C410 A2BE CB73 EF77 746E 9682 E2C4 91CE D20D 800F

Infosec bits for week 11/22

2022-03-18 12:08 - Renier van Heerden

Hacks
- Trickbot is using MikroTik routers to ply its trade. Now we know why [Dan Goodin, Arstechnica]
- Increase In Malware Sightings on GoDaddy Managed Hosting [Mark Maunder, Workfense]
- Nasty Linux netfilter firewall security hole found [Steven Vaughan-Nichols, ZDNet]
- New Unix rootkit used to steal ATM banking data [Bill Toulas, BleepingComputer]
Mobile
- Scammers have 2 clever new ways to install malicious apps on iOS devices [Dan Goodin, Arstechnica]
- Best Bluetooth tracker 2022 AirTag and other alternatives [June Wan, ZDNet]
- Europe warns of aircraft GPS outages tied to Russian invasion [Sergiu Gatlan, BleepingComputer]
Ransomware
- Feds extradite ransomware suspects from 2 prolific gangs in a single week [Dan Goodin, Arstechnica]
- All in a day’s work Google details Exotic Lily access broker for ransomware gangs [Chris Duckett, ZDNet]
- These four types of ransomware make up nearly three-quarters of reported incidents [Danny Palmer, ZDNet]
- Microsoft Defender tags Office updates as ransomware activity [Sergiu Gatlan, BleepingComputer]
DDoS and Other
- New method that amplifies DDoSes by 4 billion-fold What could go wrong [Dan Goodin, Arstechnica]
- In-the-wild DDoS attack can be launched from a single packet to create terabytes of traffic [Chris Duckett, ZDNet]
- Russia creates its own TLS certificate authority to bypass sanctions [Bill Toulas, BleepingComputer]

Contact Us:	csirt { a } sanren.ac.za

PGP Keys:
CSIRT		0xE2C491CED20D800F
Renier		0x11A7B70A4B81468E
Kgwadi		0x9FF01A35A5726937
Sicelo		0xA6CCD44FD770057B