[Referências do Episódio]

- Geacon Brings Cobalt Strike Capabilities to macOS Threat Actors - https://www.sentinelone.com/blog/geacon-brings-cobalt-strike-capabilities-to-macos-threat-actors/

- Infos stealer first trimester 2023 - https://www.bleepingcomputer.com/news/security/the-new-info-stealing-malware-operations-to-watch-out-for/ e https://ke-la.com/emerging-infostealers-2023-report/

- Qilin Ransomware - https://www.group-ib.com/blog/qilin-ransomware/

- Operação deflagra em combate ao crime de estelionato previdenciário - https://www.gov.br/pf/pt-br/assuntos/noticias/2023/05/pf-deflagra-operacao-em-combate-ao-crime-de-estelionato-previdenciario

[Ficha técnica]

Apresentação: Daniel Venzi

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor

- Water Orthrus's New Campaigns Deliver Rootkit and Phishing Modules - https://www.trendmicro.com/en_us/research/23/e/water-orthrus-new-campaigns-deliver-rootkit-and-phishing-modules.html

- Newly identified RA Group compromises companies in U.S. and South Korea with leaked Babuk source code - https://blog.talosintelligence.com/ra-group-ransomware/

- Vulnerabilities Uncovered Affect Thousands of Internet-Connected Devices Worldwide - https://www.otorio.com/blog/teltonkia-cloud-takeover-vulnerability-exposed/

- Triple Threat: Breaking Teltonika Routers Three Ways - https://claroty.com/team82/research/triple-threat-breaking-teltonika-routers-three-ways 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- CISA Adds Seven Known Exploited Vulnerabilities to Catalog - https://www.cisa.gov/news-events/alerts/2023/05/12/cisa-adds-seven-known-exploited-vulnerabilities-catalog

- BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game - https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game 

- Securonix Threat Labs Security Advisory: Latest Update: Ongoing MEME#4CHAN Attack/Phishing Campaign uses Meme-Filled Code to Drop XWorm Payloads - https://www.securonix.com/blog/securonix-threat-labs-security-meme4chan-advisory/ 

- Chaining Five Vulnerabilities to Exploit Netgear Nighthawk RAX30 Routers at Pwn2Own Toronto 2022 - https://claroty.com/team82/research/chaining-five-vulnerabilities-to-exploit-netgear-nighthawk-rax30-routers-at-pwn2own-toronto-2022 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- TEMPEST TURING DAY 2023 - https://www.even3.com.br/turingday2023/ 

- Critical Privilege Escalation in Essential Addons for Elementor Plugin Affecting 1+ Million Sites - https://patchstack.com/articles/critical-privilege-escalation-in-essential-addons-for-elementor-plugin-affecting-1-million-sites/ 

- Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers - https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/

- Uncovering RedStinger - Undetected APT cyber operations in Eastern Europe since 2020 - https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger

- CISA Releases Fifteen Industrial Control Systems Advisories - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-releases-fifteen-industrial-control-systems-advisories

- Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Deep Dive Into DownEx Espionage Operation in Central Asia - https://www.bitdefender.com/blog/businessinsights/deep-dive-into-downex-espionage-operation-in-central-asia/

- From One Vulnerability to Another: Outlook Patch Analysis Reveals Important Flaw in Windows API - https://www.akamai.com/blog/security-research/important-outlook-vulnerability-bypass-windows-api

- New phishing-as-a-service tool “Greatness” already seen in the wild - https://blog.talosintelligence.com/new-phishing-as-a-service-tool-greatness-already-seen-in-the-wild/

- White Phoenix - https://github.com/cyberark/White-Phoenix

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Patch Tuesday maio - https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2023-patch-tuesday-fixes-3-zero-days-38-flaws/

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29336

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29325

- ESET APT Report Q4 2022 - Q1 2023 - https://www.welivesecurity.com/2023/05/09/eset-apt-activity-report-q42022-q12023/

- CISA ICS Vulnerabilities - https://www.cisa.gov/news-events/alerts/2023/05/09/cisa-releases-two-industrial-control-systems-advisories

- SideWinder Uses Server Polymorphism to Target Pakistan - https://blogs.blackberry.com/en/2023/05/sidewinder-uses-server-side-polymorphism-to-target-pakistan

- Managed XDR Investigation of Ducktail in Trend Micro Vision One - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html

[Ficha técnica]

Apresentação: Daniel Venzi

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Iran-linked APT groups started exploiting Papercut flaw - https://securityaffairs.com/145952/apt/iranian-apt-papercut-exploitation.html

- AndoryuBot – New Botnet Campaign Targets Ruckus Wireless Admin Remote Code Execution Vulnerability (CVE-2023-25717) - https://www.fortinet.com/blog/threat-research/andoryubot-new-botnet-campaign-targets-ruckus-wireless-admin-remote-code-execution-vulnerability-cve-2023-25717 

- AhnLab EDR Tracks and Responds against Link File (*.lnk) Distributing RokRAT - https://asec.ahnlab.com/en/52172/ 

- Woman who scanned QR code with malware lost $20k to bubble tea survey scam while she was sleeping - https://www.straitstimes.com/singapore/woman-who-scanned-qr-code-with-malware-lost-20k-to-bubble-tea-survey-scam-while-she-was-sleeping 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/deconstructing-amadeys-latest-multi-stage-attack-and-malware-distribution/

- Reflected XSS in Advanced Custom Fields Plugins Affecting 2+ Million Sites - https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/ 

- EASTERN ASIAN ANDROID ASSAULT – FLUHORSE - https://research.checkpoint.com/2023/eastern-asian-android-assault-fluhorse/

- Not quite an Easter egg: a new family of Trojan subscribers on Google Play - https://securelist.com/fleckpe-a-new-family-of-trojan-subscribers-on-google-play/109643/ 

- New Cactus ransomware encrypts itself to evade antivirus - https://www.bleepingcomputer.com/news/security/new-cactus-ransomware-encrypts-itself-to-evade-antivirus/ 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- PaperCut Exploitation - A Different Path to Code Execution - https://vulncheck.com/blog/papercut-rce

- Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-unauth-upgrade-UqhyTWW

- CVE-2023-26876: Vulnerabilidade de injeção de SQL encontrada no software de gerenciamento de imagens Piwigo - https://sidechannel.blog/cve-2023-26876-vulnerabilidade-de-injecao-de-sql-encontrada-no-software-de-gerenciamento-de-imagens-piwigo/

- When Good APIs Go Bad: Uncovering 3 Azure API Management Vulnerabilities - https://ermetic.com/blog/azure/when-good-apis-go-bad-uncovering-3-azure-api-management-vulnerabilities/

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- A doubled “Dragon Breath” adds new air to DLL sideloading attacks - https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/

- The malware threat landscape: NodeStealer, DuckTail, and more - https://engineering.fb.com/2023/05/03/security/malware-nodestealer-ducktail/

- Attack on Security Titans: Earth Longzhi Returns With New Tricks - https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html

- Tweet sobre o ransomware BlackSuit - https://twitter.com/Unit42_Intel/status/1653760405792014336

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto