Threat Intelligence Bulletin – Russian Threat Actors, Leveraging Public Cloud Storage, and Cross-platform Capabilities with Rust
Netwrix Auditor application contains security vulnerability leading to arbitrary code execution in Active Directory domain if successfully exploited
VoIP phones utilizing Digium software and Elastix server software targeted to drop web shells
New method of leaking information across air gaps uses SATA or Serial ATA cables
CloudMensis spyware targeting Apple macOS using public cloud storage services to receive attack commands and exfiltrate files
Russian state-sponsored group APT29 attributed to new phishing campaign leveraging Google Drive and Dropbox to deliver malicious payloads
8220 crypto mining group grows to control 30,000 infected hosts
New Russian ransomware written in Rust dubbed “Luna” can encrypt Windows, Linux, and ESXi systems
Detailed information regarding exploitation of Windows RCE vulnerability in Network File System (CVE-2022-30136)
Longer read on how to abuse Duo misconfigurations in Windows and Active Directory