Technical

[Asyn]

Persistent parasite in EOL Magento 2 stores wakes at Black Friday
https://sansec.io/research/magento-2-persistent-parasite

[Asyn]

PLEASE_READ_ME: The Opportunistic Ransomware Devastating MySQL Servers
https://www.guardicore.com/labs/please-read-me-opportunistic-ransomware-devastating-mysql-servers/

[bob3160]

Partnership Executive Interview Series - Avast and Shadowserver
https://youtu.be/RZfPTfFTeSQ
The cat was certainly the star of the show.

[Asyn]

Qakbot Upgrades to Stealthier Persistence Method
https://www.binarydefense.com/qakbot-upgrades-to-stealthier-persistence-method/

[Asyn]

Partnership Executive Interview Series - Avast and Shadowserver
https://youtu.be/RZfPTfFTeSQ
The cat was certainly the star of the show.

Thanks for sharing Bob, interesting interview.

PS: You're right about the cat..!!

[bob3160]

Partnership Executive Interview Series - Avast and Shadowserver
https://youtu.be/RZfPTfFTeSQ
The cat was certainly the star of the show.

Thanks for sharing Bob, interesting interview.

PS: You're right about the cat..!!

Many strange things happen when using Zoom to do interviews or webinars.
I should know. I've seen some strange and sometimes not so pleasent things in the past 9 month.

[Asyn]

A Zebra in Gopher's Clothing: Russian APT Uses COVID-19 Lures to Deliver Zebrocy
https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/

[Asyn]

Unauthorized Access of FireEye Red Team Tools
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html
https://github.com/fireeye/red_team_tool_countermeasures

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

[Asyn]

MountLocker Ransomware-as-a-Service Offers Double Extortion Capabilities to Affiliates
https://blogs.blackberry.com/en/2020/12/mountlocker-ransomware-as-a-service-offers-double-extortion-capabilities-to-affiliates

[Asyn]

Unauthorized Access of FireEye Red Team Tools
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html
https://github.com/fireeye/red_team_tool_countermeasures

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

Malicious Domain in SolarWinds Hack Turned into ‘Killswitch’
https://krebsonsecurity.com/2020/12/malicious-domain-in-solarwinds-hack-turned-into-killswitch/

[Asyn]

Taking Action Against Hackers in Bangladesh and Vietnam
https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/

[Asyn]

Widespread malware campaign seeks to silently inject ads into search results, affects multiple browsers
https://www.microsoft.com/security/blog/2020/12/10/widespread-malware-campaign-seeks-to-silently-inject-ads-into-search-results-affects-multiple-browsers/

[Asyn]

Unauthorized Access of FireEye Red Team Tools
https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html
https://github.com/fireeye/red_team_tool_countermeasures

Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

Malicious Domain in SolarWinds Hack Turned into ‘Killswitch’
https://krebsonsecurity.com/2020/12/malicious-domain-in-solarwinds-hack-turned-into-killswitch/

Dark Halo Leverages SolarWinds Compromise to Breach Organizations
https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

[Asyn]

MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign
https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf

[Asyn]

PyMICROPSIA: New Information-Stealing Trojan from AridViper
https://unit42.paloaltonetworks.com/pymicropsia/