Bank Security @Bank_Security

bank-security.medium.com Joined September 2013

Tweets

4K
Followers

39K
Following

338
Likes

15K

Chris @phage_nz

a year ago

I'm a huge fan of using Obsidian for everything from a knowledgebase through to a shopping list. @Bank_Security has done a great job in this post of showing how effective it can be as a CTI tool: bank-security.medium.com/mastering-cybe…

0 31 116 11K 66

Bank Security @Bank_Security

2 years ago

Threat Intelligence with AI: The Power of Google Bard, Drive and Inoreader Integration medium.com/@bank-security…

3 32 83 16K 37

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

Since February 2023, Microsoft has observed password spray activity by Iranian threat actor Peach Sandstorm (HOLMIUM) against thousands of orgs, likely an attempt to collect intelligence to support Iranian interests. Get TTPs, mitigation, hunting guidance: msft.it/60129e0qE

2 97 196 56K 36

Will @BushidoToken

2 years ago

⚠️ Use Microsoft Teams? Watch out for TeamsPhisher! While it is not usually possible to send files to MS Teams users outside your org, by security researchers found a bypass by manipulating Teams web requests 🔥 github.com/Octoberfest7/T… Examples of MS Teams phish lures ⬇️ 1/3

2 146 411 82K 180

Download Image

The Citizen Lab @citizenlab

2 years ago

🚨🚨WE URGE EVERYONE TO UPDATE THEIR APPLE DEVICES AS SOON AS POSSIBLE. We have found an actively exploited #zero #click vulnerability that was used to deliver #NSO group’s #Pegasus #spyware. citizenlab.ca/2023/09/blastp…

81 2K 4K 2.2M 430

Will @BushidoToken

2 years ago

🎯#Qakbot Botnet Takedown in Operation Duck Hunt! 💻 700,000 Victim Computers 💰 $8.6m in cryptocurrency seized by DOJ 💰 Qakbot has earned $58m in ransoms 🔒 Qakbot used by Conti, ProLock, Egregor, REvil, MegaCortex, and Black Basta ransomware groups justice.gov/usao-cdca/pr/q…

4 110 241 39K 14

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

Microsoft has identified a nation-state actor tracked as Flax Typhoon quietly gaining and maintaining access to organizations in Taiwan via known exploits, malware, built-in tools, and legitimate VPN software. Get the actor's TTPs and detection info: msft.it/60119RbsD

5 163 284 64K 50

vx-underground @vxunderground

2 years ago

The vx-underground x @SentinelOne malware research competition has come to a conclusion and a winner has been chosen. @tr3gleos discovered an unknown malware family named "Net_Neo" which targets banking institutions primarily in Spain and Chile. sentinelone.com/blog/neo_net-t…

2 69 248 42K 38

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

Microsoft has detected increased credential attack activity by the threat actor Midnight Blizzard using residential proxy services to obfuscate the source of their attacks. These attacks target governments, IT service providers, NGOs, defense industry, and critical manufacturing.

3 315 726 178K 110

FalconFeeds.io @FalconFeedsio

2 years ago

KILLNET hackers group allegedly claims to have targeted IBAN banking system and they also claims to target SEPA, WISE and SWIFT. Meanwhile "REvil" group started a poll to select the targets. #killnet #REvil #infosec #cybersecurity #cyberattack

0 17 36 18K 7

Download Image

Chris Duggan @TLP_R3D

2 years ago

🔍Deep-dive on #MustangPanda indicators found in @TrendMicro's latest and awesome blog 🐼 📍5.188.33.190 (hostname mail.mofa[.]gov[.]tw) revealed an intriguing ssl cert. A #Shodan pivot unveiled another hit: 23.106.123.59 which also had hostname mail.mofa[.]gov[.]tw.…

3 38 97 22K 35

Download Image

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

In our continuous tracking of Russian govt affiliated threat groups, Cadet Blizzard (DEV-0586) has emerged as a novel GRU-affiliated actor that's conducted destructive operations likely supporting military objectives in Ukraine. Get TTPs & protection info: msft.it/6016gmzAq

5 140 240 96K 35

The Shadowserver Foundation @Shadowserver

2 years ago

At least 20.3K Fortinet devices likely vulnerable to CVE-2023-27997 (heap buffer overflow in sslvpn pre-authentication) seen in our scans (on 2023-06-12) Fortinet advisory: fortiguard.com/psirt/FG-IR-23… Dashboard: dashboard.shadowserver.org/statistics/com… Make sure to update your FortiOS/FortiProxy!

4 84 202 55K 40

Download Image

BleepingComputer @BleepinComputer

2 years ago

Fortinet fixes critical RCE flaw in Fortigate SSL-VPN devices, patch now - @LawrenceAbrams bleepingcomputer.com/news/security/…

13 224 478 158K 45

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

Microsoft is attributing attacks exploiting the CVE-2023-34362 MOVEit Transfer 0-day vulnerability to Lace Tempest, known for ransomware operations & running the Clop extortion site. The threat actor has used similar vulnerabilities in the past to steal data & extort victims.

8 381 772 314K 118

Download Image

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

A macOS vulnerability could allow an attacker with root access to bypass System Integrity Protection (SIP) and perform arbitrary operations on a device. Learn more about CVE-2023-32369, which we refer to as “Migraine”, and its patch in our latest blog: msft.it/6018gegrs

0 87 197 57K 31

Group-IB Threat Intelligence @GroupIB_TI

2 years ago

The Group-IB Threat Intelligence team has found a new #phishing kit #WonderP🔍 This phishing kit for rent primarily targets customers of German banks, but also has dormant functionality to target Dutch and Swiss victims in the future.

2 9 17 5K 2

Cerbero Labs @cprofiler

2 years ago

Extreme PowerShell Obfuscation: blog.cerbero.io/?p=2709 The following is valid PowerShell code: ${;}=+$();${=}=${;};${+}=++${;};${@}=++${;};${.}=++${;};${[}=++${;}; ${]}=++${;};${(}=++${;};${)}=++${;};${&}=++${;};${|}=++${;};…

9 138 520 97K 212

The Brofessor @Glacius_

2 years ago

Hey :) We published a #QakBot infrastructure analysis bringing some cool findings. #QakBot C2 servers are not separated by affiliate ID, identification of three upstream C2 servers located in Russia, upstream activity,etc: team-cymru.com/post/visualizi… IOCs included 🫡 @teamcymru_S2

2 77 204 35K 38

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

More actors are exploiting unpatched CVE-2023-27350 in print management software Papercut since we last reported on Lace Tempest. Microsoft has now observed Iranian state-sponsored threat actors Mint Sandstorm (PHOSPHORUS) & Mango Sandstorm (MERCURY) exploiting CVE-2023-27350.