Karol Kij

Hello Linkedin community!🌐 Cyberthint's April 2024 #ransomware report has been published! At Cyberthint, we closely monitor the activities of ransomware groups and shed light on the latest statistics every month. 📊🔍 In the meantime, some snaps from the report: - #Lockbit victim French hospital "CHC-SV" rejects ransom payment requests - Omni Hotels Hit by Ransomware Attack - Japanese Optical Giant #Hoya Hit by Ransomware Attack In this report you will also find the necessary information to protect your digital assets. 💡🔒 👉 https://lnkd.in/gG2mfZ_c Join us to unravel the complexities of the cyber realm and stay informed. Follow us to stay one step ahead of the game and learn strategies to keep you safe. 💪 Becasuse, we know what information #hackers have on you! #CyberSecurity #ThreatIntelligence #CTI #InformationSecurity

22

New feature in TaskForce 2024.6! 🎉 With the new TaskForce update, you can combine various ports into a group in Express mode. Each group has different settings of target folder, file format, type of hash to calculate, and case report fields. #dfir #digitalforensics #forensicimaging

13

Máte zájem se zapojit do beta programu ISACA nové certifikace Certified Cybersecurity Operations Analyst CCOA? The certification "Certified Cybersecurity Operations Analyst" (CCOA) is for cybersecurity analysts who need to develop and validate their knowledge and skills. A beta program involving professionals with two to three years of cybersecurity experience will launch 1 August 2024. Applications for the program will be open 1-31 July 2024. Exam passers will be recognized as CCOA certification holders. Who qualifies: The beta will consist of a limited number of approved applicants who: . Have two to three years of cybersecurity experience . Are able to perform technical cybersecurity tasks, and . Can prepare for and sit for the exam by 30 September 2024. Approved volunteers must purchase the beta materials at the discounted rate of US$299. What to expect: QAE, Review Manual, Exam: Selected participants will purchase the Questions, Answers, and Explanations (QAE) with 13 hands-on labs at the discounted rate of US$299 and receive a voucher to obtain the review manual and exam for free (a savings for members of nearly US$500 off the upcoming launch prices). Vouchers will be emailed after purchase of the QAE. Participants may also purchase the online review course at a reduced price of US$199 (a savings for members of US$350). Purchase of the online review course is not required to participate. What is next: . Applicants may apply for the CCOA beta program now through 31 July 2024. . Applications will be reviewed, and individuals who are selected for the limited program will receive details to begin the beta 1 August 2024. If you have or receive any questions, please contact ISACA Support.

4

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields. https://lnkd.in/djYk2ZVR #infosec #cybersecurity #pentest #pentesting #hacking #hackers #opensource

3

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields. https://lnkd.in/djYk2ZVR #infosec #cybersecurity #pentest #pentesting #hacking #hackers #opensource

1

Top #cybercrime investigation and #cyberlaw events of the 1st week of June: 1. Spain's most wanted cybercriminal arrested in Romania 2. Former top managers convicted of selling data on millions of Americans to fraudsters 3. Four arrested for aiding wanted cybercriminals bypass Interpol’s Red Notice system 4. ATM skimmer extradited to Puerto Rico to face charges of identity theft and bank fraud 5. Europol cracks down on money mule service providers laundering over 10M euros https://lnkd.in/gAaJrv5W #technology #law #justice #lawenforcement #cybersecurity

9

Enabling a DoS filter on the corporate firewall is not always enough to protect companies against #DDoS attacks. 🔒 What measures can more effectively prevent damage caused by such overload attacks? 💡 Learn more about protective measures against DDoS ➡ https://lnkd.in/dHDVDqHi

35

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields. https://lnkd.in/diQr87b6 #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

This week, cybersecurity experts from CERT Polska (CSIRT NASK) and CSIRT MON uncovered a significant malware campaign targeting governmental institutions in Poland. The attack, characterized by a sophisticated modus operandi, bears similarities to previous assaults on Ukrainian entities and is tentatively linked to the APT28 activity set, associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). The attackers employed cunning tactics, leveraging social engineering through compelling email content to entice recipients into clicking malicious links.   The technical analysis of the campaign reveals a multi-step infiltration strategy. The attackers initially distributed emails designed to pique recipients' curiosity, enticing them to click on a provided link. This link, housed within the run.mocky.io domain, was utilized as a redirect to another website, webhook.site, enabling the logging of queries and configuring responses. By utilizing widely-used, free services, the attackers aimed to evade detection, a tactic observed across various APT groups. Ultimately, victims were directed to download a seemingly innocuous ZIP archive purportedly containing photos but harboring malicious components, including a fake Windows calculator executable, a hidden BAT script, and a forged WindowsCodecs.dll file.   Upon execution, the malware deployed a technique known as DLL Side-Loading to run the included BAT script, which in turn initiated a series of actions culminating in the collection and transmission of victim data to a command and control (C2) server. The attackers employed a sophisticated loop mechanism, utilizing Microsoft Edge to download and execute additional scripts from webhook.site, orchestrating a comprehensive infiltration and data exfiltration process. The attack methodology closely mirrors that of previously documented malware, exemplifying the adversaries' adeptness at adapting and refining their tactics.   In response to this threat, CERT Polska issues recommendations to network administrators, urging vigilance and proactive measures to mitigate risk. Recommendations include scrutinizing connections to domains webhook.site and run.mocky.io, considering blocking these domains, and implementing email filtering for links originating from these services. Additionally, individuals are advised to disconnect potentially compromised devices from the network and promptly notify the appropriate CSIRT team in case of suspected malware infection, underscoring the importance of swift response and collaboration in combating sophisticated cyber threats.    #infosec #cyber #cybersec #cybersecurity #infosecurity     Source: https://lnkd.in/eCPUiZvZ  

2

This time we focused on USB Forensics - inside you will find three excellent articles on the topic, as well as a host of other pieces covering different fields https://lnkd.in/diQr87b6 #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

1

📅 **Bitdefender Threat Debrief | June 2024** - In total, 556 victims were claimed by ransomware groups in May. 🔍 **Key Insights**: - **Ransomware Trends**: Bitdefender monitors victim data, attack methods, and targeted industries to understand the evolving tactics of ransomware attackers. - **Data Collection Method**: Utilising ransomware leak sites where attackers publicise their activities; however, the reliability of such data can be questionable as it comes directly from criminal entities and only represents claimed victims, not the actual financial damage. 🏆 **Top 10 Ransomware Families**: - The report includes an analysis of the top ransomware families operating in May 2024. This helps in understanding the most active groups and their potential impact on various sectors. 🌍 **Top 10 Affected Countries**: - Ransomware attacks are predominantly targeted at developed nations where attackers can extract higher ransoms. The debrief lists the top 10 countries most impacted by these ransomware activities. Summary (auto generated) from the Bitdefender Threat Debrief | June 2024 by Bitdefender Source: https://lnkd.in/g2VYKYCE #securitytrends #infosec #cybersecurity #threatintel #threatintelligence #ciso

3

🤔 How can hackers extort thousands of euros from you and millions from a company? Our CISO Michal Srnec talked about this in the Let's Talk Business podcast for Startitup. Why hacker attacks are on the rise and what consequences can these attacks have on individuals and companies? Watch or listen for yourself. 👇 #letstalkbusiness #startitup #podcast #videocast

16

⚠ CYBERSECURITY HIGHLIGHTS FOR THE WEEK ⚠ Threat Actor in Focus - Persistent Cyber Intrusions: APT28’s Operations Against Global Institutions Threat Actors: APT28 Attack Type: Phishing Objective: Espionage Target Technology: Windows Target Geographies: Poland Target Industries: Government Business Impact: Data Loss, Data exfiltration Summary: A sophisticated cyber-espionage campaign, attributed to #APT28 and linked to the Russian GRU, has been actively targeting Polish government institutions. Techniques employed include DLL side-loading and executing scripts that further download and execute additional payloads. Their operations exhibit a high level of technical proficiency and employ a diverse range of techniques and objectives. One key indicator of their activity is the use of spear-phishing emails, meticulously crafted to appear legitimate and personalized to their targets within #government agencies. These emails often contain malicious links that lead to websites like run[.]mocky[.]io and webhook[.]site, which serve as initial entry points for malware delivery. Once victims click on the links, they unwittingly initiate the download of a ZIP archive containing malware disguised as image files. This archive typically includes a Windows Calculator binary, masquerading as a JPG image file, alongside hidden batch script and #DLL files. A notable aspect of APT28’s operations is their use of DLL side-loading, a technique that allows them to load a malicious DLL file while executing a legitimate application, thereby evading detection by security software. This enables APT28 to execute its malicious code surreptitiously, ultimately compromising the victim’s system. Furthermore, APT28 demonstrates a keen understanding of network evasion tactics, leveraging widely used services like run.mocky.io and webhook[.]site to obscure their malicious activities. By exploiting the trust associated with these legitimate platforms, APT28 reduces the likelihood of their malicious links being detected or blocked by security controls. Additionally, the group employs a multi-stage attack approach, incorporating social engineering tactics to maintain the illusion of legitimacy and deceive victims. Continue reading here ➡ https://bit.ly/3V0tiRM #CyberSecurity #Cyfirma #ETLM #externalthreatlandscape #ThreatIntelligence #CyberIntelligence #CYFIRMAResearch #malware #ransomware #threatactor #cybersecurityawareness Kumar Ritesh Dr. Saurabh Lal, P.D. Michael Henry Anna Koh Amit Thakur Harry Lee Glaiza Pardilla Harsha Vardhan Sam Parmar Rahul Raghav Yusuke Tateno Chiaki Izena（伊是名千晶）Greg Baylis David Plummer Rakesh R V Nicko Navarrete Ruri A. Hyungchan Mike Cho Montai Saiaroon Huy. Nguyen Tuong Vinh Dudley Swanepoel Mouli Saha Greg Baylis Vincent Cheng Julius S.

12

What is NIS2, really? 👇 NIS2 is approaching fast, bringing significant cybersecurity changes. In this first part of your NIS2 guide, you get answers to questions like: ❓ What is NIS? ❓Why NIS2? ❓What are the biggest differences between NIS and NIS2? The next part will be about sectors and industries affected and how company size plays a crucial role. #NIS2 #NIS #cybersecurity #versioncontrol #backup 

12

What is NIS2, really? 👇 NIS2 is approaching fast, bringing significant cybersecurity changes. In this first part of your NIS2 guide, you get answers to questions like: ❓ What is NIS? ❓Why NIS2? ❓What are the biggest differences between NIS and NIS2? The next part will be about sectors and industries affected and how company size plays a crucial role. #NIS2 #NIS #cybersecurity #versioncontrol #backup

5

20 - 24.04.2024 - Częstochowa, Poland CYBER SECURITY TRAINING AT THE EU LEVEL As part of a five-day cybersecurity training, participants had the opportunity to explore key aspects of this field under the supervision of experienced teachers, Gabriela Ochoa-Dąderska and Kacper K., conducted by INBIE - Fundacja Instytut Badań i Innowacji w Edukacji. On the first day, participants learned about the basic definitions and concepts related to cybersecurity and the variety of threats on the Internet. They learned why #cybersecurity is important both for individuals and for companies and institutions. The second day was devoted to basic issues in the field of network security, where the architecture of computer #networks, basic network protocols (including TCP/IP) and types of network attacks (including #phishing, #DDoS attacks) were discussed. The third day focused on the basics of system security, including operating systems such as Windows, Linux and macOS, security updates and patches, and the basics of managing passwords and user accounts. The fourth day was devoted to data protection, where the role and importance of data in today's digital world, the basics of data encryption and the management of personal data in accordance with regulations were discussed. At the end of the fifth day, participants focused on application security and the implementation of security policies, where risk and application vulnerability management were #analyzed and #security policies were implemented, including access rules, monitoring and auditing. Additionally, participants were given practical classes to apply their knowledge of cybersecurity in #practice. The training provided participants with a solid #foundation in cybersecurity and practical #skills that they can apply in their everyday #work. Within the scope of the Erasmus+KA121-VET Accreditation in Vocational Education project numbered 2023-1-TR01-KA121-VET-000163148, carried out under the coordination of Osmaniye Provincial Directorate of National Education. #inbie #training #cybersecurity

4

This month, we have prepared for you a set of texts about digital forensics tools and how to use them in practice. https://lnkd.in/dDr2nCYh #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #opensource #windows

1