Ovo se navodno desilo 2025. godine ali ne mogu reći sa sigurnošću kada.
Na jednom forumu maliciozni akter se hvalio da je navodno kompromitovao sve sajtova Ambasada Srbije ove godine :
kao dokaz priložio je snimak ekrana ambasade u Parizu :
Ovo je stari sajt ambasade koji sam preko archive.org našao da je radio do 15.05.2025. Trenutno je na tom sajtu novi dizajn koji unificira sve sajtove ambasada pod jednim okvirom, na novi dizajn se prema archive.org arhivi koju sam pretražio prešlo 16.05.2025 za sajt ambasade u Parizu a i izgleda da su danas svi sajtovi ambasada pod istim dizajnom.
nisam našao druge dokaze da su se zaista desile kompromitacije sajtova ambasada te ostaje neprovereno.
izvor https://x.com/WhichbufferArda/status/200...2669232416
Pokušaj krađe kredencijala preko ciljanih fišing mejlova ka državnim ministarstvima, link uz mejl otvara lažna dokumenta koja traže kredencijale da bi se otvorili, ima dokaza da su između ostalih ciljane Bosna i Makedonija...
izgled lažnih stranica :
kredencijale se šalju na formcarry[.]com, legitimna usluga koja se zloupotrebljava za ovu svrhu.
Aktuelna je još jedna Bex phishing kampanja, a lažni sajt koji se koristi u prevari pokazuje ranjivost tipa Stored XSS.
Na samoj stranici vidljiv je i postojeći chat log, iz kog je jasno da je jedna od žrtava već unela verifikacioni kod, što ukazuje da je prevara bila uspešna.
Za proces uplate koriste platformu MoonPay.
Unos osnovnog XSS payloada u chat rezultira njegovim automatskim izvršavanjem pri svakom otvaranju stranice, a payload se trajno čuva, što potvrđuje postojanje ranjivosti.
Trenutno nemam vremena za detaljniju tehničku analizu, pa bi bilo korisno da neko iz grupe ukoliko je u mogućnosti da preuzme dalju analizu svega.
Linkovi:
- Instagram objava i slike: https://www.instagram.com/p/DStC9z5iD5m/?img_index=6
- Lažni sajt i chat log: https://bexexpress-rs.7433.click/tpobeob
Pratim ovu sagu od početka, nemam nešto da dodam samo ću ostaviti sve što sam prikupio u hronološkom redu... poslednje što se desilo je da su navodno stavili domen na prodaju za 20 XMR i da je trenutno u statusu PendingTransfer što bi značilo da je neko kupio ali ovo naravno može biti prevara.
Više o grupi:
Wikipedia: ShinyHunters
What are ShinyHunters, the hackers that attacked Google? Should we all be worried?
What Salesforce Organizations Need to Know About ShinyHunters and Vishing
Quote:SPEAK is a platform that allows users to safely and anonymously report abuses of surveillance and censorship across the Western Balkans, which includes Albania, Bosnia and Herzegovina, Kosovo, Montenegro, North Macedonia and Serbia. BIRN also monitors digital rights violations in Romania, Hungary, Turkey, and Croatia, and submissions from these countries are welcome as well.
The platform empowers you to speak out and use your voice against surveillance and censorship. BIRN carefully reviews each submission and may investigate further through in- depth investigative stories or as part of ongoing research projects. This approach allows us to shed light on critical issues and hold accountable those who threaten freedom of expression and privacy.
https://monitoring.bird.tools/speak
IP 195.222.97.167 (AS42186 - Kancelarija za IT i eUpravu) je po CrowdSec-u označen kao maliciozan, sa vrlo agresivnim ponašanjem koje uključuje skeniranje i POP3/IMAP brute-force. Na VirusTotal-u se vide brojne Passive DNS relacije ka domenima vezanim za Synology QuickConnect, QNAP i remoteWD (*.quickconnect.to,*.synology.me,*.myqnapcloud.com), što ukazuje da je IP bio ili je još uvek povezan sa nekom NAS / remote-access infrastrukturom.
https://app.crowdsec.net/cti/195.222.97.167
https://www.virustotal.com/gui/ip-addres.../relations
https://www.abuseipdb.com/check/195.222.97.167
12-22-2025, 01:03 AM
Forum: Seminari, predavanja, radionice, konferencije
- Replies (5)
Quote:What is BSides?
Security BSides is a global series of independent information security conferences organized by and for the
community. Each BSides event is unique and deeply rooted in local infosec culture, while staying true to the
values of openness, curiosity, and shared knowledge.
Why Belgrade? Why now?
In 2026, Serbia will host its very first BSides conference – bringing the energy, talent, and creativity of the local
security and IT community into the spotlight. BSides Belgrade is organized entirely by volunteers, security
professionals, and enthusiasts who believe in the power of knowledge-sharing and meaningful connections.
What makes it different?
Bsides is not a vendor conference. It's not about product demos or corporate talks. It’s about real people, real
experience, real ideas. We aim to create a welcoming, grassroots space for technical talks, hands-on
workshops, and deep conversations – no suits required.
sajt: https://bsidesbeg.org/
brošura: https://bsidesbeg.org/pdf/bsides-brochure.pdf
CFP do 07/03/2026: https://sessionize.com/bsides-belgrade-20263111/
LN https://www.linkedin.com/company/bsides-belgrade/
Insta https://www.instagram.com/bsidesbelgrade/