Cyber Threat Detection & Response
🇧🇷
Joined April 2009
- Tweets127
- Following679
- Followers166
- Likes741
Raphael Mendonça retweeted
🛑Ripple's recommend XRP JavaScript library, xrpl.js, was compromised on NPM in a supply chain attack to steal crypto wallets.
The index.js file and other functions were modified to include a function that sends private keys and seeds for XRP wallets to https://0x9c[.]xyz/xcm.
Raphael Mendonça retweeted
Our latest post detailing compromising the #PaloAlto #Expedition. While investigating CVE-2024-5910, we discovered and reported 3 additional vulnerabilities allowing an attacker to obtain RCE and leak integration credentials across the ecosystem.
horizon3.ai/attack-research/…
Raphael Mendonça retweeted
Microsoft identified a North Korean threat actor exploiting a zero-day vulnerability in Chromium (CVE-2024-7971) to gain remote code execution. Our assessment of ongoing analysis and observed infrastructure attributes this activity to Citrine Sleet. msft.it/6010l7S6w
Raphael Mendonça retweeted
📉Maior correção diária das criptomoedas a cada ano
2014: -17,3%
2015: -16,9%
2016: -14,2%
2017: -22,3%
2018: -19,0%
2019: -12,5%
2020: -39,6%
2021: -22,2%
2022: -13,5%
2023: -6,3%
2024: -8,4%
Raphael Mendonça retweeted
Manipulated Caiman: The Sophisticated Snare of Mexico's Banking Predators perception-point.io/blog/man…
Raphael Mendonça retweeted
Microsoft Incident Response's investigation of a BlackByte 2.0 ransomware attack that progressed in less than five days highlights the importance of disrupting common attack patterns, stopping attacker activities that precede ransomware deployment: msft.it/6010gxvlQ
Raphael Mendonça retweeted
O setor farmacêutico é alvo frequente de cibercriminosos, que visam informações e vantagens econômicas que vacinas e medicamentos podem oferecer.
Descubra mais sobre as Ameaças cibernéticas no setor farmacêutico e se prepare para o futuro: pwc.to/3Bs6obv.
Raphael Mendonça retweeted
[Q1 2023 Stealer Malware Intelligence Report - Global]
During the first quarter of 2023, 1,009,519 users were infected with the Stealer malware, which led to the leakage of about 118,665,570 credentials stored in their web browsers onto the dark web.
The accompanying map illustrates the geographic distribution of infected users during the first quarter of 2023.
Raphael Mendonça retweeted
ITS OUT! @PwC's Cyber Threats 2022: A Year in Retrospect was published this week. It's got a little something for everyone... geopolitics, TTPs, case studies from IR, etc - sourced from our global practice. #threatintel
pwc.com/gx/en/issues/cyberse…
Raphael Mendonça retweeted
How to do the @MISPProject to @msftsecurity Azure Sentinel integration with PyMISP? Read the blog post at misp-project.org/2023/04/03/… #cti
Raphael Mendonça retweeted
Ransomware groups Buhti and IceFire are hitting unpatched IBM Aspera Faspex file transfer servers
databreachtoday.com/ransomwa…
@euroinfosec reports
Analysis: @malware_traffic @rapid7 @sentinellabs @Shadowserver @assetnote @raphaelmendonca @Unit42_Intel
Raphael Mendonça retweeted
ISC diary: @malware_traffic finds more #malspam pushing #Astaroth (#Guildma) in January 2023 i5c.us/d29404
Raphael Mendonça retweeted
Our fraud researchers have discovered an ongoing multi-platform malware campaign targeting both Android & Windows users in #Brazil, resulting in thousands of infections and an estimated loss of hundreds of thousands of R$. We dubbed it #BrasDex.
threatfabric.com/blogs/brasd…
Raphael Mendonça retweeted
So yesterday was open #threatintel season on the Russia-based Callisto/SEABORGIUM crew, with a triple whammy of blogs from us and a couple of industry friends:
PwC: pwc.com/gx/en/issues/cyberse…
Recorded Future: recordedfuture.com/exposing-…
Sekoia: blog.sekoia.io/calisto-show-…
Raphael Mendonça retweeted
Reinschauer: A new PoC to remotely control Windows machines over Websockets.
github.com/ps1337/reinschaue…
#infosec
Raphael Mendonça retweeted
⚠️ Zimbra Mail pre-auth RCE via Path Traversal bug in unrar (CVE-2022-30333). This is probably my most impactful bug so far, especially after Zimbra has been the target of a 0day campaign likely conducted by a state actor. More details in this blog post: blog.sonarsource.com/zimbra-…
Raphael Mendonça retweeted
Very simple POC for Atlassian Confluence Pre-Auth OGNL Injection && RCE (CVE-2022-26134)
Setup a pre-built environment to test it in 5 seconds: github.com/vulhub/vulhub/tre…
Why 5 minutes not 10 seconds? Because you should apply a trial license from Atlassian😂#vulhub
