Notices by Catalin Cimpanu (campuscodi@mastodon.social), page 4

Anyone know where I can find more details on this audit?

Source: https://twitter.com/infernosec/status/1776706528013406435

"I discovered a pre-auth path traversal vulnerability in the Jasmin Ransomware web panel (CVE-2024-30851), allowing an attacker to deanonymize panel operators and dump decryption keys"

https://github.com/chebuya/CVE-2024-30851-jasmin-ransomware-path-traversal-poc

HP has ceased all operations and has exited the Russian market.

The company stopped all shipments to Russia in February 2022 after its invasion of Ukraine.

It began winding down operations in May of the same year and had planned for a final exit in May 2024.

HP pulled out of Russia last week, two months ahead of its planned departure.

The move has surprised Russian companies, which cannot update drivers or contact support.

https://t.me/breakingmash/52972

Czech intelligence services have disrupted a Russian propaganda network operating in Prague.

The network operated a news website named the Voice of Europe.

Officials say the website was registered to a local company but was financed from Russia. It published opinions from EU politicians who were demanding that the EU stop financing Ukraine.

According to local news outlet Denik N, some of the politicians were paid using funds from Russia.

https://denikn.cz/1388000/odhaleni-bis-jak-se-rusove-snazili-z-ceska-ovlivnit-volby-po-cele-evrope/?ref=tit1

US charges KuCoin and its founders with money laundering "large sums of criminal proceeds, including proceeds from darknet markets and malware, ransomware, and fraud schemes."

https://www.justice.gov/usao-sdny/pr/prominent-global-cryptocurrency-exchange-kucoin-and-two-its-founders-criminally

Security firm ReversingLabs has discovered a malicious .NET library on the official NuGet repository.

The package contains code to take screenshots of the infected system every minute and upload the data to a remote server.

ReversingLabs says the library appears to target developers who work with industrial software from Chinese company Bozhon.

https://www.reversinglabs.com/blog/suspicious-nuget-package-grabs-data-from-industrial-systems

The UK's NCSC has published guidance to help CEOs in public and private sector organizations respond and manage a cybersecurity incident.

https://www.ncsc.gov.uk/guidance/ceos-responding-cyber-incidents

Atlas VPN, the company that flooded my inbox with bogus security research for years, is shutting down in a month

https://atlasvpn.com/blog/announcement

...and now you know why all the Russian internet troll farms defend cryptocurrencies like it was their own child

"Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned thirteen entities and two individuals for operating in the financial services and technology sectors of the Russian Federation economy including persons developing or offering services in virtual assets that enable the evasion of U.S. sanctions."

https://home.treasury.gov/news/press-releases/jy2204

SonicWall's security team has published details on CVE-2024-2054, a still-unpatched unauth PHP deserialization vulnerability in the admin web interface of Artica Proxy appliances.

The vendor reports having over 100k servers installed around the world. 👀 👀 👀 👀 👀 👀 👀

https://blog.sonicwall.com/en-us/2024/03/unpatched-php-deserialization-vulnerability-in-artica-proxy/

Fortinet SQLi exploited in the wild:

https://mastodon.social/@simontsui@infosec.exchange/112134375836144314

This comes a day after the PoC was published on GitHub: https://github.com/horizon3ai/CVE-2023-48788

US sanctions Russian disinfo crew active in Latin America

https://home.treasury.gov/news/press-rleases/jy2195

Previously covered in a State Dept advisory here:

https://www.state.gov/the-kremlins-efforts-to-covertly-spread-disinformation-in-latin-america/

@GossiTheDog too late... I've kinda retired from mindlessly posting online 2h/day

Now that Simon has retired from Mastodon, I have to go back to actually working for a living :hurb: :sadness: 😭

https://mastodon.social/@simontsui@infosec.exchange/112085234926491096

The Swiss cyber-security agency has confirmed that classified information was stolen in a ransomware attack last year.

https://www.admin.ch/gov/en/start/documentation/media-releases.msg-id-100315.html

In a paper published this month, British academics say that the involvement of cybercrime crews in the Russian and Ukrainian hacktivism scene was "short-lived and fleeting."

https://arxiv.org/abs/2208.10629

The Record is now on Mastodon: https://mastodon.social/@therecord_media

JetBrains tried to bury a security patch before Rapid7 called them out on it

https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/

@GossiTheDog s***... gonna tell my Danish friends that websites they never access are gonna be down

Security researcher HaxRob has discovered a new Linux backdoor that is currently used to spy on telco networks.

The malware is named GTPDOOR after its use of the GPRS Tunnelling Protocol (GTP) to disguise command-and-control communications.

HaxRob believes the malware may be linked to LightBasin, a cyber-espionage group with a long history of telco espionage.

https://doubleagent.net/telecommunications/backdoor/gtp/2024/02/27/GTPDOOR-COVERT-TELCO-BACKDOOR