https://asec.ahnlab.com/en/60633/ 

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-6548 and CVE-2023-6549 - https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549 

Chrome Releases: Stable Channel Update for Desktop - Tuesday, January 16, 2024 - https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html 

VMware - VMSA-2024-0001 - https://www.vmware.com/security/advisories/VMSA-2024-0001.html 

CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server - https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html 

Rotating credentials for GitHub.com and new GHES patches - https://github.blog/2024-01-16-rotating-credentials-for-github-com-and-new-ghes-patches/ 

GitHub Enterprise Server 3.11 release notes - https://docs.github.com/en/[email protected]/admin/release-notes#3.11.3-security-fixes 

*nix libX11: Uncovering and exploiting a 35-year-old vulnerability – Part 1 of 2 - https://jfrog.com/blog/xorg-libx11-vulns-cve-2023-43786-cve-2023-43787-part-one/ 

PixieFail flaws impact PXE network boot in enterprise systems - https://www.bleepingcomputer.com/news/security/pixiefail-flaws-impact-pxe-network-boot-in-enterprise-systems/ 

Known Indicators of Compromise Associated with Androxgh0st Malware - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a 

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

“MyFlaw” — Cross Platform 0-Day RCE Vulnerability Discovered in Opera’s Browser Guardio - https://labs.guard.io/myflaw-cross-platform-0-day-rce-vulnerability-discovered-in-operas-browsers-099361a808ab 

CVE-2023-36025 Exploited for Defense Evasion in Phemedrone Stealer Campaign - https://www.trendmicro.com/en_us/research/24/a/cve-2023-36025-exploited-for-defense-evasion-in-phemedrone-steal.html 

Vulnerabilidade de Bypass de Recurso de Segurança do Windows SmartScreen - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025 

It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable - https://bishopfox.com/blog/its-2024-and-over-178-000-sonicwall-firewalls-are-publicly-exploitable 

UNAUTHENTICATED STACK-BASED BUFFER OVERFLOW VULNERABILITY IN SONICOS - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0003 

SONICOS UNAUTHENTICATED STACK-BASED BUFFER OVERFLOW VULNERABILITY - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0004 

Ivanti Connect Secure VPN Exploitation Goes Global - https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/ 

KB CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways - https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Remcos RAT Being Distributed via Webhards - https://asec.ahnlab.com/en/60270/ 

GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 - https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/ 

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

KB CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways - https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN - https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/ 

2024-01 Security Bulletin: Junos OS and Junos OS Evolved: In a jflow scenario continuous route churn will cause a memory leak and eventually an rpd crash (CVE-2024-21611) - https://supportportal.juniper.net/s/article/2024-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-In-a-jflow-scenario-continuous-route-churn-will-cause-a-memory-leak-and-eventually-an-rpd-crash-CVE-2024-21611?language=en_US 

 Cisco Unity Connection Unauthenticated Arbitrary File Upload Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuc-unauth-afu-FROYsCsD 

Weaponizing Apache OFBiz CVE-2023-51467 - https://vulncheck.com/blog/ofbiz-cve-2023-51467 

Siemens SIMATIC CN 4100 - https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-09 

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

China Says It Cracked Apple AirDrop to Identify Message Sources - https://www.bloomberg.com/news/articles/2024-01-09/china-says-cracked-apple-s-airdrop-to-identify-message-sources 

司法鉴定：司法鉴定揭开“隔空投送”匿名传输的神秘面纱 - https://sfj.beijing.gov.cn/sfj/sfdt/ywdt82/flfw93/436331732/index.html 

New decryptor for Babuk Tortilla ransomware variant released - https://blog.talosintelligence.com/decryptor-babuk-tortilla/ 

Atualizações de Segurança de janeiro de 2024 - https://msrc.microsoft.com/update-guide/releaseNote/2024-Jan 

Black Basta-Affiliated Water Curupira’s Pikabot Spam Campaign - https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html 

Securonix Threat Research Security Advisory: New RE#TURGENCE Attack Campaign: Turkish Hackers Target MSSQL Servers to Deliver Domain-Wide MIMIC Ransomware - https://www.securonix.com/blog/securonix-threat-research-security-advisory-new-returgence-attack-campaign-turkish-hackers-target-mssql-servers-to-deliver-domain-wide-mimic-ransomware/ 

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Sabotage in Iran: Een missie in duisternis - https://www.volkskrant.nl/kijkverder/v/2024/sabotage-in-iran-een-missie-in-duisternis~v989743/

Dutch man sabotaged Iranian nuclear program without Dutch government's knowledge: report - https://nltimes.nl/2024/01/08/dutch-man-sabotaged-iranian-nuclear-program-without-dutch-governments-knowledge-report

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia