Daily digest for Security Boulevard, on July 30, 2022

Ambler Jackson posted: "Once upon a time, security professionals worked to secure the perimeter of the organization. The single perimeter that information technology (IT) teams spent the majority of their workday protecting with physical and technical controls has now disappeare" Security Boulevard The Past, Present, and Future of (Zero) Trust Ambler Jackson Jul 29 Once upon a time, security professionals worked to secure the perimeter of the organization. The single perimeter that information technology (IT) teams spent the majority of their workday protecting with physical and technical controls has now disappeared. Hybrid work models … The Past, Present, and Future of (Zero) Trust Read More » The post The Past, Present, and Future of (Zero) Trust appeared first on TechSpective. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/the-past-present-and-future-of-zero-trust/ Powered by Jetpack

Dancho Danchev posted: "Dear blog readers,I've decided to share with everyone a personal compilation portfolio of currently and historically active RATs (Remote Access Tools) and trojan horses for the purpose of improving everyone's situational awareness including to improve you" Security Boulevard Shots from the Wild West – Sample Compilation of RATs (Remote Access Tools) and Trojan Horses Screenshots – An OSINT Analysis – Part Two Dancho Danchev Jul 29 Dear blog readers,I've decided to share with everyone a personal compilation portfolio of currently and historically active RATs (Remote Access Tools) and trojan horses for the purpose of improving everyone's situational awareness including to improve your technical collection skills and capabilities.Sample screenshots:Stay tuned! Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1932845 Powered by Jetpack

Sarthak Misraa posted: "Introduction Raccoon is a malware family that has been sold as malware-as-a-service on underground forums since early 2019. In early July 2022, a new variant of this malware was released. The new variant, popularly known as Raccoon Stealer v2, is written" Security Boulevard Raccoon Stealer v2: The Latest Generation of the Raccoon Family Sarthak Misraa Jul 29 Introduction Raccoon is a malware family that has been sold as malware-as-a-service on underground forums since early 2019. In early July 2022, a new variant of this malware was released. The new variant, popularly known as Raccoon Stealer v2, is written in C unlike previous versions which were mainly written in C++. The Raccoon Malware is a robust stealer that allows stealing of data such as passwords, cookies, and autofill data from browsers. Raccoon stealers also support theft from all cryptocurrency wallets. In this blog, ThreatLabz will analyze Raccoon Stealer v2 in the exe format, and highlight key differences from its predecessors. The authors of the Raccoon Stealer malware have announced that other formats are available, including DLLs and embedded in other PE files. Detailed Analysis Raccoon v2 is an information stealing malware that was first seen on 2022-07-03. The malware is written in C and assembly. Though we noticed a few new features in the newer variant as mentioned below, the data stealing mechanism is still the same as is seen in its predecessor: Base64 + RC4 encryption scheme for all string literals Dynamic Loading Of WinAPI Functions Discarded the dependence on Telegram API We have noticed a significant change in the way list of command and control servers is obtained. The Raccoon Malware v1 was seen abusing the Telegram network to fetch the list of command and control servers, whereas the newer variant has abandoned the use of Telegram. Instead, they use a hardcoded IP address of a threat-actor-controlled server to fetch the list of command and control servers from where the next stage payload (mostly DLLs) is downloaded. File Information Malware Name: Raccoon Stealer v2 Language: C File Type: exe File Size: 56832 MD5: 0cfa58846e43dd67b6d9f29e97f6c53e SHA1: 19d9fbfd9b23d4bd435746a524443f1a962d42fa SHA256: 022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03 Debug Information The analyzed file has debug data intact. According to the Debug headers compilation date was Thursday, 26/05/2022 13:58:25 UTC as shown in Figure 1. Figure 1: Raccoon v2 Debug Headers We have also seen a change in how Raccoon Stealer v2 hides its intentions by using a mechanism where API names are dynamically resolved rather than being loaded statically. The stealer uses LoadLibraryW and GetProcAddress to resolve each of the necessary functions (shown in Figure 2). The names of the DLLs and WinAPI functions are stored in the binary as clear text. Figure 2: Raccoon v2 dynamic resolution List Of Loaded DLLs kernel32.dll Shlwapi.dll Ole32.dll WinInet.dll Advapi32.dll User32.dll Crypt32.dll Shell32.dll Raccoon v1 did not employ dynamic resolution for used functions, therefore packed samples were often observed in the wild to evade detection mechanisms. Conversely, Raccoon v2 is often delivered unpacked. Figure 3 shows the imported DLLs for raccoon v1. Figure 3: Raccoon Stealer v1 imports (unpacked) Once resolution of functions is done, the stealer will run its string decryption routine. The routine is simple. RC4 encrypted strings are stored in the sample with base64 encoding. The sample first decodes the base64 encoding and then decrypts the encrypted string with the key 'edinayarossiya'. This routine is followed for all the strings in function string_decryption(). The 'string_decryption' routine is shown in Figure 4. Figure 4: Raccoon v2 String Decryption Routine Previous versions of Raccoon Stealer did not encrypt string literals other than hard coded IP addresses. The Raccoon v2 variant overcomes this by encrypting all the plain text strings. Several of the plaintext strings of Raccoon v1 are shown in Figure 5. Figure 5: Plaintext Strings In Raccoon v1 After manual decryption of the Raccoon v1 sample strings, the following (Figure 6 and Figure 7) strings were obtained in plaintext format. Figure 6: Raccoon v2 Decrypted Strings Figure 7: Raccoon v2 Decrypted Strings The command and control IP addresses are saved in the malware and follow the same decryption routine but have a different key, 59c9737264c0b3209d9193b8ded6c127. The IP address contacted by the malware is 'hxxp://51(.)195(.)166(.)184/'. The decryption routine is shown in Figure 8. Figure 8: IP Address Decryption Raccoon v2 Decrypting Command and Control IP Address The encrypted command and control IP Address can be easily decrypted by using public tools such CyberChef as shown in Figure 9. Figure 9: Raccoon v2 IP Address (via cyberchef utils) This technique is common between both versions of the malware. Figure 10 shows the same routine employed in Raccoon v1. Figure 10: Raccoon v1 setting up overhead before IP Address decryption Once all the overhead of setting up the functions and decryption of the strings is done, the malware will perform some checks before contacting the command and control server to download malicious DLLs and exfiltrate information. Overhead Before Exfiltration Before executing the core of the malware, certain checks are made to understand the execution environment. This includes making sure the malware isn't already running on the machine. Further the malware also checks if it's running as NT Authority/System. The malware gets a handle on mutex and checks if it matches a particular value or not. If it matches, the malware continues execution. Value: 8724643052. This technique is used to make sure only one instance of malware is running at one time. Figure 11 depicts the Mutex check and creation for Raccoon v2, while Figure 12 depicts the similar procedure used in Raccoon v1. Figure 11: Raccoon v2 Mutex Check Figure 12: Raccoon v1 Mutex Check By retrieving the Process token and matching the text "S-1-5-18," as shown in Figure 13, the malware determines if it is or is not operating as the SYSTEM user. Figure 13: Raccoon v2 Enumerating Process Token If running as a SYSTEM user, the enumeration of all the running processes is done with the help of fun_CreateToolhelp32Snapshot. Otherwise, the malware moves forward without the enumeration. Figure 14 shows the 'enumerate_processes()' function being called while Figure 15 shows the malware iterating over the Processes. Figure 14: Raccoon v2 Enumerate Process Figure 15: Raccoon v2 Iterating Process Struct Fingerprinting Host Once the malware is aware of the environment in which it's running, it starts to fingerprint the host. This malware uses functions such as: RegQueryValueExW for fetching machine ID GetUserNameW Figure 16 depicts the malware retrieving the Machine ID from the registry key "SOFTWAREMicrosoftCryptography" via the RegQueryKeyExW and RegQueryValueExW functions. Figure 17 depicts malware using the GetUserNameW function to retrieve a username. Figure 16: Raccoon v2 Fetching MachineID Figure 17: Raccoon v2 Fetching Username Figure 18: Raccoon v2: Username Buffer After all this is done, the malware will enumerate information such as MACHINE ID and username and then send the data to the remote command and control server. For this purpose, the malware creates a char string and starts appending these values to it. It starts by adding machine id and username. Figure 19 shows the built payload in buffer. Figure 19: Raccoon v2: Fingerprinting Payload Next, it generates and appends configId which is the rc4 encryption key. machineId=<MachineGuid>|<UserName>&configId=<RC4 key> Communications with Command and Control Communication with command and control takes place over plain text http protocol. The previously decrypted IP address hxxp://51(.)195(.)166(.)184/ is used for command and control communication. The malware contacts the list of previously decrypted command and control IP addresses (stored in local_3c). Since this malware only contains one command and control IP Address, the post request is only made to one as seen in Figure 20. Figure 20: Raccoon v2: Command and Control communication Command and Control URL Figure 21: Raccoon v2 URL in buffer Request Headers Figure 22: Raccoon v2 Request Headers Once the request has been made, the malware checks if the content body length is zero or not. If no content is received from command and control or the content body length is zero, the malware exits. This check is made because the exfiltration mechanism of the malware requires command and control to respond with a list IP Addresses to exfiltrate data to. In Figure 23, this condition can be seen along with the 'ExitProcess()' function call. Figure 23: Raccoon v2 Verifying Response Content Discarded the dependence on Telegram bot The Raccoon v1 relied on the Telegram Bot API description page to fetch command and control IP addresses and establish connections. The recent malware variants (v2) from this family have started to hard-code IP addresses in the binary to achieve this task. Raccoon Malware v2 uses 5 hard coded IP addresses and iterates over them. Data Exfiltration The malware relies on response from command and control server to down the required DLLs and decides on the next course of action. As of the writing of this blog the command and control IP has died, thus analysis of traffic towards the host is not possible. ThreatLabz has previously observed that the command and control server provides information on where to download additional payloads from and which IP Address to use for further communications. Figure 24: Raccoon v2 pinging extracted IP Address Grepped DLLs Figure 25: Raccoon v2 DLLs that are downloaded The malware uses a WINAPI call to SHGetFolderPathW to get a path to C:\Users\<User>\AppData and appends "Local" to it and uses it as the path to store stolen information before sending it to the command and control. Figure 26: Raccoon v2 Storage Path In Buffer Indicators Of Compromise IP contacted by the analyzed sample of Raccoon v2. 55(.)195(.)166(.)184 List Of Other IPs that act as an C2 for other samples can be found here. Downloaded DLLs nss3.dll sqlite3.dll GdiPlus.dll Gdi32.dll Path Used By the Malware C:\Users\<USERNAME>\AppData\Local Other samples observed in the wild of Raccoon v2. 0123b26df3c79bac0a3fda79072e36c159cfd1824ae3fd4b7f9dea9bda9c7909 022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03 048c0113233ddc1250c269c74c9c9b8e9ad3e4dae3533ff0412d02b06bdf4059 0c722728ca1a996bbb83455332fa27018158cef21ad35dc057191a0353960256 2106b6f94cebb55b1d55eb4b91fa83aef051c8866c54bb75ea4fd304711c4dfc 263c18c86071d085c69f2096460c6b418ae414d3ea92c0c2e75ef7cb47bbe693 27e02b973771d43531c97eb5d3fb662f9247e85c4135fe4c030587a8dea72577 2911be45ad496dd1945f95c47b7f7738ad03849329fcec9c464dfaeb5081f67e 47f3c8bf3329c2ef862cf12567849555b17b930c8d7c0d571f4e112dae1453b1 516c81438ac269de2b632fb1c59f4e36c3d714e0929a969ec971430d2d63ac4e 5d66919291b68ab8563deedf8d5575fd91460d1adfbd12dba292262a764a5c99 62049575053b432e93b176da7afcbe49387111b3a3d927b06c5b251ea82e5975 7299026b22e61b0f9765eb63e42253f7e5d6ec4657008ea60aad220bbc7e2269 7322fbc16e20a7ef2a3188638014a053c6948d9e34ecd42cb9771bdcd0f82db0 960ce3cc26c8313b0fe41197e2aff5533f5f3efb1ba2970190779bc9a07bea63 99f510990f240215e24ef4dd1d22d485bf8c79f8ef3e963c4787a8eb6bf0b9ac 9ee50e94a731872a74f47780317850ae2b9fae9d6c53a957ed7187173feb4f42 bd8c1068561d366831e5712c2d58aecb21e2dbc2ae7c76102da6b00ea15e259e c6e669806594be6ab9b46434f196a61418484ba1eda3496789840bec0dff119a e309a7a942d390801e8fedc129c6e3c34e44aae3d1aced1d723bc531730b08f5 f7b1aaae018d5287444990606fc43a0f2deb4ac0c7b2712cc28331781d43ae27 Conclusion Raccoon Stealer sold as Malware-as-a-Service has become popular over the past few years, and several incidents of this malware have been observed. The Authors of this malware are constantly adding new features to this family of malware. This is the second major release of the malware after the first release in 2019. This shows that the malware is likely to evolve and remain a constant threat to organizations. Zscaler coverage We have ensured coverage for the payloads seen in these attacks via advanced threat signatures as well as our advanced cloud sandbox. Figure 27: Zscaler Sandbox Detection Zscaler's multilayered cloud security platform detects indicators at various levels, as shown below: Win32.PWS.Raccoon Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/raccoon-stealer-v2-the-latest-generation-of-the-raccoon-family/ Powered by Jetpack

Bruce Schneier posted: "Short article on the evolution of the vampire squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here. " Security Boulevard Friday Squid Blogging: Evolution of the Vampire Squid Bruce Schneier Jul 29 Short article on the evolution of the vampire squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1932836 Powered by Jetpack

BrianKrebs posted: "The 911 service as it existed until July 28, 2022. 911[.]re, a proxy service that since 2015 has sold access to hundreds of thousands of Microsoft Windows computers daily, announced this week that it is shutting down in the wake of a data breach that dest" Security Boulevard 911 Proxy Service Implodes After Disclosing Breach BrianKrebs Jul 29 911[.]re, a proxy service that since 2015 has sold access to hundreds of thousands of Microsoft Windows computers daily, announced this week that it is shutting down in the wake of a data breach that destroyed key components of its business operations. The abrupt closure comes ten days after KrebsOnSecurity published an in-depth look at 911 and its connections to shady pay-per-install affiliate programs that secretly bundled 911's proxy software with other titles, including "free" utilities and pirated software. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/ Powered by Jetpack

Marc Handelman posted: "Our thanks to The Aspen Institute for publishing their cogent conference videos on the organization's YouTube channel. Dan Porterfield is the President and CEO of The Aspen Institute. Anja Manuelis the Executive Director, Aspen Strategy Group and Aspen" Security Boulevard Aspen Security Forum 2022 – Dan Porterfield's And Anja Manuel's 'Opening Remarks' Marc Handelman Jul 29 Our thanks to The Aspen Institute for publishing their cogent conference videos on the organization's YouTube channel. Dan Porterfield is the President and CEO of The Aspen Institute. Anja Manuelis the Executive Director, Aspen Strategy Group and Aspen Security Forum. Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/aspen-security-forum-2022-dan-porterfields-and-anja-manuels-opening-remarks/ Powered by Jetpack

Kaseya posted: " Calm, cool and always connected! With their ability to make the impossible possible, our sysadmins could teach comic book superheroes a thing or two about saving the day. And just like an ever-reliable best friend, they actually listen to and fix ou" Security Boulevard Win Prizes Fit for a Superhero as Part of the Sysadmin Day Giveaway Kaseya Jul 29 Calm, cool and always connected! With their ability to make the impossible possible, our sysadmins could teach comic book superheroesRead More The post Win Prizes Fit for a Superhero as Part of the Sysadmin Day Giveaway appeared first on Kaseya. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/win-prizes-fit-for-a-superhero-as-part-of-the-sysadmin-day-giveaway/ Powered by Jetpack

Black Duck Solutions Team posted: "Black Duck's newest release delivers all-new, lightning-fast infrastructure-as-code (IaC) scanning capabilities.The news is just in, and it's big: Black Duck now offers IaC scanning functionality. With no additional licenses required, this capability is a" Security Boulevard Introducing IaC Security from Black Duck Black Duck Solutions Team Jul 29 Black Duck's newest release delivers all-new, lightning-fast infrastructure-as-code (IaC) scanning capabilities. The post Introducing IaC Security from Black Duck appeared first on Application Security Blog. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/introducing-iac-security-from-black-duck/ Powered by Jetpack

Tony Bailey posted: "Continued Consolidation in API Security and Bot Management – A Need for Unified API Protection As we have seen of late, in attempts to offer end-to-end application protection, web application firewall (WAF) vendors have been acquiring bot management compa" Security Boulevard Mergers and Acquisitions in API Security and Bot Management Tony Bailey Jul 29 Continued Consolidation in API Security and Bot Management – A Need for Unified API Protection As we have seen of late, in attempts to offer end-to-end application protection, web application firewall (WAF) vendors have been acquiring bot management companies. Examples of this activity include Imperva and Distil Networks, and F5 and Shape. However, the merging […] The post Mergers and Acquisitions in API Security and Bot Management appeared first on Cequence Security. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/mergers-and-acquisitions-in-api-security-and-bot-management/ Powered by Jetpack

Allison Krivda posted: "Learn about the Critical Infrastructure Information Act, including what it is and why changes to it are needed in the current landscape of cyber threats. The post Updates to the Critical Infrastructure Information Act are Long Overdue appeared first on Lo" Security Boulevard Updates to the Critical Infrastructure Information Act are Long Overdue Allison Krivda Jul 29 Learn about the Critical Infrastructure Information Act, including what it is and why changes to it are needed in the current landscape of cyber threats. The post Updates to the Critical Infrastructure Information Act are Long Overdue appeared first on LogRhythm. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1932802 Powered by Jetpack

Marc Handelman posted: " via the inimitable Daniel Stori, crafting superb comics" Security Boulevard Daniel Stori's 'bad malloc' Marc Handelman Jul 29 via the inimitable Daniel Stori, crafting superb comics at turnoff.us! Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/daniel-storis-bad-malloc/ Powered by Jetpack

Richi Jennings posted: "DSIRF 'is' PSOA: MSFT—DSIRF GmbH codenamed 'Knotweed' by Microsoft and RiskIQ. This unknown Austrian company is accused of selling the powerful, pernicious spyware Subzero.What can be done? In today's #SBBlogwatch, we count the ways. At @TechstrongGroup's" Security Boulevard Solved: Subzero Spyware Secret — Austrian Firm Fingered – Security Boulevard Richi Jennings Jul 29 DSIRF 'is' PSOA: MSFT—DSIRF GmbH codenamed 'Knotweed' by Microsoft and RiskIQ. This unknown Austrian company is accused of selling the powerful, pernicious spyware Subzero. What can be done? In today's #SBBlogwatch, we count the ways. At @TechstrongGroup's @SecurityBlvd: https://t.co/UO0oFKbT3d — @Richi Jennings (@RiCHi) July 29, 2022 Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1932832 Powered by Jetpack

Richi Jennings posted: "DSIRF GmbH codenamed 'Knotweed' by Microsoft and RiskIQ. This unknown Austrian company is accused of selling the powerful, pernicious spyware Subzero. By exploiting a range of Microsoft and Adobe zero-days, the malware spied on journalists, dissidents " Security Boulevard Solved: Subzero Spyware Secret — Austrian Firm Fingered Richi Jennings Jul 29 DSIRF GmbH codenamed 'Knotweed' by Microsoft and RiskIQ. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/solved-subzero-spyware-secret-austrian-firm-fingered/ Powered by Jetpack

Tally Shea posted: "Reading Time: 6 minutes If you missed AWS re:Inforce and you are looking for the highlights, or just simply want a refresher on the major themes, we're going to review what stood out. The re:Inforce conference was back in Boston with Amazon Chief Securit" Security Boulevard TLDR: The Highlights of AWS re:Inforce 2022 Tally Shea Jul 29 Reading Time: 6 minutes If you missed AWS re:Inforce and you are looking for the highlights, or just simply want a refresher on the major themes, we're going to review what stood out. The re:Inforce conference was back in Boston with Amazon Chief Security Officer, Stephen Schmidt, leading the charge alongside AWS Vice President and Chief Information Security Officer, […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/tldr-the-highlights-of-aws-reinforce-2022/ Powered by Jetpack

Larissa Schneider posted: "The Noname Security team is excited to announce our presence at Black Hat USA 2022. The conference takes place at the Mandalay Bay in Las Vegas, Nevada from August 6 to 11 and includes four days of training, followed by a two-day main conference. Attende" Security Boulevard Meet Noname Security at Black Hat USA 2022! Larissa Schneider Jul 29 The Noname Security team is excited to announce our presence at Black Hat USA 2022. The conference takes place at the Mandalay Bay in Las Vegas, Nevada from August 6 to 11 and includes four days of training, followed by a two-day main conference. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/meet-noname-security-at-black-hat-usa-2022/ Powered by Jetpack

Semperis Research Team posted: "Cyberattacks targeting Active Directory are on the upswing, putting pressure on AD, identity, and security teams to monitor the constantly shifting AD-focused threat landscape. To help IT pros better understand and guard against attacks involving AD, the " Security Boulevard Identity Attack Watch: July 2022 Semperis Research Team Jul 29 Cyberattacks targeting Active Directory are on the upswing, putting pressure on AD, identity, and security teams to monitor the constantly shifting AD-focused threat landscape. To help IT pros better understand and guard against attacks involving AD, the Semperis Research Team offers this monthly roundup of recent cyberattacks that used AD to introduce or propagate malware. ... The post Identity Attack Watch: July 2022 appeared first on Semperis. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/identity-attack-watch-july-2022/ Powered by Jetpack

Marc Handelman posted: "Our sincere thanks to Security BSides San Francisco for publishing their outstanding conference videos on the organization's YouTube channel. Permalink" Security Boulevard BSidesSF 2022 – Reed Loden's 'Closing Ceremony' Marc Handelman Jul 29 Our sincere thanks to Security BSides San Francisco for publishing their outstanding conference videos on the organization's YouTube channel. Permalink Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/bsidessf-2022-reed-lodens-closing-ceremony/ Powered by Jetpack

Dancho Danchev posted: "Dear blog readers,I wanted to take the time and effort and present my latest project with WhoisXML API my employer where I'm currently acting as a DNS Threat Researcher which is a Law Enforcement IoCs and threat intelligence feed including research and re" Security Boulevard Introducing WhoisXML API's WHOIS Conclave Law Enforcement IoCs and Research on Demand Threat Intelligence Feed! Dancho Danchev Jul 29 Dear blog readers,I wanted to take the time and effort and present my latest project with WhoisXML API my employer where I'm currently acting as a DNS Threat Researcher which is a Law Enforcement IoCs and threat intelligence feed including research and reports service on demand service which you can apply for here.Feel free to approach me at research@whoisxmlapi.com in case you're interested in Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1932800 Powered by Jetpack

Tess Sanchioni posted: " Earlier this month, I was lucky enough to attend a graduation at Roxbury Community College, featuring a keynote address by ThreatX CEO Gene Fay. This was not a typical graduation, but rather a celebration of 14 remarkable individuals whose achievements a" Security Boulevard Gene Fay Gives Keynote at 2022 Networking Technology Program Graduation Tess Sanchioni Jul 29 Earlier this month, I was lucky enough to attend a graduation at Roxbury Community College, featuring a keynote address by ThreatX CEO Gene Fay. This was not a typical graduation, but rather a celebration of 14 remarkable individuals whose achievements are truly inspiring. These students took part in a unique program called the Roxbury Community […] The post Gene Fay Gives Keynote at 2022 Networking Technology Program Graduation appeared first on ThreatX. Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/gene-fay-gives-keynote-at-2022-networking-technology-program-graduation/ Powered by Jetpack

Natan Solomon posted: "Public proof-of-concepts (POCs) may be helping cybercriminals more than the organizations they were designed to protect. Sophos' Active Adversary Playbook 2022 provides an in-depth analysis of cyberattacker behavior, tactics and tools from throughout 2021" Security Boulevard Are Proof-of-Concepts Benefiting Cybercriminals?    Natan Solomon Jul 29 Public proof-of-concepts (POCs) may be helping cybercriminals more than the organizations they were designed to protect. Sophos' Active Adversary Playbook 2022 provides an in-depth analysis of cyberattacker behavior, tactics and tools from throughout 2021. The report found a number of instances where public proofs-of-concept (POC) of web shell exploits coincided with major spikes in attacks.  […] Read more of this post Comment Unsubscribe to no longer receive posts from Security Boulevard. Change your email settings at manage subscriptions. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2022/07/are-proof-of-concepts-benefiting-cybercriminals/ Powered by Jetpack