630 - Earth Baxia, Raptor Train, SambaSpy e nova vuln no Gitlab

Notas do episódio

[Referências do Episódio] Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC - https://www.trendmicro.com/en_us/research/24/i/earth-baxia-spear-phishing-and-geoserver-exploit.html GrimResource - Microsoft Management Console for initial access and evasion - https://www.elastic.co/security-labs/grimresource Hijack Execution Flow: AppDomainManager - https://attack.mitre.org/techniques/T1574/014/ Derailing the Raptor Train - https://blog.lumen.com/derailing-the-raptor-train/ Exotic SambaSpy is now dancing with Italian users - https://securelist.com/sambaspy-rat-targets-italian-users/113851/ GitLab Patches Critical SAML Authentication Bypass Flaw in CE and EE Editions - https://thehackernews.com/2024/09/gitlab-patches-critical-saml.html Global Coalition Takes Down New Criminal Communication Platform - https://www.europol.europa.eu/media-press/newsroom/news/global-coalition-takes-down-new-criminal-communication-platform Microsoft: Vanilla Tempest hackers hit healthcare with INC ransomware - https://www.bleepingcomputer.com/news/microsoft/microsoft-vanilla-tempest-hackers-hit-healthcare-with-inc-ransomware/ Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors - https://unit42.paloaltonetworks.com/gleaming-pisces-applejeus-poolrat-and-pondrat/ WebDAV-as-a-Service: Uncovering the infrastructure behind Emmenhtal loader distribution - https://blog.sekoia.io/webdav-as-a-service-uncovering-the-infrastructure-behind-emmenhtal-loader-distribution/ Roteiro e apresentação: Carlos Cabral e Bianca Oliveira Edição de áudio: Paulo Arruzzo Narração de encerramento: Bianca Garcia