Roman 乐安 Weishäupl

Researchers from security firm Sophos detailed Operation #CrimsonPalace threat clusters of Chinese state-sponsored activity targeting a Southeast Asian government agency for #cyberespionage in a campaign that had precursors dating back to early 2022. The clusters were observed using tools and infrastructure that overlap with other researchers’ public reporting on Chinese threat actors BackdoorDiplomacy, REF5961, Worok, TA428, the recently-designated Unfading Sea Haze, and the APT41 subgroup Earth Longzhi. “In May 2023, in a threat hunt across Sophos Managed Detection and Response telemetry, Sophos MDR’s Mark Parsons uncovered a complex, long-running Chinese state-sponsored cyberespionage operation we have dubbed ‘Crimson Palace’ targeting a high-profile government organization in Southeast Asia,” Paul Jaramillo, Morgan Demboski, and Mark Parsons wrote in a Wednesday blog post. “MDR launched the hunt after the discovery of a DLL sideloading technique that exploited VMNat.exe, a VMware component. In the investigation that followed, we tracked at least three clusters of intrusion activity from March 2023 to December 2023. The hunt also uncovered previously unreported malware associated with the threat clusters, as well as a new, improved variant of the previously-reported EAGERBEE malware.” https://lnkd.in/gVRDg7G7

14

This recent article from ASPI reports Tokyo’s determination to build world-class capabilities in active cyber defence and economic security fit for today’s changed information-security environment. Organisations globally are getting out from behind their firewalls using active cyber defence to collect tactical intelligence. Cyber-deception and commercial data tracing tools can give a view or what's coming at you before it arrives rather than being in reactive mode when you discover too late that your perimeter has already been breached. https://lnkd.in/gZttRrk7

1

Unlocking Success: WPG’s Risk Vulnerability Assessment Services for Japanese Companies https://lnkd.in/gKxjRV6S #WPG #ExecutiveProtection #ArmedSecurity #RiskVulnerabilityAssessment #EstateSecurity #PrivateInvestigations #GoldStandardService #privacyisluxury

2

🚨 BEWARE: North Korean threat group Kimsuky is targeting South Korean cryptocurrency firms with a previously undocumented Golang-based malware.    The novel malware, dubbed “Durian,” is equipped with comprehensive backdoor functionality, enabling the execution of delivered commands, additional file downloads, and exfiltration of files. According to @The Hacker News, these attacks leverage legitimate South Korean software to establish a connection between the victim and the attacker’s server, paving the way for Durian and other malicious tools.    Read the full article: https://lnkd.in/gKsQkJFC    #MalwareMonday #CyberSecurity #Malware #Durian #Crypto #BackDoor #Kimsuky  🤓 Chris Anthony Laura Nolan Tony Cantafio Matt Quirion Vic Macias Don K.

4

The choice of a security agency should not only be based on cost and capabilities but also on the principal's specific needs. This involves a thorough evaluation of operational details, including financial obligations, operational logistics, travel arrangements, identification requirements, and operational restrictions. It is crucial to understand the principal's responsibilities regarding payment, the number of security personnel required, their shifts, and the criteria for armed or unarmed personnel. Operational logistics should also be thoroughly examined, including travel arrangements, transportation methods, documentation, and identification requirements. It is also essential to inquire about any operational restrictions imposed by the agency or its personnel, such as limitations on accompanying the principal to specific locations or using specific modes of transport. Preferences regarding the guards, such as gender, race, age, or personality characteristics, should also be discussed. Health and personal habits of the guards should also be scrutinized to ensure they meet the principal's standards. Professional credentials of the security company and its guards must be verified, including checking licenses, educational backgrounds, military service, job history, and references. Understanding the procedures for potentially interrupting, terminating, or altering the scope of an assignment is essential for maintaining flexibility and control throughout the engagement. By addressing these critical questions, potential clients can forge partnerships with security agencies that are effective and deeply aligned with their specific security needs and preferences. #evaluation #choice #fit #costvservice #validateandverify #standards #economics #security #securityservices #clientservices

1

Download: 'Same targets, new playbooks - East Asia threat actors employ unique methods' from Microsoft Threat Intelligence (pdf) https://buff.ly/3UoZf4J #asiapacific #southeastasia #asean #china #northkorea #cybersec #datasec #cybercrime #asiatechnews

2

Not only is the Philippines in the middle of a cyber crime and online fraud / scam explosion, cyber attacks aimed at critical national infrastructure and government entities have also experienced a four fold rise in the last 12 months. Targets included government (80%) and educational institutions (20%) and the attacks are combined with a disinformation campaign designed to discredit the current administration. Geopolitical tensions in the region have been suggested as one of the potential root causes but nonetheless, it’s safe to say that much more needs to be done to raise cybersecurity awareness both within government and the public - at the moment we seem to be an easy target. Thanks to Alexander Rogan for bringing this article to my attention. #cybercrime #fraud #scam #online #cybersecurity #awareness #investigations #security #cyberdefense #philippines #china #southchinasea

19

Web applications are the workhorses of the digital age, powering everything from online shopping to managing our daily tasks. To ensure they perform seamlessly and securely, they need comprehensive testing. 🌐 Ensuring Excellence in Web Application Testing! 🌐🔍 In today's digital landscape, web applications are crucial for business success. Comprehensive testing is essential to deliver smooth, secure, and efficient web experiences. Here's why it's so important: - Functionality Testing: Verifies that all features work as intended, ensuring reliable operations. ✔️ - Usability Testing: Enhances user experience by making sure the application is user-friendly and intuitive.🧑‍💻 - Performance Testing: Ensures the app performs well under various conditions, handling high traffic and stress effectively. 🚀 - Compatibility Testing: Confirms seamless operation across different browsers, devices, and operating systems. 🌍 - Security Testing: Identifies and fixes vulnerabilities, protecting user data and privacy. 🔒 - Database Testing: Maintains data integrity and security, ensuring reliable data interactions. 🗂️ - Interface Testing: Verifies smooth communication between different systems and interfaces. 🔗 You are partnering with TESTRIQ QA Lab, LLP. means ensuring that your Web applications function flawlessly and provide a smooth and secure user experience. Let's work together to elevate your Web applications and ensure they meet the needs of today's digital world! 🚀✨ 📧 Interested? Connect with Us! 📩 Email: contact@testriq.com 🤝 Contact: Heena Pathan (Business Development Executive) 🤝 VP of Sales: Ameya Pingaley #webapplicationtesting #softwaretesting #qualityassurance #userexperience #securitytesting #technology #softwaredevelopment #performance #digitalworld #testriq

9

Exploring the balance between security and privacy in our digital world. Dive into the discussion with SecurityMattersPH. #SecurityMattersPH Read more: https://lnkd.in/difFJDJm

2

U.S. agencies have issued a joint advisory highlighting attempts by the Democratic People’s Republic of Korea (DPRK, a.k.a. North Korea) Kimsuky cyber actors to exploit improperly configured #DNS Domain-based Message Authentication, Reporting and Conformance (DMARC) record policies to conceal #socialengineering attempts. Without properly configured #DMARC policies, #malicious #cyber actors can send spoofed emails as if they came from a legitimate domain’s email exchange. “The North Korean cyber actors have conducted spearphishing campaigns posing as legitimate journalists, academics, or other experts in East Asian affairs with credible links to North Korean policy circles,” the Federal Bureau of Investigation (FBI), the U.S. Department of State and the National Security Agency (NSA) detailed in a Thursday advisory. “North Korea leverages these #spearphishing campaigns to collect intelligence on #geopolitical events, adversary foreign policy strategies, and any information affecting North Korean interests by gaining illicit access to targets’ private documents, research, and #communications.” https://lnkd.in/gNwKbWBu

17

The 911 S5 Botnet Infected Over 19M IP Addresses to Enable Billions of Dollars in Pandemic and Unemployment Fraud, and Access to Child Exploitation Materials. ''A court-authorized international law enforcement operation led by the U.S. Justice Department disrupted a botnet used to commit cyber attacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations. According to an indictment unsealed on May 24, 2024, from 2014 through July 2022, Wang and others are alleged to have created and disseminated malware to compromise and amass a network of millions of residential Windows (Microsoft) computers worldwide. These devices were associated with more than 19 million unique IP addresses, including 613,841 IP addresses located in the United States. Wang then generated millions of dollars by offering cybercriminals access to these infected IP addresses for a fee.'' Free, illegitimate VPN applications that were created to connect to the 911 S5 service are: MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN. Unaware of the proxy backdoor, once users downloaded these VPN applications, they unknowingly became a victim of the 911 S5 botnet. The proxy backdoor enabled 911 S5 users to re-route their devices through victims’ devices, allowing criminals to carry out crimes such as bomb threats, financial fraud, identity theft, child exploitation, and initial access brokering. Our congratulations to the Justice Department, the Federal Bureau of Investigation (FBI) and all those involved. To recap: this operation lasted 8 years, exploited some $5.9 billion, infected 19 million IP addresses, and impacted over 200 countries. Access Brokering and the exploitation of compromised IP addresses - sounds familiar. To put this in context. On average, global daily costs and losses to cybercrime are around $32 billion. 911 S5 went on for 8 years in the shadows with millions of victims being exploited via exposed and insecure IP addresses. The success of this shut down must be applauded, however, it is very much a drop in the digital ocean. The world needs to work rapidly toward securing and fortifying Internet Assets and DNS as opposed to the current systemically exposed and insecure Internet Assets and DNS if there is any hope to do more than play Digital Whack a Mole and if we ever want to better protect our economies and future. #WhitethornShield FBI Cyber Division Federal Bureau of Investigation (FBI) The White House GCHQ National Cybersecurity Coordination Center (NCSCC) #InterentSecurity #DNS #PKI #Cybercrime #InternetAssets https://lnkd.in/dkDfS4Cv

15

4 Kommentare

Philippines Pummeled by Assortment of Cyberattacks & Misinformation Tied to China The volume of malicious cyber activity against the Philippines quadrupled in the first quarter of 2024 compared to the same period in 2023. This represents a four-fold (325%) increase in what the researchers identify as malicious cyber-espionage activity targeting the Philippines in the first quarter of 2024 compared to the same period last year. "The goal of this activity is to discredit the government and create chaos via cyberspace, as the Philippine population also relies on digital media channels and is active on social media networks. In April 2023, more than 800 gigabytes of both applicant and employee records from multiple state agencies — including the Philippine National Police (PNP), National Bureau of Investigation (NBI), Bureau of Internal Revenue (BIR), and Special Action Force (SAF) — were compromised. This was followed in September by a breach and ransomware attack on the Philippine Health Insurance Corporation (PhilHealth) that led to the exposure of hospital bills, internal memos, and identification documents. There remains an ongoing investigation into the full extent of the leak, according to cyber threat detection firm Gatewatcher. Nebulosity patented activeSENTINEL™ Digital Twin Security ... Patrolling and adapting in Real-time unGUARDED™ network segments for LOTL & Behavioral Anomalies! #activeSENTINEL™ , #nebulositycloud , #ransomware , #GlobalCyberTHREAT, #digitaltwinsnetwork, #counteroffense

1

How to Leverage OSINT for Brand Intelligence #E042 #OSINT #BrandIntelligence OSINT is an invaluable skill. ➡ It provides a competitive advantage in business. ➡ It enhances the accuracy of information. ➡ It aids in identifying and assessing potential threats. Dive into this detailed guide to discover how OSINT can be applied for improved brand intelligence: (This is part 2 of a series) ⛔ Negative Effects: - Competitive Disadvantage - Decreased Sales - Brand Devaluation - Negative Media Coverage - Employee Turnover - Loss of Trust - Legal Scrutiny - Brand Devaluation - Social Media Blacklash - Increased Costs 💻 Main Strategies 1. Real-Time Monitoring 2. Sentiment Analysis 3. Crisis Management 4. Competitor Insights 5. Influencer Engagement 6. Customer Feedback Collection 7. Market and Trend Analysis 8. Internal Monitoring 💡 Why is It Essential?: - Customer Trust & Loyalty - Competitive Advantage - Crisis Resilience - Attracting Talent - Customer Acquisition & Retention - Financial Performance - Stakeholder Relationships 🛡️ Actions to Enhance Reputation 1. Monitor and respond to online feedback 2. Build and maintain positive online media relations 3. Engage with your online audience 4. Ensure excellent online customer service 5. Promote online Corporate Social Responsibility (CSR) 6. Encourage and showcase positive online reviews 7. Create and share high-quality content 8. Leverage influencer and brand ambassadors partnerships 🛠 Know The Right Tool: - Talkwalker - Brandwatch - Alto Intelligence - TweetDeck - ShadowDragon Horizon - Social Links Crimewall - Save this sheet to help you. Any thoughts to add? Let's hear it in the comments below ⬇ #advancedOSINT #cyber #intelligence #enterprises

322

14 Kommentare

Telstra has revealed that low levels of security maturity in operational technology (OT) and information technology (IT) across North Asia could put businesses who are rapidly adopting the fourth industrial revolution (4IR) technologies at major risk, according to Telstra's "Securing Industry 4.0: The Challenges and Opportunities of IT/OT Convergence" study.

2

🚨 Urgent Cybersecurity Update: MARINA Systems Breached 🚨 The Philippine Maritime Industry Authority (MARINA) has experienced a significant cyber attack, compromising critical web-based systems. This incident highlights the escalating cyber threats facing the maritime industry. What We Know: ⌖ The breach was announced by a user called "Ph1ns" on an online forum. In an interview to the Manila Bulletin, the anonymous hacker appears to claim activist intent in this incident ⌖ We've seen reports that known vulnerabilities in MARINA's servers were used to carry out the attack ⌖ There are reports of ~20GB of sensitive data leakage, including some ship owner data ⌖ Rapid response measures are in place, and MARINA is collaborating with DICT-CICC to investigate and mitigate the breach. How We Can Assist: Concerned about how this might affect your operations? We’re here to support our clients with robust cybersecurity solutions to protect your vessels from similar vulnerabilities. Stay proactive in safeguarding your maritime operations. Contact us for expert cybersecurity support. #MaritimeCybersecurity #CyberResilience #DataBreach #MaritimeIndustry #CyberAttack

31

3 Kommentare