Hamza Rabbani

  As claims made in a Telegram Chat, CERT-In Might Be Compromised by a Group of Pakistani Hackers; read more in this news post by News4Hackers. https://lnkd.in/dS8Y849H . #crawsec #newsec #certin #hacking #pakistanihacker #hackers #hack #cybernews #latesthackingnews #hackingcrime #cybercrime #cybercriminals #lifeatcraw

4

Investigation Scenario 🔎 A large file with a CPL extension executed from a user temp directory on a Windows system. What do you look for to investigate whether an incident occurred and what caused it? #InvestigationPath #DFIR #SOC

28

2 Comments

Today 25-26 April #day25 #day26 on the way to becoming #dfir😎. Today I conclude my days of working First I slute to Pakistan Government for power outage for 8 hours and second slute goes to PTCL Pakistani know why. So I am doing the malware analysis I can not disclose the output. The tools I used. I got the excel file and sheets are password protected and contain malware. So make a safe Envoirenment VM Windows 10 OS and TSURUGI linux Tools Regedit xls to zip sublime steghide pdfinfo HxD CFF Explorer Procmon pestudio Code that I used to break the sheet password Sub PasswordBreaker() 'Breaks worksheet password protection. Dim i As Integer, j As Integer, k As Integer Dim l As Integer, m As Integer, n As Integer Dim i1 As Integer, i2 As Integer, i3 As Integer Dim i4 As Integer, i5 As Integer, i6 As Integer On Error Resume Next For i = 65 To 66: For j = 65 To 66: For k = 65 To 66 For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66 For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66 For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126 ActiveSheet.Unprotect Chr(i) & Chr(j) & Chr(k) & _         Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _         Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)     If ActiveSheet.ProtectContents = False Then         MsgBox "One usable password is " & Chr(i) & Chr(j) & _             Chr(k) & Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _             Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)     ActiveWorkbook.Sheet(l).Select              Exit Sub     End If     Next: Next: Next: Next: Next: Next     Next: Next: Next: Next: Next: Next End Sub Dr. Zunera Jalil Trillium Information Security Systems Digital Forensics Now Digital Forensics Indonesia Asfand Yar #100daysofcybersecurity #forenscis #chfi #DFIR #DigitalForensics

3

A Russian state hacking group #hijacked the command-and-control infrastructure of a Pakistan-based #espionage network as part of an ongoing intelligence-gathering operation targeting victims in Asia, finds a report from Microsoft and Black Lotus Labs. #ISMGNews #cybersecurity Akshaya Asokan

4

Finally, Successful cleared exam of certified in Cyber Security (CC) by ISC2! However, Exam much more difficult than post-assessment exam provided by ISC2. #cybersecurity #cc #pakistan #isc2

37

9 Comments

PhantomCore is actively targeting Pakistan and Asia, deploying PhantomRAT via phishing emails with legitimate-looking logos. Exploiting CVE-2023-38831 in outdated WinRAR versions, their password-protected RAR files trigger a hidden .NET executable disguised as a PDF. Once executed, PhantomRAT installs, enabling attackers to steal files, harvest credentials, monitor activities, and execute remote commands. Though similar tactics exist, PhantomCore's exact origins remain obscure. #PhantomCom #threatcure #threatactor #malware #CISO #CyberThreats #MalwareAnalysis #InfoSec #infosec Advisory Link: https://lnkd.in/gXHrUJRy

14

Secret Blizzard has used the infrastructure of the Pakistan-based threat activity cluster we call Storm-0156, which overlaps with the threat actor known as SideCopy, Transparent Tribe, and APT36 to install backdoors and collect intelligence on targets of interest in South Asia.  https://lnkd.in/g9KAQyte

Email remains a critical vector for attackers. It is free and easy to abuse. "Military-themed Email Scam Spreads Malware to Infect Pakistani Users" Your organization should have managed advanced email protection, so as you reduce the likelihood of an incident through email. Of course, this single security control is not enough for a complete proper security posture, yet, it's a good step as it's one of the main initial access path toward incident. #cybersecurity #emailsecurity https://lnkd.in/gAVj8p3z

1

Pakistani Hackers Use DISGOMOJI Malware in Indian Government Cyber Attacks. A suspected Pakistan-based threat actor has been linked to a cyber espionage campaign targeting Indian government entities in 2024. Cybersecurity company Volexity is tracking the activity under the moniker UTA0137, noting the adversary's exclusive use of a malware called DISGOMOJI that's written in Golang and is designed to infect Linux systems. "It is a modified version of the public project http://ow.ly/tgBU105wTmK #InceptusSecure #UnderOurProtection

4

𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐎𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐬 Security operations, also known as SecOps, refers to a business combining internal information security and IT operations practices to improve collaboration and reduce risks. SecOps is a set of Security operations center(SOC) processes to improve the security posture of an organization. 🔔 To get more content follow me G M Faruk Ahmed, CISSP, CISA, CDCP #securityoperationscenter #soc #cybersecurity #networksecurity #dataprivacy #freeresources #management #ai

189

10 Comments

🔑 Pass the Hash With Mimikatz: Complete Guide Mimikatz can retrieve plaintext passwords, password hashes, PINs, and Kerberos tickets directly from memory, primarily by accessing credential data within the Local Security Authority Subsystem Service (LSASS) process responsible for managing user authentication and security policies. This detailed article explains Mimikatz, how pass-the-hash attacks work, and the prerequisites for such an attack. We'll guide you through using Mimikatz, including leveraging its Kiwi module within Meterpreter to maximize your capabilities in real-world scenarios. By the end of our guide, you'll understand how to perform pass-the-hash attacks and be equipped to apply these techniques effectively during the post-exploitation phase of your cybersecurity assessments. Enhance your knowledge and skills in cybersecurity by exploring our full guide on passing the hash with Mimikatz here 👉 https://lnkd.in/erV9WwVf

14

1 Comment

Master in Ethical Hacking Course from HELP FOR CYBER VICTIMS FOUNDATION  - Master in Ethical Hacking - Cyber Crime Investigation  - Starts from : Nov 18 2024 - Duration : 3 Months - Fee : 9,999/- - Certification : HFCV Foundation  Spot your booking : +919381964475 10% Discount Registered 10 seats  Enroll now 🔰 limited seats #HelpForCyberVictimsFoundation #HFCVFoundation#Ethicalhacking #cybersecurity #hacking #hackingcourse #cybercrimeinvestigations #cybercrime #hackingtools #hackinglife #hackers #liveclasses #ethicalhackeraravind #cyberexpert #cybercrimes #investigations #HFCV

18

❄ 𝐁𝐮𝐠 𝐁𝐨𝐮𝐧𝐭𝐲 𝐓𝐨𝐨𝐥𝐬 & 𝐑𝐞𝐬𝐨𝐮𝐫𝐜𝐞𝐬 Bug bounty programs are initiatives that allow ethical hackers to find and report security vulnerabilities in exchange for rewards or recognition. These programs are crucial for maintaining robust security postures in organizations. Thank you Sumit Jain and Mohamed Hamdi Ouardi for nice sharing. 🔔 To get more content follow me G M Faruk Ahmed, CISSP, CISA, CDCP #bugbounty #cybersecurity #dataanalyst #cybersecurityanalyst #redteam #soc

124

6 Comments

Wazuh Lab Setup in kali Linux. #SOC team Presentation Wazuh quickstart implementation, adding agents with Wazuh-Manager for SOC team optimization. #wazuh #blueteaming #soc #cybersecurity #siem #bytecapsule #SmartBangladesh #DigitalBangladesh

13

1 Comment