نبذة عني
** Opinions are my own, and not of my employer or affiliated companies**
Matt…
مقالات Matt
-
Summary: CCP Cyber Threat to the American Homeland and National Security
Summary: CCP Cyber Threat to the American Homeland and National Security
Original Hearing: https://www.youtube.
-
Enhancing Windows Security: The Strategic Deprecation of WMIC and Its Impact on Cybersecurity Tactics
Enhancing Windows Security: The Strategic Deprecation of WMIC and Its Impact on Cybersecurity Tactics
The discontinuation of the Windows Management Instrumentation Command line (WMIC) is a key development in Microsoft's…
-
US GAO says "Agencies Need to Improve Cyber Incident Response Practices"
US GAO says "Agencies Need to Improve Cyber Incident Response Practices"
INFORMATION SECURITY: Agencies Need to Improve Cyber Incident Response Practices (April 2014) First, we selected 6…
الإسهامات
النشاط
-
Range Rover. Book a test drive to embark on a journey of unparalleled sophistication.
Range Rover. Book a test drive to embark on a journey of unparalleled sophistication.
تم إبداء الإعجاب من قبل Matt Suiche
الخبرة
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
التراخيص والشهادات
المنشورات
-
Your cloud is in my pocket
BlackHat DC (Arlington, VA, USA)
LiveCloudKd makes possible to debug live Microsoft Hyper-V and VMWare Workstation virtual machines without having to enable the debug mode. With read+write access on the memory
-
Blue screen of the death is dead
H2HC (Sao Paulo, Brazil)
-
Blue screen of the death is dead
Microsoft BlueHat (Seattle, WA, USA)
-
Blue screen of the death is dead
SyScan (HCMC, Vietnam)
-
BlueScreen of Death is Dead
BlackHat USA (Las Vegas, Nevada, USA)
-
Mac OS X Physical Memory Analysis
Hackito Ergo Sum (Paris, France)
-
Mac OS X Physical Memory Analysis
CanSecWest (Vancouver, Canada)
-
Mac OS X Physical Memory Analysis
BlackHat DC (Arlington, Virginia, USA)
-
Mac OS X Physical Memory Analysis
EUROPOL HTCEM (The Hague, Netherlands)
-
Challenges of Windows physical memory acquisition
Shakacon (Honolulu, Hawaii, USA)
اللغات
-
English
إجادة اللغة الأم أو إجادة لغتين إجادة تامة
-
French
إجادة اللغة الأم أو إجادة لغتين إجادة تامة
التوصيات المستلمة
شخصان قدما توصية لـMatt
انضم الآن لعرضملفات شخصية أخرى مشابهة
استكشاف مزيد من المنشورات
-
MUSTAPHA HUNEYD
#SupplyChain security lapses leading to exploitable vulnerabilities have been a concern, but the recent attack in #Lebanon underscores the potential for physical harm. - Will this impact #technological #innovation amidst increased #TPRM and #SupplyChainSecurity measures? - What steps can be taken to mitigate this risk? Share your thoughts. #CyberResilience #NationState National Institute of Standards and Technology (NIST) European Union Agency for Cybersecurity (ENISA) #CyberWar #SupplyChain CyberEdBoard Community ClubCISO The CISO Collective
٢ تعليق -
Osint10x
🌐 Emerging Threats: Espionage & Disruption in the Middle East 🌐 Recent campaigns by WIRTE, affiliated with Hamas and part of the Gaza Cybergang (TA402), Presents a Dual Strategy of Espionage and Disruption, posing significant Risks to Organizations in the Middle East and Israel. Key Campaign Details: 🔍 Threat Overview: - Two waves of SameCoin Wiper attacks in 2024 targeting Israel. - Espionage campaigns using Phishing, Malicious PDFs, DLL sideloading, and IronWind loaders to gather Intelligence. 💻 Malware & Tactics: - Tools: IronWind loader, SameCoin wiper, Havoc Demon payloads, and custom loaders. - Techniques: HTML Payload Embedding, Phishing with Fake Domains, and DLL sideloading via legitimate executables. - Exploited both Windows and Android platforms. https://lnkd.in/gjgBHwsY #CyberSecurity #MiddleEastThreats #Espionage #Disruption #Hamas #ThreatIntelligence #Phishing #WiperAttacks #CyberWarfare #IncidentResponse #ThreatIntelligence
-
Just Do IT
**Bitter APT Group Launches Sophisticated Cyber Attack Against Turkish Defense Sector** Cybersecurity professionals are on high alert as a cunning Advanced Persistent Threat known as Bitter has perpetrated a sophisticated cyber espionage campaign targeting a Turkish defense organization. The foreign adversary leveraged two stealthy C++ malware families, WmRAT and MiyaRAT, to infiltrate the victim's systems undetected in November 2024. The assailants' multi-staged attack progressed with cunning craftiness. Initially planting an infectious shortcut file during the exploitation of unusual data streams hidden within a compressed archive, this malicious LNK payload surreptitiously scheduled forthcoming payloads to deploy. This alarming incident underscores the growing complexity of cyber operations aimed at critical industries worldwide. All entities must stay perpetually watchful while also strengthening precautions to immediately identify and block such threats. We at Just Do IT stand prepared to help with actionable intelligence and comprehensive security offerings to shelter your operations from these technologically-savvy intruders. Stay informed and protected. Follow our page for continuous updates on cybersecurity and share this post to raise awareness among your contacts. #CyberSecurity #ThreatIntelligence #APT #MSSP #CyberEspionage #DataProtection #JustDoIT
-
Zlatan Moric
GuardZoo Android Surveillanceware Targeting Military Personnel GuardZoo is an active Android surveillanceware campaign targeting military personnel in the Middle East since October 2019. Named after a piece of source code enabling persistence, it uses animal-related class names like AnimalCoop and MainZoo. Lookout attributes this campaign to a Yemeni, Houthi-aligned threat actor. Over 450 IP addresses from victims primarily in Yemen, Saudi Arabia, Egypt, Oman, UAE, Qatar, and Turkey have been identified. GuardZoo can collect extensive data, including photos, documents, location data, device information, and more. Distributed via WhatsApp, WhatsApp Business, and direct browser download, it allows threat actors to deploy additional invasive malware on infected devices. For more details, visit the Lookout report: [GuardZoo Surveillanceware Report](https://lnkd.in/dZXeP2eA) #CyberSecurity #Lookout
-
Hernan Espinoza
CVE-2024-4548 - CVSS 9.8 - EPSS We don't have an EPSS score for this CVE yet - An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field. Ref.1: https://lnkd.in/daT9dFuw
-
Piotr Klepuszewski
🔗 DarkWebInformer.com - Cyber Threat Intelligence 📅 Date: 2024-12-22 🚨 Title: Alleged data leak of Gr8life International Corporation 🛡️ Victim Country: Philippines 🏭 Victim Industry: Marketing, Advertising & Sales 🏢 Victim Organization: Gr8life International Corporation 🌐 Victim Site: gr8lifeintlcorp.com 📜 Category: Data Breach 🔗 Claim: https://lnkd.in/e4AFsCfx 🕵️♂️ Threat Actor: Counter 🌍 Network: Open Web 📝 Description: The threat actor claims to have leaked 1GB of data from Gr8life International Corporation. The breach impacts approximately 15,000–20,000 unique clients and distributors, exposing personal data, operational records, transaction details, shipping and billing information, and login credentials.
-
Matthew Stith
Constantly evolve your policies regarding your email authentication and your email setup. (The adversaries definitely are) Setting up DMARC to p=none while you are ensuring that you have properly configured all of your SPF and DKIM is something that companies have to do when trying to wrangle in their email infrastructure. But remember it does not stop there..... strive for a world where you are p=reject. (I know quarantine exists but really if DMARC fails throw it back at them). Be careful out there. Oh and read the advisory.
١ تعليق واحد -
Cyber Threat Alliance
Members of Cyber Threat Alliance often share threat blogs, research, reports, with each other early - generally 24-72 hours before they post the threat information publicly. This allows CTA members to be aware and prepare for what is coming. This is priceless! Here is a recent share from Symantec Middle East Campaign: Fake Mossad Intelligence Reports Lure https://lnkd.in/gMczwT5q #CTAearlyshares #threatintelligence #EmpoweringCTA #threatresearch #cybersecurity
-
Jorge Laurel
### SUMMARY: Critical flaws in CocoaPods put iOS and macOS apps at significant risk, enabling potential remote code execution. ### MAIN POINTS: - Severe vulnerabilities in CocoaPods could lead to remote code execution in iOS and macOS applications. - Attackers can exploit these flaws to execute malicious code on affected devices. ### TAKEAWAYS: - Immediate updating of CocoaPods is strongly recommended to mitigate these risks. - Developers should review and implement security best practices to prevent exploitation. #cybersecuritynews #cybersecurity
-
James Villeneuve
🚨 Skopenow just released a new blog addressing alert fatigue in intelligence and investigative tools. Alert fatigue surged between 2018-2020 with the introduction of persistent monitoring features across the industry, it remains as prevalent of an issue today. Organizations are turning to OSINT solutions with advanced AI-powered search, filtering, and reporting to boost analyst productivity and combat burnout. Check out the blog here: https://bit.ly/4cILDZG #OSINT
-
OSINT Team
Are you an investigator looking to uncover the darkest corners of the web? FAZLA RABBI reveals the top 6 OSINT tools that will empower your dark web investigations. https://lnkd.in/eXvzq_2M #OSINT #OpenSourceIntelligence #Research #OpenSourceInvestigation #Intelligence
١ تعليق واحد -
Daniel Faram
In corporate intelligence, #OSINT practitioners often evaluate the extent of automation in disinformation campaigns. While it’s clear that social media companies could do more to counter these threat actors, the landscape is continually changing—enhanced detection methods are likely to drive more advanced evasion tactics. This article explores how 3D-printed robotics could be a viable threat actor escalation. https://lnkd.in/e-DA8i9D
٢ تعليق -
Gurucul
💡Daily Threat Research Entries 12/09/2024—IOCs and Detection Queries💡 1️⃣ SmokeLoader Attack Targets Companies in Taiwan Details 👉 https://lnkd.in/dU7h93fw Explore all Threat Research, updated daily 👉 https://lnkd.in/gbEWXNdB #ThreatResearch #ThreatDetection #CVE #Vulnerabilities #SecurityResearch
-
Exiger
💡 Exiger’s Supply Chain Trends report covers the most impactful industry headlines and features “Exiger Insights” on why it matters. This month we explore: 🚨 Broader Middle East war looms after assassination in Iran of Hamas’s head negotiator for Gaza ceasefire. 🚨 Bug in update to popular cybersecurity software roils global institutions. 🚨 Sensitive data stolen and leaked in multiple high-profile hacks. Don’t miss the targeted assessments by Exiger’s SMEs to help you prepare for the coming months. 🔗 Read it here: https://lnkd.in/eEu_zVhv #SupplyChain #SCRM #War #Data #Cybersecurity
-
Marc Krisjanous
*** New CCSS v9 requirement for blockchain state monitoring *** Monitoring wallet addresses for suspicious activity appears to be a very effective detective control. Unauthorized access and use of key material can sometimes be detected before other information security controls identify the intrusion. Cyvers provides, for the crypto community's benefit, a publicly accessible alert service that has proven effective at alerting entities of intrusions into an entity's platform. One example is the WazirX breach, where it appears Cyvers tooling identified suspicious activity with a WazirX wallet while the attack occurred. https://lnkd.in/gcB5-yP5 Based on the Cyvers example and many other alerts generated from monitoring wallet addresses, the CCSS Steering Committee added a requirement to CCSS v9 that the blockchain state, confirmed and unconfirmed, be monitored for suspicious activity. The requirement is below. "2.02.4.1 Relevant blockchain state (confirmed and unconfirmed) as it relates to the CCSS Trusted Environment are continuously monitored for anomalous behavior, generating alerts. Appropriate personnel address the alerts that are generated." The wording of the requirement avoids “wallet address monitoring” to future-proof this requirement and allow for different monitoring approaches that do not lock in the entity to purchase vendor-provided tooling to meet the requirement. Note that the “unconfirmed” state term is related to transactions that have not been fully confirmed, such as transactions in a mempool. The CCSSA (the auditor) will consider whether the "unconfirmed" state applies to the entity under audit when conducting an audit. More guidance on this requirement will be coming. CCSS v9 is located here: https://lnkd.in/gUxMJjn9 #DigitalAssetsFramework #DigitalAssets #VirtualAssets #CryptoCustody #CryptoCompliance #Crypto #CryptoCurrency #ccss #ccssa #informationsecurity #digitalpayments #cryptosecurity #informationsecurity #risk
٣ تعليق