[Referências do Episódio]

- North Korea Using Social Engineering to Enable Hacking of Think Tanks, Academia, and Media - https://media.defense.gov/2023/Jun/01/2003234055/-1/-1/0/JOINT_CSA_DPRK_SOCIAL_ENGINEERING.PDF

- North Korean Advanced Persistent Threat Focus: Kimsuky - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a

- New Magecart-Style Campaign Abusing Legitimate Websites to Attack Others - https://www.akamai.com/blog/security-research/new-magecart-hides-behind-legit-domains

- Como configurar autenticação baseada em certificados SSH - https://sidechannel.blog/como-configurar-autenticacao-baseada-em-certificados-ssh/

- MALWARE SPOTLIGHT: CAMARO DRAGON’S TINYNOTE BACKDOOR - https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Operation Triangulation: iOS devices targeted with previously unknown malware - https://securelist.com/operation-triangulation/109842/

- New Horabot campaign targets the Americas - https://blog.talosintelligence.com/new-horabot-targets-americas/

- When byte code bites: Who checks the contents of compiled Python files? - https://www.reversinglabs.com/blog/when-python-bytecode-bites-back-who-checks-the-contents-of-compiled-python-files 

- Rapid7 Observed Exploitation of Critical MOVEit Transfer Vulnerability - https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/

- MOVEit Transfer Critical Vulnerability (May 2023) - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Tempest Vuln Watchlist - https://www.tempest.com.br/gerenciamento/threat-intelligence/vuln-watchlist/#contact

- SUPPLY CHAIN RISK FROM GIGABYTE APP CENTER BACKDOOR - https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/

- Dark Pink. Episode 2 - https://www.group-ib.com/blog/dark-pink-episode-2/

- CISA Adds One Known Exploited Vulnerability to Catalog - https://www.cisa.gov/news-events/alerts/2023/05/31/cisa-adds-one-known-exploited-vulnerability-catalog

- Reverse Engineering RokRAT: A Closer Look at APT37’s Onedrive-Based Attack Vector - https://threatmon.io/reverse-engineering-rokrat-a-closer-look-at-apt37s-onedrive-based-attack-vector/ 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- PixBankBot: New ATS-Based Malware Poses Threat to the Brazilian Banking Sector - https://blog.cyble.com/2023/05/30/pixbankbot-new-ats-based-malware-poses-threat-to-the-brazilian-banking-sector/

- New macOS vulnerability, Migraine, could bypass System Integrity Protection - https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/

- Barracuda Email Security Gateway Appliance (ESG) Vulnerability - https://www.barracuda.com/company/legal/esg-vulnerability 

- Fog of war: how the Ukraine conflict transformed the cyber threat landscape - https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/

- Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals - https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- GobRAT malware written in Go language targeting Linux routers - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html

- DogeRAT: The Android Malware Campaign Targeting Users Across Multiple Industries - https://cloudsek.com/blog/dogerat-the-android-malware-campaign-targeting-users-across-multiple-industries

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- New Info Stealer Bandit Stealer Targets Browsers, Wallets - https://www.trendmicro.com/en_us/research/23/e/new-info-stealer-bandit-stealer-targets-browsers-wallets.html

- CISA adds recently patched Barracuda zero-day to its Known Exploited Vulnerabilities catalog - https://securityaffairs.com/146729/security/cisa-barracuda-0day-catalog.html

- Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) on May 19, 2023. - https://status.barracuda.com/incidents/34kx82j5n4q9

- Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware - https://blog.talosintelligence.com/mercenary-intellexa-predator/

- The Dark Frost Enigma: An Unexpectedly Prevalent Botnet Author Profile - https://www.akamai.com/blog/security-research/dark-frost-botnet-unexpected-author-profile 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Operation Magalenha | Long-Running Campaign Pursues Portuguese Credentials and PII - https://www.sentinelone.com/labs/operation-magalenha-long-running-campaign-pursues-portuguese-credentials-and-pii/

- Volt Typhoon targets US critical infrastructure with living-off-the-land techniques - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

- COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises - https://www.mandiant.com/resources/blog/cosmicenergy-ot-malware-russian-response

- Buhti: New Ransomware Operation Relies on Repurposed Payloads - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/buhti-ransomware

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Legion Update to attach SSH Servers - https://www.cadosecurity.com/updates-to-legion-a-cloud-credential-harvester-and-smtp-hijacker/

- Technical Analysis of Pikabot - https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot

- Agrius Deploys Moneybird in attacks against israeli organizations - https://research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-against-israeli-organizations/

- Attacks against Ukranian organization - https://thehackernews.com/2023/05/cyber-attacks-strike-ukraines-state.html e https://cert.gov.ua/article/4697016

[Ficha técnica]

Apresentação: Daniel Venzi

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Meet the GoldenJackal APT group. Don’t expect any howls - https://securelist.com/goldenjackal-apt-group/109677/

- Android app breaking bad: From legitimate screen recording to file exfiltration within a year - https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/

- Lazarus Group Targeting Windows IIS Web Servers - https://asec.ahnlab.com/en/53132/ 

- StrelaStealer Being Distributed To Spanish Users - https://asec.ahnlab.com/en/53158/ 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- BlackCat Ransomware Deploys New Signed Kernel Driver - https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html

- CLOUD-BASED MALWARE DELIVERY: THE EVOLUTION OF GULOADER - https://research.checkpoint.com/2023/cloud-based-malware-delivery-the-evolution-of-guloader/

- CISA Adds Three Known Exploited Vulnerabilities to Catalog - https://www.cisa.gov/news-events/alerts/2023/05/22/cisa-adds-three-known-exploited-vulnerabilities-catalog

- CVE-2023-32154 - https://blog.mikrotik.com/security/cve-2023-32154.html

- Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor/

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- PyPI new user and new project registrations temporarily suspended: Incident Report for Python Infrastructure - https://status.python.org/incidents/qy2t9mjjcc7g

- Phishing attacks already using the .zip TLD - https://news.netcraft.com/archives/2023/05/17/phishing-attacks-already-using-the-zip-tld.html

- KeePass 2.X Master Password Dumper (CVE-2023-32784) - https://github.com/vdohney/keepass-password-dumper

- Security - Dumping Master Password from Memory, Even When Locked - https://sourceforge.net/p/keepass/discussion/329220/thread/f3438e6283/#8a4a

- Notorious Cyber Gang FIN7 Returns With Cl0p Ransomware in New Wave of Attacks - https://thehackernews.com/2023/05/notorious-cyber-gang-fin7-returns-cl0p.html

- Rust-Based Info Stealers Abuse GitHub Codespaces - https://www.trendmicro.com/en_us/research/23/e/rust-based-info-stealers-abuse-github-codespaces.html

- Abusing a GitHub Codespaces Feature For Malware Delivery - https://www.trendmicro.com/en_us/research/23/a/abusing-github-codespaces-for-malware-delivery.html\

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- About the security content of iOS 16.5 and iPadOS 16.5 - https://support.apple.com/en-us/HT213757

- Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices - https://www.trendmicro.com/en_us/research/23/e/lemon-group-cybercriminal-businesses-built-on-preinfected-devices.html

- PSA: Attackers Actively Exploiting Critical Vulnerability in Essential Addons for Elementor - https://www.wordfence.com/blog/2023/05/psa-attackers-actively-exploiting-critical-vulnerability-in-essential-addons-for-elementor/

- CISA Releases Five Industrial Control Systems Advisories - https://www.cisa.gov/news-events/alerts/2023/05/18/cisa-releases-five-industrial-control-systems-advisories 

- Papo Binário Gravação EP #100 - https://www.youtube.com/watch?v=HK-sHky1PEs

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- YouTube do Mente Binária - https://www.youtube.com/@mentebinaria/streams

- Playing for the Wrong Team: Dangerous Functionalities in Microsoft Teams Enable Phishing and Malware Delivery by Attackers - https://www.proofpoint.com/us/blog/threat-insight/dangerous-functionalities-in-microsoft-teams-enable-phishing

- Cisco Small Business Series Switches Buffer Overflow Vulnerabilities - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sg-web-multi-S9g4Nkgv 

- Minas – on the way to complexity - https://securelist.com/minas-miner-on-the-way-to-complexity/109692

- #StopRansomware: BianLian Ransomware Group - https://www.cyber.gov.au/about-us/advisories/stopransomware-bianlian-ransomware-group 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Geacon Brings Cobalt Strike Capabilities to macOS Threat Actors - https://www.sentinelone.com/blog/geacon-brings-cobalt-strike-capabilities-to-macos-threat-actors/

- Infos stealer first trimester 2023 - https://www.bleepingcomputer.com/news/security/the-new-info-stealing-malware-operations-to-watch-out-for/ e https://ke-la.com/emerging-infostealers-2023-report/

- Qilin Ransomware - https://www.group-ib.com/blog/qilin-ransomware/

- Operação deflagra em combate ao crime de estelionato previdenciário - https://www.gov.br/pf/pt-br/assuntos/noticias/2023/05/pf-deflagra-operacao-em-combate-ao-crime-de-estelionato-previdenciario

[Ficha técnica]

Apresentação: Daniel Venzi

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor

- Water Orthrus's New Campaigns Deliver Rootkit and Phishing Modules - https://www.trendmicro.com/en_us/research/23/e/water-orthrus-new-campaigns-deliver-rootkit-and-phishing-modules.html

- Newly identified RA Group compromises companies in U.S. and South Korea with leaked Babuk source code - https://blog.talosintelligence.com/ra-group-ransomware/

- Vulnerabilities Uncovered Affect Thousands of Internet-Connected Devices Worldwide - https://www.otorio.com/blog/teltonkia-cloud-takeover-vulnerability-exposed/

- Triple Threat: Breaking Teltonika Routers Three Ways - https://claroty.com/team82/research/triple-threat-breaking-teltonika-routers-three-ways 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- CISA Adds Seven Known Exploited Vulnerabilities to Catalog - https://www.cisa.gov/news-events/alerts/2023/05/12/cisa-adds-seven-known-exploited-vulnerabilities-catalog

- BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game - https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game 

- Securonix Threat Labs Security Advisory: Latest Update: Ongoing MEME#4CHAN Attack/Phishing Campaign uses Meme-Filled Code to Drop XWorm Payloads - https://www.securonix.com/blog/securonix-threat-labs-security-meme4chan-advisory/ 

- Chaining Five Vulnerabilities to Exploit Netgear Nighthawk RAX30 Routers at Pwn2Own Toronto 2022 - https://claroty.com/team82/research/chaining-five-vulnerabilities-to-exploit-netgear-nighthawk-rax30-routers-at-pwn2own-toronto-2022 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- TEMPEST TURING DAY 2023 - https://www.even3.com.br/turingday2023/ 

- Critical Privilege Escalation in Essential Addons for Elementor Plugin Affecting 1+ Million Sites - https://patchstack.com/articles/critical-privilege-escalation-in-essential-addons-for-elementor-plugin-affecting-1-million-sites/ 

- Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers - https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/

- Uncovering RedStinger - Undetected APT cyber operations in Eastern Europe since 2020 - https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger

- CISA Releases Fifteen Industrial Control Systems Advisories - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-releases-fifteen-industrial-control-systems-advisories

- Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Deep Dive Into DownEx Espionage Operation in Central Asia - https://www.bitdefender.com/blog/businessinsights/deep-dive-into-downex-espionage-operation-in-central-asia/

- From One Vulnerability to Another: Outlook Patch Analysis Reveals Important Flaw in Windows API - https://www.akamai.com/blog/security-research/important-outlook-vulnerability-bypass-windows-api

- New phishing-as-a-service tool “Greatness” already seen in the wild - https://blog.talosintelligence.com/new-phishing-as-a-service-tool-greatness-already-seen-in-the-wild/

- White Phoenix - https://github.com/cyberark/White-Phoenix

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Patch Tuesday maio - https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2023-patch-tuesday-fixes-3-zero-days-38-flaws/

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29336

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29325

- ESET APT Report Q4 2022 - Q1 2023 - https://www.welivesecurity.com/2023/05/09/eset-apt-activity-report-q42022-q12023/

- CISA ICS Vulnerabilities - https://www.cisa.gov/news-events/alerts/2023/05/09/cisa-releases-two-industrial-control-systems-advisories

- SideWinder Uses Server Polymorphism to Target Pakistan - https://blogs.blackberry.com/en/2023/05/sidewinder-uses-server-side-polymorphism-to-target-pakistan

- Managed XDR Investigation of Ducktail in Trend Micro Vision One - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html

[Ficha técnica]

Apresentação: Daniel Venzi

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto

[Referências do Episódio]

- Iran-linked APT groups started exploiting Papercut flaw - https://securityaffairs.com/145952/apt/iranian-apt-papercut-exploitation.html

- AndoryuBot – New Botnet Campaign Targets Ruckus Wireless Admin Remote Code Execution Vulnerability (CVE-2023-25717) - https://www.fortinet.com/blog/threat-research/andoryubot-new-botnet-campaign-targets-ruckus-wireless-admin-remote-code-execution-vulnerability-cve-2023-25717 

- AhnLab EDR Tracks and Responds against Link File (*.lnk) Distributing RokRAT - https://asec.ahnlab.com/en/52172/ 

- Woman who scanned QR code with malware lost $20k to bubble tea survey scam while she was sleeping - https://www.straitstimes.com/singapore/woman-who-scanned-qr-code-with-malware-lost-20k-to-bubble-tea-survey-scam-while-she-was-sleeping 

[Ficha técnica]

Apresentação: Carlos Cabral

Roteiro: Carlos Cabral e Daniel Venzi

Edição de áudio: Paulo Arruzzo

Narração de encerramento: Bianca Garcia

Projeto gráfico: Julian Prieto