Hanan Levin

⚠ CYBERSECURITY HIGHLIGHTS FOR THE WEEK ⚠ Threat Actor in Focus - Emerging Threat: Void Manticore’s Destructive Cyber Campaigns Targeting Israeli Organizations Threat Actors: Void Manticore Attack Type: Public-facing web server Objective: Espionage Target Technology: Windows Target Geographies: Israel Target Industries: Government & Critical Infrastructure Business Impact: Data Loss, Data exfiltration Summary: Void Manticore (aka Storm-842) is an Iranian state-sponsored threat actor known for conducting destructive attacks on Israeli organizations and leaking information through the online persona ‘Karma’ (sometimes written as KarMa). These operations often target sectors such as government, finance, and critical infrastructure, aligning with Iran’s broader offensive strategy. The group employs straightforward and efficient techniques aimed at causing rapid and significant damage. Their operations extend beyond Israel, with attacks also reported in Albania, where they use the persona ‘Homeland Justice’ to leak stolen data. In Israel, Void Manticore is notable for utilizing a custom wiper named BiBi, after Israeli Prime Minister Benjamin Netanyahu. One common method Void Manticore uses to gain access to target systems is through internet-facing web servers like CVE-2019-0604, where they deploy web shells like the custom “Karma Shell.” This tool, disguised as an error page, can list directories, create processes, upload files, and manage services, using simple encryption methods like base64 and one-byte XOR for obfuscation. They have also been observed uploading a custom executable, do.exe, which checks for Domain Admin credentials. Upon successful authentication, it installs another web shell, reGeorge, indicating valid credentials. This suggests the initial access might be facilitated by another entity, possibly Scarred Manticore, a more sophisticated threat actor. Continue reading here ➡ https://lnkd.in/gvR_-7wt #CyberSecurity #Cyfirma #ETLM #externalthreatlandscape #ThreatIntelligence #CyberIntelligence #CYFIRMAResearch #malware #ransomware #threatactor #cybersecurityawareness Kumar Ritesh Dr. Saurabh Lal, P.D. Michael Henry Anna Koh Amit Thakur Harry Lee Glaiza Pardilla Harsha Vardhan Sam Parmar Rahul Raghav Yusuke Tateno Chiaki Izena（伊是名千晶）Greg Baylis David Plummer Rakesh R V Nicko Navarrete Ruri A. Hyungchan Mike Cho Montai Saiaroon Huy. Nguyen Tuong Vinh Dudley Swanepoel Mouli Saha Greg Baylis Vincent Cheng Julius S.

13

⚠️ 𝟐𝟒-𝐡𝐨𝐮𝐫 𝐰𝐚𝐫𝐧𝐢𝐧𝐠 ⚠️ There’s still room to register for tomorrow’s special session✨ Tune in as Tamir Frenkel & George Tubin tackle the most prolific cyberattack vectors and advise #cybersecurity capabilities for small teams to detect inbound threats → https://lnkd.in/d2aTG9kk #informationsecurity #MSP #SMB #MSSP #riskmanagement #threatintelligence

24

DATA BREACH ALERT - Alleged sale of clients database from the JSC NIKORA The threat actor is offering to sell a database of clients from the Georgian company, JSC Nikora, containing 23,106 unique lines of data. The data is from May 2024 and includes information such as first name, last name, phone number, ID number, email, and date of birth. - #data_breach #data_leak #infosec #dark_web #DataBreach  #DataLeak  #Services  #CyberThreat  #CyberAttack

3

Meet with us during RSA Conference and learn how AI-Powered Deception can help with early detection cyber attacks with precision. No false positives!!! 🔒 With traditional cyber defense, You, the Defender, must get it right all the time, but the threat actor needs to be right only once to compromise your critical assets. 🔑 Deception turns this asymmetry on its head to your benefit – with deception, the bad guy must be wrong only once to get caught. ✅ There are many use cases for Deception Technology. Our customers are using it for Advanced Threat Defense, Zero Days, Ransomware Protection, OT Security, Active Directory Protection and Identity Threat Detection and Response (ITDR). They are using it to accelerate their Zero Trust deployment. Suresh (Surra) Yanamadala Raj Gopalakrishna Suril Desai Chad Scrupps #CyberDeception #IdentityProtection #Honeytokens #Ransomware #InsiderThreats #APTs #ITDR

20

Check out CYJAX's latest cyber intelligence weekly round-up! This week's video explores cyberattacks linked to the Israel-Palestine conflict, global DNS probing by a Chinese threat actor, and a major data leak involving the New York Times. For the written version - subscribe to our newsletter here: https://lnkd.in/dFgKdKPU #DataBreach #CyberSecurityNews #ThreatIntelligence

7

Join us on Thursday the 27th to gain insight into mitigating the risk of DDoS attacks in our upcoming webinar: "The problem of DDoS attacks and the vulnerabilities that won't go away." Dr. Chase Cunningham, also known as Dr. Zero Trust, and Alon Yaffe, Senior Solution Architect at MazeBolt, will unravel the complexities of the persistent DDoS vulnerabilities that undermine cybersecurity efforts. Gain exclusive insights and strategic approaches to fortify your defenses and stay ahead of potential DDoS threats. Save your spot here: https://bit.ly/4aK05iQ #Webinar #MazeBolt #Vulnerabilities #DDoSDefense #DDoSVulnerabilities #CyberThreats #DDoSThreats #CyberSecurity #DDoS #CyberDefense

13

3 Comments

Cato Networks is coming to SharkFest'24 US to discuss IoT Security! Join us on June 19 at 11:45am for the session: “Passive Fingerprinting Methods for IoT Profiling”. Cato’s Data Science Team Lead, Asaf Fried, will discuss how to improve identity and network security for IoT with passive fingerprinting. He will share effective methods and practical examples and then show how to use them to enhance organizational security. More details here 👉 https://okt.to/ruJNQ0 #NetworkSecurity #SASE #Wireshark

7

How do you balance the need for #businesscontinuity against the need for #cybersecurity? Hint: it doesn't need to be so difficult. If you're in Israel, join us on Sunday to learn some of killer valuable tricks of the trade from our expert panel, moderated by the incomparable Tal Catran » https://lnkd.in/dUd7MJAR

16

Exciting news from Cato at RSA 2024! 📣 Discover the latest in threat research as we unveil how attackers exploit complex security architectures. Our Chief Security Strategist, Etay Maor, and Cato’s Security Services Manager, Tal Darsan, along with the Cato CTRL team, will lead discussions detailing today's critical cybersecurity challenges. Mark your calendars: 📈 "The Price is WRONG - An Analysis of Security Complexity" on May 6, 2024, at 10:50 a.m. PT. 🛡️ "Flying Under the Radar - New Security Evasion Techniques" on May 7, 2024, at 8:30 a.m. PT. Join us to learn how simplifying your security setup can mitigate risks and reduce the costs associated with data breaches 👉 https://okt.to/gQ8W6C #Cybersecurity #SASE #SecurityStrategy

39

Great to know to protect! Threat Actor in Focus - Emerging Threat: Void Manticore’s Destructive Cyber Campaigns Targeting Israeli Organizations Threat Actors: Void Manticore Attack Type: Public-facing web server Objective: Espionage Target Technology: Windows Target Geographies: Israel Target Industries: Government & Critical Infrastructure Business Impact: Data Loss, Data exfiltration

1

Your Security Operations Center (SOC) may be facing challenges I know inside and out. As the former Deputy Director General of the Israeli National Cyber Directorate (INCD), I was until recently in charge of leading the national operational posture and the Israeli National CERT. Now on my way to RSA, I can’t wait to share our new platform with fellow attendees. It just launched. It was built for SOC teams and leadership by expert, senior SOC and IR analysts who experienced the challenges we solve firsthand. Our work at Cyngular Security is truly remarkable, and I am proud of all our team has done to achieve it. Let’s connect there if you’re curious about our team’s groundbreaking work. Visit our website and request a demo to learn what THIRDhub is, why it is unique, and how it's going to dramatically enhance your Security Operations Center. If you can't make RSA, read more about THIRDhub in this article: https://lnkd.in/e9RBAeh9 #Cybersecurity #CloudSecurity #cloud #Cyberattack #MSSP #CloudIR #CIRA #CloudThreatHunting #ClouDFIR #CloudIR #DFIR #RSA #RSA2024

58

5 Comments

RedTeam Tips: Orchestrating Chaos, Evading Defense Culture Dive deep into the strategies and tactics of Red Teaming with experts from Amir Gholizadeh from Hadess | حادث and Nima D. from Nova Groups. Read now: https://lnkd.in/d2fnnSYq Shellcode to ASCII string API Testing Tip Wmiexec Evasion Exfiltration DNS Linux Binaries Nameless Excel Macro Hiding Malware Using Shadow Copy Usermode EDR hook bypass Process Instrumentation Callback Overpass-the-Hash Reconnaissance Tips Process Injections Local Code Injection DLL Injection Remote Thread Injection Thread Hijacking Classic APC Early Bird APC MapView Injection Binary Proxy Execution Active Directory Reversible Encryption RPC Payload development in smb or webdav amsi one line bypass Transfer Dns in Linux Execute the exfil command and transfer its information with icmp #redteam #hackthebox #activedirectory #networksecurity #hardening #microsoftad #redteamguide #edr #evading #activedirectorysecurity #cybersecurity #offensivesecurity #oscp #ecptx #crtp #crte #crto #crts #cyberwarfare

88

2 Comments

Don't miss our Threat Intelligence Briefing for an exclusive look at how attackers are exploiting weak security measures. Listen to the discussion now! https://lnkd.in/dppEu5-i #informationtechnology #cyber #cybersecurity #threatintelligence #threathunting #Israel #Gaza #APT #podcast #expert #insight #mssps

1

Today marks the beginning of the next chapter for everyone at Armis. The acquisition of Silk Security by Armis, THE Asset Intelligence Cybersecurity company will bring many benefits to Armis Centrix customers, and you can learn more at RSA. Book a meeting now to speak with one of our experts and let us help you solve your cyber challenges: https://lnkd.in/e_zs8D_W If you're interested in learning more about the acquisition, check out Yevgeny Dibrov, CEO & Co-Founder of Armis' blog on the topic. He shares his passion for the acquisition and what it means for Armis and our customers: https://lnkd.in/djnpy2_x For a deeper dive into how Silk Security's technology is powering Armis Centrix, read Nadir Izrael's CTO blog. He explains how this acquisition is a leap forward in addressing the security gap between the find and the fix: https://lnkd.in/d5W6qwFQ We lookforward to helping you solve even more of your cybersecurity challenges and ensuring that your entity stays safe and secure. #Cyber #CyberSecurity #MA #Mergers #Acquisition #Consolidation #SaaS #VulnerabilityManagement #Vulnerability #RiskResolution #RiskManagement #Prioritisation #Remediation #Optimisation #See #Protect #Manage #Armis #SilkSecurity

87

1 Comment

The recent #CheckPointResearch article, "Bad Karma, No Justice: VOID MANTICORE Destructive Activities in Israel," details the activities of VOID MANTICORE, a #cyberespionage group targeting Israeli organizations. The report highlights their use of sophisticated tactics, techniques, and procedures (#TTPs) to infiltrate networks, steal sensitive data, and deploy destructive #malware. The group’s activities are part of a broader trend of increasing #cyberthreats faced by #criticalinfrastructure in Israel, underscoring the need for robust #cybersecurity measures.

3

FS-ISAC EMEA Summit is in 1 week! Find us at Booth #16 to discover how to fortify your defenses and eliminate the path of least resistance for threat actors. Want to reserve some time in advance? Book a 1:1 meeting with one of our experts: https://lnkd.in/g8pj4qep? #Cybersecurity #FSISAC #EASM #ManageYourExposure

1

It is your destiny…

8