Cybersecurity Digest for 26 July 2024

Today we discuss the following items: Notable News Crowdstrike Post Incident Report: Falcon Content Update Remediation and Guidance Hub | CrowdStrike Crowdstrike Phishing Campaigns: Malicious Inauthentic Falcon Crash Reporter Installer Distributed to German Entity (crowdstrike.com) Malware Distributed Using Falcon Sensor Update Phishing Lure | CrowdStrike Threat Actor Distributes Python-Based Info Stealer Using Fake Update (crowdstrike.com) Apparent CrowdStrike Threat Actor List Leak: Hacktivist Entity USDoD Claims to Have Leaked CrowdStrike’s Threat Actor List Meta Ousts 63,000 accounts linked to Sextortion : Combating Financial Sextortion Scams From Nigeria | Meta (fb.com) Darknet Diaries Episode related to the Sextortion Scams: The Pig Butcher – Darknet Diaries Rapid7 Malware Campaign using Fake W2: Malware Campaign Lures Users With Fake W2 Form | Rapid7 Blog GitHub Deleted and Private Repo Access: Anyone can Access Deleted and Private Repository Data on GitHub ◆ Truffle Security Co. GitHub Accounts Distributing Malware: Over 3,000 GitHub accounts used by malware distribution service (bleepingcomputer.com) Windows SmartScreen Flaw: Windows SmartScreen Flaw Enabling Data Theft in Major Stealer Attack (hackread.com)

Apt45 Shifts from Espionage to Ransomware: APT45: North Korea’s Digital Military Machine | Google Cloud Blog Related CISA Advisory: North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs | CISA

Prevalent Patches Google Chrome Fixes Vulnerabilities: Chrome Releases: Stable Channel Update for Desktop (googleblog.com) Docker Fixes Authentication Bypass: Docker Security Advisory: AuthZ Plugin Bypass Regression in Docker Engine | Docker Siemens Fixes Closes Backdoors: SSA-071402 (siemens.com) Progress Telerik Vulnerability: Insecure Deserialization Vulnerability - Telerik Report Server

CISA Alert: BIND 9: ISC Releases Security Advisories for BIND 9 | CISA Related news: BIND DNS Server Vulnerability Lets Attackers Flood Server (cybersecuritynews.com)