Technical

[Asyn]

EU officially blames Russia for 'Ghostwriter' hacking activities
https://www.bleepingcomputer.com/news/security/eu-officially-blames-russia-for-ghostwriter-hacking-activities/

[Asyn]

Financially motivated actor breaks certificate parsing to avoid detection
https://blog.google/threat-analysis-group/financially-motivated-actor-breaks-certificate-parsing-avoid-detection/

[Asyn]

FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor
https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/

[Asyn]

Microsoft WPBT flaw lets hackers install rootkits on Windows devices
https://www.bleepingcomputer.com/news/security/microsoft-wpbt-flaw-lets-hackers-install-rootkits-on-windows-devices/

[Asyn]

BloodyStealer and gaming assets for sale
https://securelist.com/bloodystealer-and-gaming-assets-for-sale/104319/

[Asyn]

FinSpy: unseen findings
https://securelist.com/finspy-unseen-findings/104322/

[Asyn]

Apple Pay with VISA lets hackers force payments on locked iPhones
https://www.bleepingcomputer.com/news/security/apple-pay-with-visa-lets-hackers-force-payments-on-locked-iphones/
https://practical_emv.gitlab.io/assets/practical_emv_rp.pdf

[Asyn]

GriftHorse Android Trojan Steals Millions from Over 10 Million Victims Globally
https://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally/

[Asyn]

DarkHalo after SolarWinds: the Tomiris connection
https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/

[Asyn]

A wolf in sheep's clothing: Actors spread malware by leveraging trust in Amnesty International and fear of Pegasus
https://blog.talosintelligence.com/2021/09/fakeantipegasusamnesty.html

[Asyn]

US unites 30 countries to disrupt global ransomware attacks
https://www.bleepingcomputer.com/news/security/us-unites-30-countries-to-disrupt-global-ransomware-attacks/

[Asyn]

GhostEmperor: From ProxyLogon to kernel mode
https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf

[Asyn]

A New variant of Hydra Banking Trojan Targeting European Banking Users
https://blog.cyble.com/2021/09/30/a-new-variant-of-hydra-banking-trojan-targeting-european-banking-users/

[Asyn]

RansomEXX, Fixing Corrupted Ransom
https://medium.com/proferosec-osm/ransomexx-fixing-corrupted-ransom-8e379bcaf701

[Asyn]

Misconfigured Airflows Leak Thousands of Credentials from Popular Services
https://www.intezer.com/blog/cloud-security/misconfigured-airflows-leak-credentials/