Abusing Web Services Using Automated CAPTCHA-Breaking Services and Residential Proxies

Credit to Author: Joey Costoya| Date: Thu, 25 May 2023 00:00:00 +0000

This blog entry features three case studies that show how malicious actors evade the antispam, antibot, and antiabuse measures of online web services via residential proxies and CAPTCHA-breaking services.

Read more

Future Exploitation Vector: File Extensions as Top-Level Domains

Credit to Author: Joshua Aquino| Date: Tue, 23 May 2023 00:00:00 +0000

In this blog entry, we will examine the security risks related to file extension-related Top-Level Domains (TLDs) while also providing best practices and recommendations on how both individual users and organizations can protect themselves from these hazards.

Read more

Healthcare cybersecurity updated in HIMSS23

Credit to Author: Kazuhisa Tagaya| Date: Fri, 19 May 2023 00:00:00 +0000

This update reports on the current state of cybersecurity in the healthcare industry from the CISA’s keynote in Cybersecurity forum of HIMSS23.

Read more

Rust-Based Info Stealers Abuse GitHub Codespaces

Credit to Author: Nitesh Surana| Date: Fri, 19 May 2023 00:00:00 +0000

This is the first part of our security analysis of an information stealer targeting GitHub Codespaces (CS) that discusses how attackers can abuse these cloud services for a variety of malicious activities.

Read more

Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices

Credit to Author: Fyodor Yarochkin| Date: Wed, 17 May 2023 00:00:00 +0000

An overview of the Lemon Group’s use of preinfected mobile devices, and how this scheme is potentially being developed and expanded to other internet of things (IoT) devices. This research was presented in full at the Black Hat Asia 2023 Conference in Singapore in May 2023.

Read more

8220 Gang Evolves With New Strategies

Credit to Author: Sunil Bharti| Date: Tue, 16 May 2023 00:00:00 +0000

We observed the threat actor group known as “8220 Gang” employing new strategies for their respective campaigns, including exploits for the Linux utility “lwp-download” and CVE-2017-3506, an Oracle WebLogic vulnerability.

Read more

Attackers Use Containers for Profit via TrafficStealer

Credit to Author: Alfredo Oliveira| Date: Wed, 26 Apr 2023 00:00:00 +0000

We found TrafficStealer abusing open container APIs in order to redirect traffic to specific websites and manipulate engagement with ads.

Read more