Last week's reporting gave a great insight into the level of innovation going on in the cyber crime ecosystem - C2 over MQTT, cryters delivering payloads over SQL connections, and UEFI bootkits that bypass Window's Secure Boot! We've pulled it all together, just for you:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-3fd

The BlackLotus #Bootkit has been upgraded to exploit a vulnerability in Microsoft's Secure Boot Mechanism, allowing it to persist on fully patched Windows 11 systems. This is enabled in no small part by the failure to update the UEFI revocation list, which allowed the bootkit author to simply load and exploit the vulnerable UEFI components on target systems.

Australia's cyber security laws were "bloody useless" in helping mitigate the Optus and Medibank breaches of 2022, according to the government's Home Affairs Minister. A new "national cyber office", reforms to Critical Infrastructure security laws, and a new Cyber Security Act are all on the table for discussion.

zScaler analysts have picked up on the Snip3 crypter, a Crypter-as-a-Sevice offering which uses multiple obfuscated stages; an AMSI Bypass, and SQL queries to circumvent security controls.

Sysdig share insights from a sophisticated #AWS-centric campaign; ESET have uncovered a new backdoor used by China's Mustang Panda (#APT27) which implements C2 over MQTT, and Team Cymru have again picked apart #IcedID's infrastructure to identify key TTPs.

Some interesting supply chain vulnerabilities this week, with bugs found in the ZK web app framework and Trusted Platform Module (TPM) having the potential to affect an untold number of applications and devices.

#Redteam members will get a kick out of DroppedConnection - a PoC that mimics Cisco AnyConnect VPN to siphon credentials and serve up malware to unwitting victims.

The #blueteam can look forward to some tips for GCP DFIR, bypassing malware geo-fencing, and tracking cyber criminal infrastructure.

Catch all this and much more in this week's newsletter:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-3fd

#infosec #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #soc #threatintel #threatintelligence #DarkWeb #criticalinfrastructure #breach #privacy #Australia #crypter

My latest #APT research on #IronTiger (#APT27/#EmissaryPanda/#LuckyMouse) is out ! It includes analysis of a new version of SysUpdate ported to Linux, a new communication protocol through DNS TXT requests, a VMProtect certificate compromise, and probable infection vector https://trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html

EU-Cyber-Sicherheitsbehörden warnen vor chinesischen Cybergangs | heise online https://www.heise.de/news/EU-Cyber-Sicherheitsbehoerden-warnen-vor-chinesischen-Cybergangs-7522269.html #Hacking #CyberCrime #APT27 #APT30 #APT31 #Ke3chang #Gallium #MustangPanda #China

RT @sekoia_io@twitter.com

🕵️‍♂️ Following @Intrinsec@twitter.com’s report on #APT27 🇨🇳, we have just published a blogpost where we analyze #LuckyMouse TTPs and provide #SIGMA detection rules for most of them: https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/

#DetectionEngineering

Belgio accusa la Cina di attacco hacker ai Ministeri Interni e Difesa - Matrice Digitale #apt27 #apt30 #apt31 #belgio #cina #cyberwarfare #evidenza #23luglio https://parliamodi.news/article/aHR0cHM6Ly93d3cubWF0cmljZWRpZ2l0YWxlLml0L25vdGl6aWUvYmVsZ2lvLWFjY3VzYS1sYS1jaW5hLWRpLWF0dGFjY28taGFja2VyLWFpLW1pbmlzdGVyaS1pbnRlcm5pLWUtZGlmZXNhLw==

RT @aRtAGGI
Which Chinese APT actors are active in Europe right now against the federal sector, well according to Belgian gov, #APT27, #APT31, and #Gallium. We know APT31 has for years targeted gov and parliamentary orgs in Europe. Would love more details on Gallium.
https://diplomatie.belgium.be/en/news/declaration-minister-foreign-affairs-malicious-cyber-activities

Major Gaming Companies Hit with Ransomware Linked to APT27 - Researchers say a recent attack targeting videogaming developers has 'strong links' to the infamou... https://threatpost.com/ransomware-major-gaming-companies-apt27/162735/ #ransomwareattack #gamingcompanies #cyberattacks #bronzeunion #supplychain #drbcontrol #ransomware #videogames #shellcode #covid-19 #malware #dropbox #winnti #hacks #apt27 #apt