ISC StormCast for Friday, May 6th, 2022
Password-protected Excel Spreadsheet Pushes Remcos RAT
https://isc.sans.edu/forums/diary/Passwordprotected+Excel+spreadsheet+pushes+Remcos+RAT/28616/
Microsoft, Apple, Google Accelated FIDO Standard Implementation
https://www.theregister.com/2022/05/05/microsoft-apple-google-fido/
Heroku Admits Breach
https://status.heroku.com/incidents/2413
ISC StormCast for Thursday, May 5th, 2022
Finding the Real “Last Patched” Day (Interim Version)
https://isc.sans.edu/forums/diary/Finding+the+Real+Last+Patched+Day+Interim+Version/28610/
Fake Windows Updates Install Ransomware
https://www.bleepingcomputer.com/news/security/fake-windows-10-updates-infect-you-with-magniber-ransomware/
Vulnerablities in Ransomware
https://www.malvuln.com
Heroku Forces Password Reset
https://status.heroku.com/incidents/2413
Cisco Patches Enterprise NFV Infrastructure Software
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9
Big-IP iControl REST Vulnerability
https://support.f5.com/csp/article/K23605346
Coding robot teaches K-12 students about cybersecurity
K-12 students need to learn about cybersecurity along with their exposure to digital technology. The Sphero BOLT, a coding robot, can help teach students about cyber risk management, ethical hacking and more.
ISC StormCast for Wednesday, May 4th, 2022
Some Honeypot Updates
https://isc.sans.edu/forums/diary/Some+Honeypot+Updates/28608/
TLStorm 2 – NanoSSL TLS Library Misuse
https://www.armis.com/blog/tlstorm-2-nanossl-tls-library-misuse-leads-to-vulnerabilities-in-common-switches/
Unpatched DNS Bug in uClibc and uClibc-ng Library
https://www.nozominetworks.com/blog/nozomi-networks-discovers-unpatched-DNS-bug-in-popular-c-standard-library-putting-iot-at-risk/
Abusing Security Software to Sideload PlugX and ShadowPad
https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/
Microsoft Edge Update Triggers Trend Micro AV
https://success.trendmicro.com/forum/s/question/0D54T00001QDqzgSAD/we-are-getting-this-message-from-every-client-since-several-minutesis-it-a-false-positiv-error-or-do-we-have-a-real-trojaner-problem-
FEMA conducts earthquake preparedness tabletop exercise
The Federal Emergency Management Agency (FEMA) is conducting a tabletop exercise on the risks posed by and response to a potential Cascadia Subduction Zone (CSZ) earthquake-tsunami event.
A 3-step approach to cyber defense: Before, during and after a ransomware attack
Formulating a before, during and after approach is key to organizational sanity and survival in a world increasingly dominated by ransomware attacks.
Jason Fickett to lead national cyber strategy at Booz Allen
Jason Fickett is now a leader of Booz Allen’s national cyber strategy, where he will focus on protecting U.S. critical infrastructure federal assets from cyber threats.
ISC StormCast for Tuesday, May 3rd, 2022
Detecting VSTO Office Files with ExifTool
https://isc.sans.edu/forums/diary/Detecting+VSTO+Office+Files+With+ExifTool/28604/
The Gmail SMTP Relay Service Exploit
https://www.avanan.com/blog/the-gmail-smtp-relay-service-exploit
OpenSSF Package Analysis
https://openssf.org/blog/2022/04/28/introducing-package-analysis-scanning-open-source-packages-for-malicious-behavior/
M1 Prefetcher Data Leak
https://www.prefetchers.info
Virginia launches crisis management project for school safety
The Virginia Department of Criminal Justice Services (DCJS), the Department of Education and Virginia State Police will collaborate to develop a crisis management program focusing on school safety.
