Tag: shell script
-
Cisco Talos Blog: Gamaredon campaign abuses LNK files to distribute Remcos backdoor
Source URL: https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/ Source: Cisco Talos Blog Title: Gamaredon campaign abuses LNK files to distribute Remcos backdoor Feedly Summary: Cisco Talos is actively tracking an ongoing campaign, targeting users in Ukraine with malicious LNK files which run a PowerShell downloader since at least November 2024. AI Summary and Description: Yes **Summary:** The text details a…
-
Hacker News: Whose code am I running in GitHub Actions?
Source URL: https://alexwlchan.net/2025/github-actions-audit/ Source: Hacker News Title: Whose code am I running in GitHub Actions? Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a recent security issue with the tj-actions/changed-files GitHub Action, highlighting the risks of mutable Git tags as opposed to immutable commit references in CI/CD processes. It emphasizes the…
-
Microsoft Security Blog: New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects
Source URL: https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/ Source: Microsoft Security Blog Title: New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects Feedly Summary: Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that infects Xcode projects, in the wild. Its first known variant since 2022, this latest XCSSET malware features…
-
Hacker News: (Reasonably) secure Azure Pipelines on-prem deployments
Source URL: https://rewiring.bearblog.dev/azure-devops-in-action-pt-iii-reasonably-secure-deploys-to-iis/ Source: Hacker News Title: (Reasonably) secure Azure Pipelines on-prem deployments Feedly Summary: Comments AI Summary and Description: Yes Summary: The text provides a detailed walkthrough of implementing a secure deployment pipeline using Azure DevOps to an on-premises Internet Information Services (IIS) server. It emphasizes the importance of security, particularly through minimizing permissions…
-
Hacker News: Exposing Russian EFF Impersonators: The Inside Story on Stealc and Pyramid C2
Source URL: https://hunt.io/blog/russian-speaking-actors-impersonate-etf-distribute-stealc-pyramid-c2 Source: Hacker News Title: Exposing Russian EFF Impersonators: The Inside Story on Stealc and Pyramid C2 Feedly Summary: Comments AI Summary and Description: Yes Summary: The text provides an in-depth analysis of a cyber attack targeting the online gaming community, specifically through impersonation of the Electronic Frontier Foundation (EFF) to conduct phishing…
-
Cisco Talos Blog: Unmasking the new persistent attacks on Japan
Source URL: https://blog.talosintelligence.com/new-persistent-attacks-japan/ Source: Cisco Talos Blog Title: Unmasking the new persistent attacks on Japan Feedly Summary: Cisco Talos has discovered an active exploitation of CVE-2024-4577 by an attacker in order to gain access to the victim’s machines and carry out post-exploitation activities. AI Summary and Description: Yes **Summary:** The text describes a sophisticated cyberattack…
-
Cloud Blog: Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/ Source: Cloud Blog Title: Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger Feedly Summary: Written by: Dan Black Google Threat Intelligence Group (GTIG) has observed increasing efforts from several Russia state-aligned threat actors to compromise Signal Messenger accounts used by individuals of interest to Russia’s intelligence services. While this…
-
Cloud Blog: CVE-2023-6080: A Case Study on Third-Party Installer Abuse
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/cve-2023-6080-third-party-installer-abuse/ Source: Cloud Blog Title: CVE-2023-6080: A Case Study on Third-Party Installer Abuse Feedly Summary: Written By: Jacob Paullus, Daniel McNamara, Jake Rawlins, Steven Karschnia Executive Summary Mandiant exploited flaws in the Microsoft Software Installer (MSI) repair action of Lakeside Software’s SysTrack installer to obtain arbitrary code execution. An attacker with low-privilege access…
-
Hacker News: How to run DeepSeek R1 locally
Source URL: https://workos.com/blog/how-to-run-deepseek-r1-locally Source: Hacker News Title: How to run DeepSeek R1 locally Feedly Summary: Comments AI Summary and Description: Yes **Summary:** DeepSeek R1 is an open-source large language model (LLM) designed for local deployment to enhance data privacy and performance in conversational AI, coding, and problem-solving tasks. Its capability to outperform OpenAI’s flagship model…
-
Cloud Blog: Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation
Source URL: https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day/ Source: Cloud Blog Title: Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation Feedly Summary: Written by: John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson Note: This is a developing campaign under active analysis by Mandiant and Ivanti. We will continue to add more…