[Referências do Episódio]

About the security content of iOS 17.1.2 and iPadOS 17.1.2 - https://support.apple.com/en-us/HT214031 

Zyxel security advisory for authentication bypass and command injection vulnerabilities in NAS products - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products 

New SugarGh0st RAT targets Uzbekistan government and South Korea - https://blog.talosintelligence.com/new-sugargh0st-rat/ 

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency - https://home.treasury.gov/news/press-releases/jy1933 

Zoom Vulnerability Allowed Hackers to Take Over Meetings, Steal Data - https://www.hackread.com/zoom-vulnerability-hackers-hijack-meetings-data/ 

New BLUFFS attack lets attackers hijack Bluetooth connections - https://www.bleepingcomputer.com/news/security/new-bluffs-attack-lets-attackers-hijack-bluetooth-connections/ 

DJVU Ransomware's Latest Variant 'Xaro' Disguised as Cracked Software - https://thehackernews.com/2023/11/djvu-ransomwares-latest-variant-xaro.html 

Black Basta Ransomware Has Extracted Over $100 Million From its Victims - https://www.corvusinsurance.com/blog/black-basta-ransomware-has-extracted-over-100-million-from-its-victims 

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Chrome Releases - Stable Channel Update for Desktop - Tuesday, November 28, 2023 - https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html

CVE-2023-49103: ownCloud Critical Vulnerability Quickly Exploited in the Wild - https://www.greynoise.io/blog/cve-2023-49103-owncloud-critical-vulnerability-quickly-exploited-in-the-wild 

DeleFriend: Severe design flaw in Domain Wide Delegation could leave Google Workspace vulnerable for takeover - https://www.hunters.security/en/blog/delefriend-a-newly-discovered-design-flaw-in-domain-wide-delegation-could-leave-google-workspace-vulnerable-for-takeover 

Prova de conceito do DeleFriend - https://github.com/axon-git/DeleFriend/ 

Exploitation of Unitronics PLCs used in Water and Wastewater Systems - https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems 

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads - https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/

Elastic catches DPRK passing out KANDYKORN - https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn

BlueNoroff APT group targets macOS with ‘RustBucket’ Malware - https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

BlueNoroff strikes again with new macOS malware - https://www.jamf.com/blog/bluenoroff-strikes-again-with-new-macos-malware/

Police dismantle ransomware group behind attacks in 71 countries - https://www.bleepingcomputer.com/news/security/police-dismantle-ransomware-group-behind-attacks-in-71-countries/

Roteiro e apresentação: Carlos Cabral e Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

DPRK state-linked cyber actors conduct software supply chain attacks - https://www.documentcloud.org/documents/24174869-rok-uk-joint-cyber-security-advisoryeng

Guidelines for secure AI system development - https://www.ncsc.gov.uk/files/Guidelines-for-secure-AI-system-development.pdf 

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

$19 Stanley cup deal is a Black Friday scam - https://www.malwarebytes.com/blog/news/2023/11/19-stanley-cup-deal-is-a-black-friday-scam

ISRAEL-HAMAS WAR SPOTLIGHT: SHAKING THE RUST OFF SYSJOKER - https://research.checkpoint.com/2023/israel-hamas-war-spotlight-shaking-the-rust-off-sysjoker/

Telekopye: Chamber of Neanderthals’ secrets - https://www.welivesecurity.com/en/eset-research/telekopye-chamber-neanderthals-secrets/

Roteiro e apresentação: Bianca Oliveira

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Diamond Sleet supply chain compromise distributes a modified CyberLink installer - https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/

New botnet malware exploits two zero-days to infect NVRs and routers - https://www.bleepingcomputer.com/news/security/new-botnet-malware-exploits-two-zero-days-to-infect-nvrs-and-routers/

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

New "Agent Tesla" Variant: Unusual "ZPAQ" Archive Format Delivers Malware - https://www.gdatasoftware.com/blog/2023/11/37822-agent-tesla-zpaq

Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors - https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/

Atomic Stealer distributed to Mac users via fake browser updates - https://www.malwarebytes.com/blog/threat-intelligence/2023/11/atomic-stealer-distributed-to-mac-users-via-fake-browser-updates

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Unveiling LummaC2 stealer’s novel Anti-Sandbox technique: Leveraging trigonometry for human behavior detection - https://outpost24.com/blog/lummac2-anti-sandbox-technique-trigonometry-human-detection/

MALWARE SPOTLIGHT – INTO THE TRASH: ANALYZING LITTERDRIFTER - https://research.checkpoint.com/2023/malware-spotlight-into-the-trash-analyzing-litterdrifter/

APT29 attacks embassies using CVE-2023-38831 - https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf

CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits - https://www.trendmicro.com/en_us/research/23/k/cve-2023-46604-exploited-by-kinsing.html

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

 Zimbra 0-day used to target international government organizations - https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/

Fortinet warns of critical command injection bug in FortiSIEM - https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-command-injection-bug-in-fortisiem/

Scattered Spider - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a

Protestware taps npm to call out wars in Ukraine, Gaza - https://www.reversinglabs.com/blog/protestware-taps-npm-to-call-out-wars-in-ukraine-gaza

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

November 2023 Security Updates - https://msrc.microsoft.com/update-guide/releaseNote/2023-Nov

Redundant Prefix Issue - ID 793262 - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/redundant-prefix-issue.html

Citrix Hypervisor Security Bulletin for CVE-2023-23583 and CVE-2023-46835 - https://support.citrix.com/article/CTX583037/citrix-hypervisor-security-bulletin-for-cve202323583-and-cve202346835

VMware - VMSA-2023-0026 - https://www.vmware.com/security/advisories/VMSA-2023-0026.html

SAP Security Patch Day –November 2023 - https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10

#StopRansomware: Rhysida Ransomware - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a

Investigating the New Rhysida Ransomware - https://www.fortinet.com/blog/threat-research/investigating-the-new-rhysida-ransomware

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

CISA Adds Six Known Exploited Vulnerabilities to Catalog - https://www.cisa.gov/news-events/alerts/2023/11/13/cisa-adds-six-known-exploited-vulnerabilities-catalog

#StopRansomware: Royal Ransomware - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Ddostf DDoS Bot Malware Attacking MySQL Servers - https://asec.ahnlab.com/en/58878/ 

In-Depth Analysis of July 2023 Exploit Chain Featuring CVE-2023-36884 and CVE-2023-36584 - https://unit42.paloaltonetworks.com/new-cve-2023-36584-discovered-in-attack-chain-used-by-russian-apt/ 

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Bitter Pill: Third-Party Pharmaceutical Vendor Linked to Pharmacy and Health Clinic Cyberattack - https://www.huntress.com/blog/third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack

BiBi Wiper Used in the Israel-Hamas War Now Runs on Windows - https://blogs.blackberry.com/en/2023/11/bibi-wiper-used-in-the-israel-hamas-war-now-runs-on-windows

NORTH KOREA-LINKED APT SAPPHIRE SLEET TARGETS IT JOB SEEKERS WITH BOGUS SKILLS ASSESSMENT PORTALS - https://securityaffairs.com/154082/apt/sapphire-sleet-apt-targets-it-job-seekers.html

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Microsoft: SysAid zero-day flaw exploited in Clop ransomware attacks - https://www.bleepingcomputer.com/news/security/microsoft-sysaid-zero-day-flaw-exploited-in-clop-ransomware-attacks/

SysAid On-Prem Software CVE-2023-47246 Vulnerability - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification

Hive Ransomware's Offspring: Hunters International Takes the Stage - https://www.bitdefender.com/blog/businessinsights/hive-ransomwares-offspring-hunters-international-takes-the-stage/

IMPERIAL KITTEN Deploys Novel Malware Families in Middle East-Focused Operations - https://www.crowdstrike.com/blog/imperial-kitten-deploys-novel-malware-families/

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology - https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology

Warning Against Phobos Ransomware Distributed via Vulnerable RDP - https://asec.ahnlab.com/en/58753/

Python obfuscation traps - https://checkmarx.com/blog/python-obfuscation-traps/

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

BlueNoroff strikes again with new macOS malware - https://www.jamf.com/blog/bluenoroff-strikes-again-with-new-macos-malware/

Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware - https://www.group-ib.com/blog/farnetwork/

Chinese APT Targeting Cambodian Government - https://unit42.paloaltonetworks.com/chinese-apt-linked-to-cambodia-government-attacks/

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors - https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/ 

Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518 - https://www.rapid7.com/blog/post/2023/11/06/etr-rapid7-observed-exploitation-of-atlassian-confluence-cve-2023-22518/ 

CVE-2023-38547 | CVE-2023-38548 | CVE-2023-38549 | CVE-2023-41723 - https://www.veeam.com/kb4508 

Jupyter Rising: An Update on Jupyter Infostealer - https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html 

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

Looney Tunables Vulnerability Exploited by Kinsing - https://blog.aquasec.com/loony-tunables-vulnerability-exploited-by-kinsing 

WhatsApp spy mod spreads through Telegram, attacks Arabic-speaking users - https://securelist.com/spyware-whatsapp-mod/110984/ 

New Microsoft Exchange zero-days allow RCE, data theft attacks - https://www.bleepingcomputer.com/news/microsoft/new-microsoft-exchange-zero-days-allow-rce-data-theft-attacks/ 

Unveiling Socks5Systemz: The Rise of a New Proxy Service via PrivateLoader and Amadey - https://www.bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

CVE-2023-22518 - Improper Authorization Vulnerability In Confluence Data Center and Confluence Server - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-confluence-server-1311473907.html

FROM ALBANIA TO THE MIDDLE EAST: THE SCARRED MANTICORE IS LISTENING - https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/

Massive cybercrime URL shortening service uncovered via DNS data - https://www.bleepingcomputer.com/news/security/massive-cybercrime-url-shortening-service-uncovered-via-dns-data/

Prolific Puma: Shadowy Link Shortening Service Enables Cybercrime - https://blogs.infoblox.com/cyber-threat-intelligence/prolific-puma-shadowy-link-shortening-service-enables-cybercrime/

IAmReboot: Malicious NuGet packages exploit loophole in MSBuild integrations - https://www.reversinglabs.com/blog/iamreboot-malicious-nuget-packages-exploit-msbuild-loophole

EXPERTS RELEASED POC EXPLOIT CODE FOR CISCO IOS XE FLAW CVE-2023-20198 - https://securityaffairs.com/153285/hacking/cisco-ios-xe-cve-2023-20198-poc.html

Investigation of Session Hijacking via Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966) - https://www.mandiant.com/resources/blog/session-hijacking-citrix-cve-2023-4966 

Roteiro e apresentação: Carlos Cabral

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

[Referências do Episódio]

- Three new NGINX ingress controller vulnerabilities reported and how they affect Kubernetes - https://www.armosec.io/blog/cve-2023-5043-nginx-ingress/

- K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747 - https://my.f5.com/manage/s/article/K000137353

- A cascade of compromise: unveiling Lazarus’ new campaign - https://securelist.com/unveiling-lazarus-new-campaign/110888/

- Ukrainian hackers disrupt internet providers in Russia-occupied territories - https://therecord.media/ukranian-hackers-disrupt-internet-providers-crimea 

Roteiro e apresentação: Carlos Cabral 

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia