digicat

NICKEL ALLEY strategy: Fake it ‘til you make it - Victimizing software developers via fake companies, jobs, and code repositories to steal cryptocurrency (www.sophos.com)

Pro-Iranian Nasir Security is Targeting The Energy Sector in the Middle East (www.resecurity.com)

Our investigation of the laptop farm identified that DPRK IT workers leverage Raspberry Pi-based KVM (Keyboard-Video-Mouse) devices to remotely access desktops and mesh VPN (6068438.fs1.hubspotusercontent-na1.net)

Who Runs Cl0p? Inside the Most Elusive Ransomware Operation in the World (rmoskovy.github.io)

TeamPCP Isn't Done: Threat Actor Behind Trivy and KICS Compromises Now Hits LiteLLM's 95 Million Monthly Downloads on PyPI (www.endorlabs.com)

APT-C-13 (Sandworm) RDP backdoor attack (mp.weixin.qq.com)

Brbbot: Full Malware Analysis & Reverse Engineering (7amthereaper.github.io)

Add TVicPort64.sys - arbitrary physical memory mapping LPE (EnTech Taiwan, signed 2006t) (github.com)

Active device code phishing campaign impersonating a popular cloud-based file storage service and two prominent electronic signature and document workflow platforms. (github.com)

Russian Citizen Sentenced to Prison for Hacking into U.S. Companies and Enabling Major Cybercrime Groups to Extort Tens of Millions of Dollars (www.justice.gov)

Firewall Rule BOF - Add, remove, or query Windows Firewall rules via the COM API (INetFwPolicy2) without spawning netsh.exe or cmd.exe. Useful for pivoting inside networks. (github.com)

Business, logic, and chains: unauthenticated RCE in Dell Wyse Management Suite (swarm.ptsecurity.com)