Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)KI
Posts
2,247
Comments
71
Joined
1 yr. ago

Cybersecurity @sh.itjust.works

5 Takeaways: Senate Banking Committee Hearing on Digital Assets

Cybersecurity @sh.itjust.works

CVE-2025-6514 Threatens LLM clients

Cybersecurity @sh.itjust.works

Export to PDF allows local file inclusion/path traversal in Microsoft 365 - hn security

Cybersecurity @sh.itjust.works

GitHub Abused to Spread Malware Disguised as Free VPN - CYFIRMA

Cybersecurity @sh.itjust.works

Server with Rockerbox Tax Firm Data Exposed 286GB of Records

Cybersecurity @sh.itjust.works

Pay2Key’s Resurgence: Iranian Cyber Warfare Targets the West

Cybersecurity @sh.itjust.works

North American APT Uses Exchange Zero-Day to Attack China

Cybersecurity @sh.itjust.works

SatanLock Next in Line for Ransomware Group Shutdowns

Cybersecurity @sh.itjust.works

Ransomware Attack Stops Nova Scotia Power Meter Readings - Infosecurity Magazine

Cybersecurity @sh.itjust.works

A Vulnerability in FortiWeb Could Allow for SQL Injection

Cybersecurity @sh.itjust.works

Malicious Open Source Packages Surge 188% Annually - Infosecurity Magazine

Cybersecurity @sh.itjust.works

Android malware Anatsa infiltrates Google Play to target US banks

Cybersecurity @sh.itjust.works

Over 500 Scattered Spider Phishing Domains Poised to Target Multiple I - Infosecurity Magazine

Cybersecurity @sh.itjust.works

Employee gets $920 for credentials used in $140 million bank heist

Cybersecurity @sh.itjust.works

4 Critical Steps in Advance of 47-Day SSL/TLS Certificates

Cybersecurity @sh.itjust.works

Ransomware negotiator investigated over criminal gang kickbacks | Malwarebytes

Cybersecurity @sh.itjust.works

VenusTech and Salt Typhoon Breach Sheds Light on China's Covert Cyber Mercenary Networks

Cybersecurity @sh.itjust.works

DPRK macOS 'NimDoor' Malware Targets Web3, Crypto Platforms

Cybersecurity @sh.itjust.works

Malware Attacks on Android Devices Surge in Q2, Driven by Banking Trojans and Spyware

Cybersecurity @sh.itjust.works

Surmodics & Kentfield Hospital Fall Victim to Cyberattacks

  • From the article:

    Microsoft locked down a server last month that exposed Microsoft employee passwords, keys and credentials to the open Internet, as the company faces growing pressure to strengthen the security of its software. Microsoft was notified of the vulnerability on February 6th and the block on March 5th. It is unclear whether anyone accessed the exposed server during this period.

  • In this particular case, the method of infection of the router was not disclosed. However, typically, the most common methods involve an open administration port to the internet (user interface or TR-069) or through the internal interface, in case a network host has been compromised.

    They often perform brute-force password attacks, and once access is obtained, they look for typical Linux administrative tools (such as bash, etc.) and proceed to compromise the router.

    So I understand that a router with custom firmware can be compromised if it has a weak password and resources to maintain the infection, or of course, a vulnerability that is exploitable.

  • Not following... Since this is a cybersecurity com, I assume that many of us work in this area, literally defending people and organizations from attackers and scammers. That's why I said some of us make a living out of this in a sad way.

  • IoCs from original research:

    Hashes

    267071df79927abd1e57f57106924dd8a68e1c4ed74e7b69403cdcdf6e6a453b 54/70

    d6ac21a409f35a80ba9ccfe58ae1ae32883e44ecc724e4ae8289e7465ab2cf40 54/71

    ad4d196b3d85d982343f32d52bffc6ebfeec7bf30553fa441fd7c3ae495075fc

    13c017cb706ef869c061078048e550dba1613c0f2e8f2e409d97a1c0d9949346

    b376a3a6bae73840e70b2fa3df99d881def9250b42b6b8b0458d0445ddfbc044

    Domains

    hanagram[.]jpthefinetreats[.]com

    caduff-sa[.]chjeepcarlease[.]com

    buy-new-car[.]com

    carleasingguru[.]com

    IP Addresses

    91[.]193[.]18[.]120

  • IoCs:

    IOCs Hashes (SHA-256) Email – 16e6dfd67d5049ffedb8c55bee6ad80fc0283757bc60d4f12c56675b1da5bf61

    Docx – 1abf56bc5fbf84805ed0fbf28e7f986c7bb2833972793252f3e358b13b638bb1

    Injected ZIP – 95898c9abce738ca53e44290f4d4aa4e8486398de3163e3482f510633d50ee6c

    LNK file – d07323226c7be1a38ffd8716bc7d77bdb226b81fd6ccd493c55b2711014c0188

    Final ZIP – 94499196a62341b4f1cd10f3e1ba6003d0c4db66c1eb0d1b7e66b7eb4f2b67b6 26/64

    Client32.exe – 89f0c8f170fe9ea28b1056517160e92e2d7d4e8aa81f4ed696932230413a6ce1 26/73

    URLs and Hostnames yourownmart[.]com/solar[.]txt

    firstieragency[.]com/depbrndksokkkdkxoqnazneifidmyyjdpji[.]txt

    yourownmart[.]com

    firstieragency[.]com

    parabmasale[.]com

    tapouttv28[.]com

    IP Addresses 192[.]236[.]192[.]48

    173[.]252[.]167[.]50

    199[.]188[.]205[.]15

    46[.]105[.]141[.]54

    Others Message ID contains: “sendinblue[.]com”

    Return Path contains: “sender-sib[.]com”

    Source

  • From the text:

    Now, attackers breach a user's mobile account with stolen, brute-forced, or leaked credentials and initiate porting the victim's number to another device on their own. They can do this by generating a QR code through the hijacked mobile account that can be used to activate a new eSIM. They then scan it with their device, essentially hijacking the number.

    No need for social engineering.