Threats affecting Denmark

This intelligence report emphasizes the importance of understanding one's own environment and personal weaknesses in cybersecurity. It stresses the need for repeatable processes to maintain knowledge of one's environment and advocates for continuous learning to fill skill gaps. The report also highlights recent vulnerability disclosures by Cisco Talos across various software, including catdoc, Parallel, NVIDIA, and High-Logic FontCreator. It underscores the significance of promptly applying patches and remaining vigilant against potential exploits. Additionally, the report touches on recent cyber incidents affecting the NHS, United Natural Foods, and vulnerabilities in Google accounts and SinoTrack GPS devices.

Malware#critical infrastructure#ransomwareUnited Kingdom+9

Supply chain attack hits Gluestack NPM packages with 960K weekly downloads Source: https://www.bleepingcomputer.com/news/security/supply-chain-attack-hits-gluestack-npm-packages-with-960k-weekly-downloads/

Campaign#infosecnews#redditGermany+11

A sophisticated campaign using typo-squatted 'Spectrum' domains has been uncovered, spreading a new Atomic macOS Stealer (AMOS) variant. The attack, disguised as a CAPTCHA verification, employs dynamic payloads based on the victim's operating system. For macOS users, a malicious shell script steals system passwords and downloads an AMOS variant. The script uses native macOS commands to harvest credentials, bypass security, and execute malicious binaries. Russian-language comments in the source code suggest involvement of Russian-speaking cybercriminals. The campaign's delivery sites show flawed logic, indicating hasty assembly. This multi-platform social engineering attack targets both consumer and corporate users, highlighting an increasing trend in cross-platform threats.

Campaign#dynamic payload#spectrumGermany+7

This analysis examines cyber threats targeting government institutions worldwide, focusing on three case studies: a phishing email targeting the South Carolina Department of Employment and Workforce, a fraudulent domain mimicking the U.S. Social Security Administration, and a malicious PDF posing as a South African Judiciary notice. The study demonstrates how ANY.RUN's solutions, including Threat Intelligence Lookup, Interactive Sandbox, and YARA Search, can be utilized to detect, analyze, and mitigate these threats. Key findings include the use of FormBook stealer, remote access tools, and credential harvesting techniques. The analysis provides actionable insights for government cybersecurity teams to enhance their defensive strategies and response capabilities.

Campaign#screenconnect#phishingGermany+9

Apple Safari exposes users to fullscreen browser-in-the-middle attacks

News#infosecnews#redditGermany+7

Threat of TCC Bypasses on macOS

News#netsec#redditGermany+9