InfoSecBulletin Cybersecurity for mankind
Microsoft warn Iranian threat actor has targeted organizations in the Defense Industrial Base (DIB) sector with a campaign involving a new type of backdoor called FalseFont. Microsoft found the activity related to Peach Sandstorm (previously known as Holmium), also called APT33, Elfin, and Refined Kitten.
FalseFont is a type of malware that can be used to remotely control a hacked system and perform various actions, such as accessing files and sending data to its servers. This information comes from the Microsoft Threat Intelligence team. The first recorded use of the implant was in early November 2023.
Eight New ICS Advisories released by CISA
Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI
London-based company “Builder.ai” reportedly exposed 1.2 TB data
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall
“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA
CVE-2023-48788
Kaspersky reveals active exploitation of Fortinet Vulnerability
U.S. Weighs Ban on Chinese-Made Router TP-Link: WSJ reports
Daily Security Update Dated: 18.12.2024
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
ALSO READ:
The company stated that this new development is consistent with previous actions by Peach Sandstorm and shows that the threat actor’s methods are still evolving.
Microsoft’s report from September 2023 connected the group to password spray attacks on numerous organizations worldwide from February to July 2023. The attacks targeted satellite, defense, and pharmaceutical sectors. The company’s goal is to help gather intelligence for Iran. Peach Sandstorm has been active since 2013.
Israel’s National Cyber Directorate (INCD) has accused Iran and Hezbollah of attempting to hack Ziv Hospital. The hacking crews involved in the attempt were named Agrius and Lebanese Cedar.
The agency revealed a phishing campaign using a fake security advisory for F5 BIG-IP products to deliver wiper malware on Windows and Linux systems.
A critical authentication bypass vulnerability (CVE-2023-46747, CVSS score: 9.8) was discovered in late October 2023, and it is being used as bait for targeted attacks. The size of the campaign is not yet known.
