Sebastian Kwapisz

What is NIS2, really? 👇 NIS2 is approaching fast, bringing significant cybersecurity changes. In this first part of your NIS2 guide, you get answers to questions like: ❓ What is NIS? ❓Why NIS2? ❓What are the biggest differences between NIS and NIS2? The next part will be about sectors and industries affected and how company size plays a crucial role. #NIS2 #NIS #cybersecurity #versioncontrol #backup 

12

This week, cybersecurity experts from CERT Polska (CSIRT NASK) and CSIRT MON uncovered a significant malware campaign targeting governmental institutions in Poland. The attack, characterized by a sophisticated modus operandi, bears similarities to previous assaults on Ukrainian entities and is tentatively linked to the APT28 activity set, associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). The attackers employed cunning tactics, leveraging social engineering through compelling email content to entice recipients into clicking malicious links.   The technical analysis of the campaign reveals a multi-step infiltration strategy. The attackers initially distributed emails designed to pique recipients' curiosity, enticing them to click on a provided link. This link, housed within the run.mocky.io domain, was utilized as a redirect to another website, webhook.site, enabling the logging of queries and configuring responses. By utilizing widely-used, free services, the attackers aimed to evade detection, a tactic observed across various APT groups. Ultimately, victims were directed to download a seemingly innocuous ZIP archive purportedly containing photos but harboring malicious components, including a fake Windows calculator executable, a hidden BAT script, and a forged WindowsCodecs.dll file.   Upon execution, the malware deployed a technique known as DLL Side-Loading to run the included BAT script, which in turn initiated a series of actions culminating in the collection and transmission of victim data to a command and control (C2) server. The attackers employed a sophisticated loop mechanism, utilizing Microsoft Edge to download and execute additional scripts from webhook.site, orchestrating a comprehensive infiltration and data exfiltration process. The attack methodology closely mirrors that of previously documented malware, exemplifying the adversaries' adeptness at adapting and refining their tactics.   In response to this threat, CERT Polska issues recommendations to network administrators, urging vigilance and proactive measures to mitigate risk. Recommendations include scrutinizing connections to domains webhook.site and run.mocky.io, considering blocking these domains, and implementing email filtering for links originating from these services. Additionally, individuals are advised to disconnect potentially compromised devices from the network and promptly notify the appropriate CSIRT team in case of suspected malware infection, underscoring the importance of swift response and collaboration in combating sophisticated cyber threats.    #infosec #cyber #cybersec #cybersecurity #infosecurity     Source: https://lnkd.in/eCPUiZvZ  

2

Instead of focusing on one specific topic, we want to touch on various aspects of hacking and its tools. https://lnkd.in/dXx-dgxB #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #opensourc

4