Tag: shell script
-
Cloud Blog: Windows Remote Desktop Protocol: Remote to Rogue
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/windows-rogue-remote-desktop-protocol/ Source: Cloud Blog Title: Windows Remote Desktop Protocol: Remote to Rogue Feedly Summary: Written by: Rohit Nambiar Executive Summary In October 2024, Google Threat Intelligence Group (GTIG) observed a novel phishing campaign targeting European government and military organizations that was attributed to a suspected Russia-nexus espionage actor we track as UNC5837. The…
-
Cloud Blog: Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability/ Source: Cloud Blog Title: Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457) Feedly Summary: Written by: John Wolfram, Michael Edie, Jacob Thompson, Matt Lin, Josh Murchie On Thursday, April 3, 2025, Ivanti disclosed a critical security vulnerability, CVE-2025-22457, impacting Ivanti Connect Secure (“ICS”) VPN appliances version 22.7R2.5 and…
-
Cisco Talos Blog: Gamaredon campaign abuses LNK files to distribute Remcos backdoor
Source URL: https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/ Source: Cisco Talos Blog Title: Gamaredon campaign abuses LNK files to distribute Remcos backdoor Feedly Summary: Cisco Talos is actively tracking an ongoing campaign, targeting users in Ukraine with malicious LNK files which run a PowerShell downloader since at least November 2024. AI Summary and Description: Yes **Summary:** The text details a…
-
Hacker News: Whose code am I running in GitHub Actions?
Source URL: https://alexwlchan.net/2025/github-actions-audit/ Source: Hacker News Title: Whose code am I running in GitHub Actions? Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a recent security issue with the tj-actions/changed-files GitHub Action, highlighting the risks of mutable Git tags as opposed to immutable commit references in CI/CD processes. It emphasizes the…
-
Microsoft Security Blog: New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects
Source URL: https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/ Source: Microsoft Security Blog Title: New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects Feedly Summary: Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that infects Xcode projects, in the wild. Its first known variant since 2022, this latest XCSSET malware features…
-
Hacker News: (Reasonably) secure Azure Pipelines on-prem deployments
Source URL: https://rewiring.bearblog.dev/azure-devops-in-action-pt-iii-reasonably-secure-deploys-to-iis/ Source: Hacker News Title: (Reasonably) secure Azure Pipelines on-prem deployments Feedly Summary: Comments AI Summary and Description: Yes Summary: The text provides a detailed walkthrough of implementing a secure deployment pipeline using Azure DevOps to an on-premises Internet Information Services (IIS) server. It emphasizes the importance of security, particularly through minimizing permissions…
-
Hacker News: Exposing Russian EFF Impersonators: The Inside Story on Stealc and Pyramid C2
Source URL: https://hunt.io/blog/russian-speaking-actors-impersonate-etf-distribute-stealc-pyramid-c2 Source: Hacker News Title: Exposing Russian EFF Impersonators: The Inside Story on Stealc and Pyramid C2 Feedly Summary: Comments AI Summary and Description: Yes Summary: The text provides an in-depth analysis of a cyber attack targeting the online gaming community, specifically through impersonation of the Electronic Frontier Foundation (EFF) to conduct phishing…
-
Cisco Talos Blog: Unmasking the new persistent attacks on Japan
Source URL: https://blog.talosintelligence.com/new-persistent-attacks-japan/ Source: Cisco Talos Blog Title: Unmasking the new persistent attacks on Japan Feedly Summary: Cisco Talos has discovered an active exploitation of CVE-2024-4577 by an attacker in order to gain access to the victim’s machines and carry out post-exploitation activities. AI Summary and Description: Yes **Summary:** The text describes a sophisticated cyberattack…
-
Cloud Blog: Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/ Source: Cloud Blog Title: Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger Feedly Summary: Written by: Dan Black Google Threat Intelligence Group (GTIG) has observed increasing efforts from several Russia state-aligned threat actors to compromise Signal Messenger accounts used by individuals of interest to Russia’s intelligence services. While this…
-
Cloud Blog: CVE-2023-6080: A Case Study on Third-Party Installer Abuse
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/cve-2023-6080-third-party-installer-abuse/ Source: Cloud Blog Title: CVE-2023-6080: A Case Study on Third-Party Installer Abuse Feedly Summary: Written By: Jacob Paullus, Daniel McNamara, Jake Rawlins, Steven Karschnia Executive Summary Mandiant exploited flaws in the Microsoft Software Installer (MSI) repair action of Lakeside Software’s SysTrack installer to obtain arbitrary code execution. An attacker with low-privilege access…