||||The.Fischerman.CH

Unit 42 has discovered a new malware family we’ve named “Reaver” with ties to attackers who use SunOrcal malware. SunOrcal activity has been documented to at least 2013, and based on metadata surrounding some of the C2s, may have been active as early as 2010. The new family appears to have been in the wild since late 2016 and to date we have only identified 10 unique samples, indicating it may be sparingly used. Reaver is also somewhat unique in the fact that its final payload is in the form of a Control panel item, or CPL file. To date, only 0.006% of all malware seen by Palo Alto Networks employs this technique, indicating that it is in fact fairly rare.

Source ->

— the.Fischerman.ch
(@FischermanCH)

 

A script to help set up an event handler in order to install a persistent backdoor that can be activated by sending a message.

Note: This no longer works in newer versions of Mac OSX, iMessages has removed the ability to have AppleScript event handlers.

Source ->

— the.Fischerman.ch
(@FischermanCH)

 

This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS and FBI identified Internet Protocol (IP) addresses and other indicators of compromise (IOCs) associated with a remote administration tool (RAT) used by the North Korean government—commonly known as FALLCHILL. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. 

Source ->

— the.Fischerman.ch
(@FischermanCH)

 

Sie erhalten jeden Tag irgendwelche nervigen Spam-Mails? Leiten Sie diese doch an den Chatbot „Re:scam“ weiter. Der beginnt dann einen Endlos-Dialog mit den Cyber-Kriminellen!

Nachtrag : Re:scam scheint leider nicht mehr online zu sein 🙁

Source ->

— the.Fischerman.ch
(@FischermanCH)

 

Über 200.000 Cisco Switches sind übers Internet erreichbar und lassen sich umkonfigurieren oder komplett übernehmen; mehrere tausend davon allein in Deutschland. Die Systeme werden bereits angegriffen, doch der Hersteller sieht keine Schwachstelle.

Source ->

— the.Fischerman.ch
(@FischermanCH)