Matinale cyber du 20 Février 2023

📰 La UNE 📰

🏴‍☠️ Attaques 🏴‍☠️

Atlassian = vol de données perso des employés: https://cyberscoop.com/atlassian-hack-employee-data-seigedsec/
Cloudflare bloque un DDoS de 71Mrps: https://blog.cloudflare.com/cloudflare-mitigates-record-breaking-71-million-request-per-second-ddos-attack/
Piratage des mails de Namecheap: https://www.namecheap.com/status-updates/archives/74848
Royal Mail "il vous faut un nouveau négociateur": https://www.lemagit.fr/actualites/252529186/Cyberattaque-de-la-poste-britannique-la-franchise-LockBit-ou-un-tiers
Twitter de l'ambassadeur cyber US piraté: https://edition.cnn.com/2023/02/05/politics/nate-fick-twitter-hack-cybersecurity/index.html
IBM Aspera Faspex servers ?: https://archive.ph/H9OSf
TCC (Tonga FAI) touché par un ransomware: https://therecord.media/tonga-is-the-latest-pacific-island-nation-hit-with-ransomware/
SAS (scandinavian airlines) piratée: https://www.sasgroup.net/newsroom/press-releases/2023/sas-cyber-attack--update/
Encore ESXiArgs: https://censys.io/the-evolution-of-esxiargs-ransomware/
Pybot: malware dans un générateur de codes Discord : https://asec.ahnlab.com/en/47789/
6 packages npm malveillants: https://blog.checkpoint.com/2023/02/14/check-point-cloudguard-spectral-detects-malicious-crypto-mining-packages-on-npm-the-leading-registry-for-javascript-open-source-packages/
package Pypi malveillant: https://blog.phylum.io/phylum-discovers-go-based-rat-spark-being-distributed-on-pypi

📢 Annonces 📢

Framework légal pour le le Responsible disclosure en Belgique: https://ccb.belgium.be/en/news/new-legal-framework-reporting-it-vulnerabilities
FTC donne 115 M$ d'amende pour MoneyGram à cause d'arnaqueurs: https://www.ftc.gov/news-events/news/press-releases/2023/02/more-115-million-refunds-sent-consumers-result-ftc-doj-charges-moneygram-failed-crack-down-scams
Ubuntu RTOS: https://canonical.com/blog/real-time-ubuntu-is-now-generally-available
Google teste le pré-bunke de fake news russe: https://medium.com/jigsaw/defanging-disinformations-threat-to-ukrainian-refugees-b164dbbc1c60
Du relâchement sur les tels pro du DOD: https://www.dodig.mil/reports.html/Article/3294159/management-advisory-the-dods-use-of-mobile-applications-report-no-dodig-2023-041/
Arrestation d'un sextorteur en série: https://www.vice.com/en/article/4axjbm/sim-swapper-amir-golshan-instagram-influencers-dates-strip
Arrestation de 9 suspects dans un réseau d'arnaques: https://www.policia.es/_es/comunicacion_prensa_detalle.php?ID=15307
Meta Verified = un blue check sur instagram: https://www.lemonde.fr/pixels/article/2023/02/19/meta-mark-zuckerberg-annonce-le-lancement-d-un-abonnement-payant-pour-authentifier-son-compte_6162487_4408996.html

🌏 Géopolitique 🌍

Story Killers = Ingérance chez BFMTV par la "Team Jorge": https://www.francetvinfo.fr/monde/story-killers/soupcon-d-ingerence-a-bfmtv-derriere-le-cas-de-rachid-m-barki-l-enquete-story-killers-revele-le-role-d-une-agence-de-desinformation-israelienne_5659016.html
Enquete de Politico sur les activités de Prigozhine: https://www.politico.com/news/2023/02/18/russia-wagner-group-ukraine-paramilitary-00083553
[ ] Positive Technologies ferme ses bureaux en Europe: https://www-rbc-ru.translate.goog/technology_and_media/01/02/2023/63d90e8c9a79478299b258ad?_x_tr_sl=fr&_x_tr_tl=zh-CN&_x_tr_hl=fr&_x_tr_pto=wapp

🕵️ Threat Intelligence 🕵️

MortalKombat, nouvelle variante de ransomware: https://www.lemagit.fr/actualites/365531517/MortalKombat-un-nouveau-ransomware-repere-par-Cisco-Talos
Exchange Simbad est en fait le retour de Blender: https://hub.elliptic.co/8613
Échapper à la détection avec des bips: https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
APT chinois Dalbit: https://asec.ahnlab.com/en/47455/
DPRK APT37: https://asec-ahnlab-com.translate.goog/ko/47622/&_x_tr_sl=fr&_x_tr_tl=zh-CN&_x_tr_hl=fr&_x_tr_pto=wapp

⚠️ Vulnérabilités ⚠️

iOS/WebKit 0-day: https://www.bleepingcomputer.com/news/security/apple-fixes-new-webkit-zero-day-exploited-to-hack-iphones-macs/
Résultats de l'audit de cURL: https://blog.trailofbits.com/2023/02/14/curl-audit-fuzzing-libcurl-command-line-interface/
(Patch Tuesday) 3 0-day chez Microsoft: https://rawcdn.githack.com/campuscodi/Microsoft-Patch-Tuesday-Security-Reports/b5f6670cd5280ad37f72f32274960b24650d4e33/Reports/MSRC_CVEs2023-Feb.html
Hyundai et Kia corrigent une vuln qui permet de voler une voiture: https://www.bleepingcomputer.com/news/security/hyundai-kia-patch-bug-allowing-car-thefts-with-a-usb-cable
Pwn2Own Miami (ICS): https://www.zerodayinitiative.com/blog/2023/2/13/pwn2own-miami-2023-the-full-schedule
Vol des certificats d'Emisoft: https://www.emsisoft.com/en/blog/43619/alert-threat-actors-are-using-fake-emsisoft-code-signing-certificates-to-disguise-their-attacks/
(Patch Tuesday) Apple: https://support.apple.com/en-us/HT201222
(Patch Tuesday) Adobe: https://helpx.adobe.com/security/security-bulletin.html
(Patch Tuesday) Git: https://lore.kernel.org/git/xmqqr0us5dio.fsf@gitster.g/T/#u
(Patch Tuesday) SAP: https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
(Patch Tuesday) Android: https://source.android.com/docs/security/bulletin/2023-01-01&hl=fr
(Patch Tuesday) OpenSSL: https://mta.openssl.org/pipermail/openssl-announce/2023-February/000251.html
(Patch Tuesday) VMWare: https://www.vmware.com/security/advisories.html

💸 Des Crypto-Échanges piratés ? 💸

OneKey : https://fortune.com/crypto/2023/02/09/cyber-firm-cracks-onekey-crypto-wallets-in-video-raises-questions-hardware-security/
Réseau d'arnaques (700 chaines) sur Youtube: https://labs.withsecure.com/publications/usdt-crypto-scams

🔎 Les Articles 🔎

Epuisement des équipes de défense: https://www-lemondeinformatique-fr.cdn.ampproject.org/c/s/www.lemondeinformatique.fr/actualites/lireamp-gros-coup-de-fatigue-pour-les-equipes-forensiques-et-de-reponse-a-incident-cyber-89567.html
Reconstruction d'un AD: https://www.riskinsight-wavestone.com/2023/02/reconstruction-dactive-directory-comment-se-donner-les-moyens-dy-parvenir/
Ukraine : https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
RETEX = Comment Thalès a pisté la fuite de données: https://www.lemagit.fr/actualites/365531452/Ransomware-dans-les-coulisses-de-la-fausse-revendication-de-LockBit-contre-Thales
(CTI) https://minerva-labs.com/blog/beepin-out-of-the-sandbox-analyzing-a-new-extremely-evasive-malware/
(WU) RCE dans un NAS: https://www.synacktiv.com/publications/exploiting-a-remote-heap-overflow-with-a-custom-tcp-stack.html

Blog