Urbanists.Social

11 posts10 participants2 posts today

MISPJust a reminder: our free MISP online training is happening tomorrow, Wednesday.<a href="https://misp-project.org/events/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://misp-project.org/events/</a><a href="https://misp-community.org/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://misp-community.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://misp-community.org/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://misp-community.org/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintelligence</a> <a href="https://misp-community.org/tags/misp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#misp</a>

Mr Tech KingPalo Alto Networks confirms brute-force login attacks on GlobalProtect portals, linked to recent scanning surges. Stay safe: Update PAN-OS, enforce MFA, and block attack patterns.<a href="https://mastodon.social/tags/PaloAltoNetworks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PaloAltoNetworks</a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mastodon.social/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a>

Kevin BeaumontSeveral months after this thread, Conduent have finally filed at 8-K for a cyber incident. They don’t say it, but it was ransomware. Ransomware group was Safepay. This is their second big ransomware incident. The Fediverse had the thread first. <a href="https://www.sec.gov/ix?doc=/Archives/edgar/data/1677703/000167770325000067/cndt-20250409.htm" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.sec.gov/ix?doc=/Archives/edgar/data/1677703/000167770325000067/cndt-20250409.htm</a><a href="https://cyberplace.social/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://cyberplace.social/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ransomware</a>

Kevin BeaumontHealthcare provider DaVita Inc have filed an 8-K with the SEC for an ongoing ransomware incident. <a href="https://www.sec.gov/Archives/edgar/data/927066/000119312525079593/d948299d8k.htm" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.sec.gov/Archives/edgar/data/927066/000119312525079593/d948299d8k.htm</a><a href="https://cyberplace.social/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://cyberplace.social/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ransomware</a>

A bot witha.nameNew configuration detected for DDosia. Hosts: * www.taaleri.com * beta-my.fondia.com * www.fingrid.fi * mediabank.neova-group.com * extra.eezy.fi * login-euva-saasfaprod1.fa.ocs.oraclecloud.com * enersense.com * smile2.likeit.fi * gasgrid.fi * www.panostaja.fi * eezy.fi * tyopaikat.eezy.fi * codento.com * www.if.fi * www.kaukokiito.fi * www.op.fi <a href="https://social.circl.lu/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> <a href="https://social.circl.lu/tags/Ddosia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ddosia</a> <a href="https://social.circl.lu/tags/NoName" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NoName</a> * <a href="https://witha.name/data/2025-04-12_08-25-06_DDoSia-target-list-full.json" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://witha.name/data/2025-04-12_08-25-06_DDoSia-target-list-full.json</a> *

Ian CampbellGood MORNING, folks!I am caffeinated, and I also have brand new shiny things for you.<a href="https://infosec.exchange/@DomainTools" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@DomainTools</a> Investigations published a report this morning detailing a campaign of newly-registered domains impersonating the Google Play store and leading to deployment of the SpyNote Android RAT. No attribution available, but significant Chinese-language connections.<a href="https://masto.deoan.org/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://masto.deoan.org/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://masto.deoan.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://dti.domaintools.com/newly-registered-domains-distributing-spynote-malware/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://dti.domaintools.com/newly-registered-domains-distributing-spynote-malware/</a>

A bot witha.nameNew configuration detected for DDosia. Hosts: * www.vaasa.fi * www.porvoo.fi * ek.fi * www.if.fi * www.lahitaksi.fi * www.kuluttajariita.fi * www.vaestoliitto.fi * supo.fi * www.airpro.fi * www.lahitapiola.fi * www.hel.fi * www.korrek.fi * www.ely-keskus.fi * www.hsl.fi <a href="https://social.circl.lu/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> <a href="https://social.circl.lu/tags/Ddosia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ddosia</a> <a href="https://social.circl.lu/tags/NoName" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NoName</a> * <a href="https://witha.name/data/2025-04-10_11-50-02_DDoSia-target-list-full.json" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://witha.name/data/2025-04-10_11-50-02_DDoSia-target-list-full.json</a> * <a href="https://witha.name/data/2025-04-10_11-50-02_DDoSia-target-list.csv" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://witha.name/data/2025-04-10_11-50-02_DDoSia-target-list.csv</a>

Kevin BeaumontSensata Technologies Holding plc filed an 8-K with the SEC for a ransomware attack which is remarkably honest, and pretty much the textbook example of how to do it well. <a href="https://www.sec.gov/ix?doc=/Archives/edgar/data/1477294/000147729425000047/st-20250406.htm" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.sec.gov/ix?doc=/Archives/edgar/data/1477294/000147729425000047/st-20250406.htm</a><a href="https://cyberplace.social/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://cyberplace.social/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ransomware</a>

Alexandre DulaunoyFirst cool and impressive outcome of hackathon.lu 2025, MISP fleet commander. An open source project which supports organisation to manage large fleet of MISP instances, tests synchronisation and many other features.🔗 <a href="https://github.com/MISP/MISP-Fleet-Commander" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/MISP/MISP-Fleet-Commander</a><a href="https://misp-community.org/@misp" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@misp</a><a href="https://social.circl.lu/@circl" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@circl</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://infosec.exchange/tags/misp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#misp</a>

Quad9DNSWe recently sat down with our Director of <a href="https://mastodon.social/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> to talk about her role at Quad9 and what she enjoys about her work.<a href="https://www.quad9.net/news/blog/staff-highlight-emilia-cebrat-maslowski" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.quad9.net/news/blog/staff-highlight-emilia-cebrat-maslowski</a><a href="https://mastodon.social/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://mastodon.social/tags/privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#privacy</a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a>

Taggart :donor:Oh is it time for another Fortinet crit again? Unauthenticated admin password change in FortiSwitch.CVE-2024-48887, CVSSv3 9.3<a href="https://fortiguard.fortinet.com/psirt/FG-IR-24-435" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://fortiguard.fortinet.com/psirt/FG-IR-24-435</a><a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a>

Infoblox Threat IntelOnline gambling operators are sponsoring charities?? If only :(We've identified a malicious gambling affiliate whose specialty is to buy expired domain names which used to belong to charities or reputable organisations. Once they own a domain, they host a website impersonating its previous owner, where they claim to "deeply appreciate the support from [their] sponsors", which surprise surprise, all turn out to be dubious online gambling companies.Because the domain they are taking over is often abandoned or managed by non-technical people, its previous owner often doesn't notify anyone that they've lost control of their website, so it continues being referenced in genuine content, and it continues getting traffic from old links scattered throughout the internet.teampiersma[.]org (screenshots below) americankayak[.]org getelevateapp[.]com hotshotsarena[.]com nehilp[.]org questionner-le-numerique[.]org sip-events[.]co[.]uk studentlendinganalytics[.]com thegallatincountynews[.]comComparison content: 2018: <a href="https://web.archive.org/web/20180119043432/https://teampiersma.org/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://web.archive.org/web/20180119043432/https://teampiersma.org/</a> 2025: <a href="https://web.archive.org/web/20250401092253/https://teampiersma.org/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://web.archive.org/web/20250401092253/https://teampiersma.org/</a><a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#scam</a> <a href="https://infosec.exchange/tags/dropcatch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dropcatch</a> <a href="https://infosec.exchange/tags/charity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#charity</a>

GreyNoiseSpike in Exploitation Attempts Targeting TVT NVMS9000 DVRs — reportedly used in security and surveillance systems. Full analysis: <a href="https://www.greynoise.io/blog/surge-exploitation-attempts-tvt-dvrs" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.greynoise.io/blog/surge-exploitation-attempts-tvt-dvrs</a> <a href="https://infosec.exchange/tags/GreyNoise" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GreyNoise</a> <a href="https://infosec.exchange/tags/Exploitation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Exploitation</a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a>

Infoblox Threat IntelIs the sky fluxxing?! Last week a CISA advisory on DNS Fast Flux created a lot of buzz. We have an insider's take. Fast Flux is a nearly 20 year old technique and is essentially the malicious use of dynamic DNS. It is critical that protective DNS services understand this -- and all other DNS techniques -- on that we agree. What we also know as experts in DNS is that there are many ways to skin a cat, as they say. <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/cisa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cisa</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://blogs.infoblox.com/threat-intelligence/disrupting-fast-flux-and-much-more-with-protective-dns/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blogs.infoblox.com/threat-intelligence/disrupting-fast-flux-and-much-more-with-protective-dns/</a>

A bot witha.nameNew configuration detected for DDosia. Hosts: * www.handelsbanken.fi * www.kaukokiito.fi * id.handelsbanken.fi * www4.handelsbanken.fi <a href="https://social.circl.lu/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> <a href="https://social.circl.lu/tags/Ddosia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ddosia</a> <a href="https://social.circl.lu/tags/NoName" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NoName</a> * <a href="https://witha.name/data/2025-04-07_10-00-03_DDoSia-target-list-full.json" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://witha.name/data/2025-04-07_10-00-03_DDoSia-target-list-full.json</a> * <a href="https://witha.name/data/2025-04-07_10-00-03_DDoSia-target-list.csv" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://witha.name/data/2025-04-07_10-00-03_DDoSia-target-list.csv</a>

Xavier «X» Santolaria :verified_paw: :donor:Missed that over the week-end...<blockquote>It was not immediately clear why Haugh was fired. However, his dismissal comes amid a purge of other national security officials at the National Security Council and NSA. It happened following a visit to the Oval Office of political activist Laura Loomer, who has urged President Donald Trump to fire certain officials due to their perceived disloyalty to him and his agenda.</blockquote>I suppose you could equally say they got fired because they were saying and doing the right thing for the country and the world. Which, in this case, is indeed being disloyal to Trump.<a href="https://defensescoop.com/2025/04/04/trump-fires-gen-timothy-haugh-cyber-command-nsa/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://defensescoop.com/2025/04/04/trump-fires-gen-timothy-haugh-cyber-command-nsa/</a><a href="https://infosec.exchange/tags/uspol" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#uspol</a> <a href="https://infosec.exchange/tags/us" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#us</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

Kevin BeaumontLFTD Partners Inc. filed an 8K with the SEC for a cyber incident. They purchased $350k in cryptocurrency.. and immediately had it stolen. “On April 1, 2025, the Company converted $350,000 of its cash into USD Coin (USDC), a digital stablecoin pegged to the U.S. dollar. Shortly thereafter, the digital wallet containing the USDC was compromised by an unauthorized and unknown third party, resulting in the theft of the full amount.”<a href="https://www.sec.gov/ix?doc=/Archives/edgar/data/1391135/000109690625000425/lsfp-20250401.htm" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.sec.gov/ix?doc=/Archives/edgar/data/1391135/000109690625000425/lsfp-20250401.htm</a><a href="https://cyberplace.social/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a>

Kevin BeaumontThe Oracle cloud threat actor has told the BBC they plan to release European region Oracle Cloud Classic data this weekend. <a href="https://cyberplace.social/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a>

greyFriendly reminder that you should be blocking all newly registered domains for your end users. Free lists like the NRD (<a href="https://github.com/xRuffKez/NRD" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/xRuffKez/NRD</a>) exist. Microsoft Defender for Endpoint also has a built in list you can enable via policy.IMO everyone should do 365 days but even 30 or 90 will save you so much headache. <a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> <a href="https://infosec.exchange/tags/FastFlux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FastFlux</a>

Ian CampbellI'm a sucker for behavior-based investigations, especially for stuff off the beaten path, so I love the insights we were able to come up with on this one. <a href="https://infosec.exchange/@DomainTools" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@DomainTools</a> Investigations researchers found exposed criminal infrastructure and went down a rabbit hole. <a href="https://masto.deoan.org/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://masto.deoan.org/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://masto.deoan.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://dti.domaintools.com/proton66-where-to-find-aspiring-hackers/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://dti.domaintools.com/proton66-where-to-find-aspiring-hackers/</a>

Recent searches

Search options

Administered by:

Server stats:

#threatintel