Quote:Interpol announced it arrested 41 individuals and taken down 1,037 servers and infrastructure running on 22,000 IP addresses facilitating cybercrime in an international law enforcement action titled Operation Synergia II.https://www.bleepingcomputer.com/news/se...rrests-41/
The operation took place between April and August 2024, spanning 95 countries and resulting in 41 arrests of those linked to various crimes, including ransomware, phishing, and information stealers.
Interpol said its enforcement action was backed by intelligence provided by private cybersecurity firms like Group-IB, Kaspersky, Trend Micro, and Team Cymru, leading to the identification of over 30,000 suspicious IP addresses.
Eventually, roughly 76% of those were taken down, 59 servers were seized, and 43 electronic devices were confiscated, which will be examined to retrieve additional evidence.
In addition to the 41 individuals who were arrested, the authorities are also investigating another 65 persons suspected of associating with illicit activities.
Quote:Nokia is investigating whether a third-party vendor was breached after a hacker claimed to be selling the company's stolen source code.https://www.bleepingcomputer.com/news/se...urce-code/
"Nokia is aware of reports that an unauthorized actor has alleged to have gained access to certain third-party contractor data and possibly data of Nokia," the company told BleepingComputer.
"Nokia takes this allegation seriously and we are investigating. To date, our investigation has found no evidence that any of our systems or data being impacted. We continue to closely monitor the situation."
This statement comes after a threat actor known as IntelBroker claimed to be selling Nokia source code that was stolen after they breached a third-party vendor's server.
"Today, I am selling a large collection of Nokia source code, which we got from a 3rd party contractor that directly worked with Nokia to help aid their development of some internal tools."
Quote:Cisco has confirmed to BleepingComputer that it is investigating recent claims that it suffered a breach after a threat actor began selling allegedly stolen data on a hacking forum.https://www.bleepingcomputer.com/news/se...ing-forum/
"Cisco is aware of reports that an actor is alleging to have gained access to certain Cisco-related files," a Cisco spokesperson told BleepingComputer.
"We have launched an investigation to assess this claim, and our investigation is ongoing."
This statement comes after a well-known threat actor named "IntelBroker" said that he and two others called "EnergyWeaponUser and "zjj" breached Cisco on October 6, 2024, and stole a large amount of developer data from the company.
"Compromised data: Github projects, Gitlab Projects, SonarQube projects, Source code, hard coded credentials, Certificates, Customer SRCs, Cisco Confidential Documents, Jira tickets, API tokens, AWS Private buckets, Cisco Technology SRCs, Docker Builds, Azure Storage buckets, Private & Public keys, SSL Certificates, Cisco Premium Products & More!," reads the post to a hacking forum.
Cisco takes DevHub portal offline after hacker publishes stolen data
Quote:Cisco confirmed today that it took its public DevHub portal offline after a threat actor leaked "non-public" data, but it continues to state that there is no evidence that its systems were breached.https://www.bleepingcomputer.com/news/se...olen-data/
"We have determined that the data in question is on a public-facing DevHub environment—a Cisco resource center that enables us to support our community by making available software code, scripts, etc. for customers to use as needed," reads an updated statement from Cisco.
"At this stage in our investigation, we have determined that a small number of files that were not authorized for public download may have been published."
Cisco says there are no indications that personal information or financial data was stolen but is continuing to investigate what data may have been accessed.
This statement comes after a threat actor known as IntelBroker claimed to have breached Cisco and attempted to sell data and source code stolen from the company.
Quote:U ovoj epizodi razgovaramo o jednom od najvećih problema koje moderne tehnologije donose, a to je briga o sajber bezbednosti.
Naš gost je Nebojša Jokić, direktor Mreže za sajber bezbednost i stručnjak za informacionu bezbednost sa više od 30 godina iskustva. Veliki deo svoje karijere Nebojša je proveo u Ministarstvu unutrašnjih poslova, gde je bio aktivno angažovan na izgradnji informacionih bezbednosnih sistema Srbije. Kao prvi rukovodilac MUP CERT-a, prvog tima za upravljanje incidentima u javnom sektoru, doprineo je postavljanju temelja za informatičku bezbednost u zemlji.
direkt ka podcastu:
Telekomunikacije i bezbednost: kako se grade kapaciteti odbrane I deo | TeleSrbija podcast EP 26
Telekomunikacije i bezbednost: kako se grade kapaciteti odbrane II deo | TeleSrbija podcast EP 27
Sa sajta:
TeleSrbija podcast ep. 26: Telekomunikacije i bezbednost - kako se grade kapaciteti odbrane - I deo
TeleSrbija podcast ep. 27: Telekomunikacije i bezbednost - kako se grade kapaciteti odbrane - II deo
Zloupotrebljen je video nadzor na aerodromu Nikola Tesla, gde su slike sa ekrana koji prikazuje nadzorne kamere poslate nekome i završile su u tabloidu Informer kao napad i kršenje privatnosti lica sa snimka.
Arhiviran link članka iz Informera: https://archive.is/7wPmi
originalni link: informer .rs/politika/vesti/959408/nikola-ristic
sudeći po imenima fajlova, slike ekrana su poslate preko WhatsApp-a :
fišing mejl:
rbaupdate.online has address 84.32.84.32
sajt dosta lošeg izgleda je u pitanju:
Server je izgleda dedicated windows server što nije uopšte jeftino. Ima instaliran XAMPP for Windows 8.2.12
Izuzetno loše konfigurisan:
RDP je otvoren:
phpinfo je vidljiv:
u javascript fajlovima koij su takođe dostupni u jednom direktorijumu imamo kod koji je očigledno "domaći":
pre koji dan se pojavio fajl na sajtu Moodle online platforme Građevinskog Arhitektonskog Fakulteta (GAF) univerziteta u Nišu:
Uhvaćen je od strane urlhaus.abuse.ch i prijavljen abuse kontaktima, posle čega je maliciozni fajl uklonjen...
gf94.gaf.ni.ac.rs has address 160.99.31.94
fajl u pitanju: https://www.virustotal.com/gui/file/bdc0.../detection
Ransomware grupa Medusa je objavila da poseduje podatke od IUS-a i nudi ih na prodaju ili da se obrišu po ceni od $180000:
Kao dokaz ponudili su određene uzorke kao i kompletan spisak datoteka koje imaju u posedu:
Sajtovi svih ovih domena su trenutno nedostupni:
alumni.ius.edu.ba
isabeg.edu.ba
ius.edu.ba
kidius.ba
maarifkoledz.edu.ba
maarif.ba
maarif.edu.ba
maarifkoledz.ba
sedef.ba
sedefbosnia.ba
student.ius.edu.ba
Prema onome što je za sada dostupno, izgleda da su svukli podatke samo sa jednog računara, interne IP adrese 10.0.1.34 i prema imenima direktorijuma i datoteka verovatno korišćen od strane Enes Pivić. Moguće je da je ovaj računar bio i prvobitna tačka ulaska u mrežu, ali za to nema opipljivih dokaza.
Među podacima naizgled ima dosta ličnih dokumenata od ove osobe kao i od njegove porodice. Savet je uvek da se ne skladište lične stvari na kompanijski računar.
Pošto je sajt IUSa nedostupan, na guglu sam našao da je ova osoba direktor centra za informacione tehnologije:
Konstantni napadi na sajt 021.rs iz inostranstva, sajt ponovo dostupan za ceo svet
Quote:Portal 021.rs se od četvrtka popodne suočava sa snažnim DDoS napadom, zbog čega je sajt u pojedinim trenucima bio nedostupan publici. Sajt je na udaru hakera od početka septembra.
Podsetimo, kako smo objavili u četvrtak, sajt je pod jakim napadom sa različitih "sumnjivih" IP adrese koje su dolazile iz TOR mreže ili IP adresa iz data centara širom sveta.
Pojavljuju se ovi oglas ina Fejsbuku...
Imaju još jedan oglas :
Ako pogledate na TrustPilot-u videćete gomilu recenzija gde su ljudi popunjavali ankete ali nisu ništa dobili:
uglavnom, ko god nudi novac za nekakvo popunjavanje anketa je 99% prevara