RansomLook Ticker

Posted on in internet, security
   Leave a reply

RansomLook Ticker is a lightweight Python utility that monitors the latest posts from RansomLook (a ransomware gang tracker) and forwards enriched notifications to Mattermost. It leverages:

The RansomLook API for recent incident data Google Custom Search to gather contextual snippets OpenAI’s ChatGPT to extract structured intelligence (country, sector, etc.) Mattermost webhook for real-time alerts

This project is ideal if you want:

Push notifications without hosting a RansomLook instance A minimal Retrieval-Augmented Generation (RAG) pipeline A … Read more.

Extract hostnames and domains from DDoSia MISP object

Posted on in internet, security
   1 Reply

DDoSia is a distributed denial-of-service (DDoS) attack tool reportedly employed by pro-Russian hacktivist groups. The tool coordinates large networks of compromised devices to flood targeted websites or services with excessive traffic, overwhelming their capacity and rendering them inaccessible to legitimate users. It has been used to disrupt government, financial, and media platforms, aiming to create instability and hinder critical infrastructure.

The DDoSia configuration, basically the instructions for the attack tool, have been shared via the … Read more.

Ivanti vulnerabilties – recap

Posted on in internet
   2 Replies

Formerly known as Pulse Connect Secure, or simply Pulse Secure VPN software All supported versions (9.x and 22.x) of Ivanti Connect Secure and Ivanti Policy Secure are vulnerable to CVE-2023-46805 and CVE-2024-21887 CVE-2023-46805 an authentication-bypass vulnerability with a CVSS score of 8.2 in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure that allows a remote attacker to access restricted resources by bypassing control checks. CVE-2024-21887 a command-injection vulnerability found into … Read more.

Current state of the MISP playbooks

Posted on in internet, open source
   Leave a reply

I published an overview of the current state of the MISP playbooks, covering the work that has been done in 2023 and the features you can expect in 2024.

Activity 4: MISP workflow integration, Elasticsearch, MDTI and support for curation Activity 5: Timesketch, conversions with CACAO and Microsoft Sentinel Activity 6: Scheduled playbooks, timelines,

Read the full details at the MISP project website at https://www.misp-project.org/2023/12/08/current-state-MISP-playbooks.html/

MISP playbook: Malware triage

Posted on in internet, open source, security
   Leave a reply

I shared the MISP playbook for malware triage that I regularly use for a first assessment on new samples. It uses MISP, VirusTotal, MalwareBazaar, Hashlookupand pefile. It then uploads the samples to MWDB and alerts to Mattermost.

The MISP playbook on malware triage is one of many playbooks that address common use-cases encountered by SOCs, CSIRTs or CTI teams to detect, react and analyse specific intelligence received by MISP.

Include threat information from MISP in Zeek network visibility

Posted on in internet, linux, open source, security
   Leave a reply

Zeek (formerly Bro) is a free and open-source software network analysis framework. It gives insights on DNS queries, HTTP and TLS information and details on transmitted files. I find Zeek one of the best network monitoring tools available to provide detailed visibility on network traffic.

Zeek has a built-in intelligence framework. This framework allows you to add information received via MISP directly into the network visibility capabilities of Zeek. This includes

Visits to URLs or … Read more.

ENISA Threat Landscape 2022

Posted on in internet, security
   1 Reply

I contributed to the ENISA Threat Landscape 2022. The ETL is an annual report on the status of the cybersecurity threat landscape. It identifies the top threats, major trends observed with respect to threats, threat actors and attack techniques, as well as impact and motivation analysis. It also describes relevant mitigation measures.

Get a copy of the ENISA Threat Landscape 2022.

MISP web scraper

Posted on in internet, open source
   Leave a reply

I published an article on the MISP project website on the MISP web scraper.

There are a lot of websites that regularly publish reports on new threats, campaigns or actors with useful indicators, references and context information. Unfortunately only a few publish information in an easily accessible and structured format, such as a MISP-feed. As a result, we often find ourself manually scraping these sites, and then copy-pasting this information in new MISP events. These … Read more.

Cyber Resilience Strategy Changes You Should Know in the EU’s Digital Decade

Posted on in internet
   Leave a reply

I published an article on the IBM Security Intelligence blog : Cyber Resilience Strategy Changes You Should Know in the EU’s Digital Decade. The article describes the new EU Cybersecurity Strategy and one the proposal for a revised Directive on Security of Network and Information Systems

The EU Commission attempts to improve cyber resilience with the NIS2 Directive and provides an overview of cyber resilience challenges for 5G and IoT. Other topics discussed include … Read more.

Cybersecurity Ethics: Establishing a Code for Your SOC

Posted on in internet, security, society
   Leave a reply

I published an article on the IBM Security Intelligence blog : Cybersecurity Ethics: Establishing a Code for Your SOC. The article describes the dilemmas you can face when working in a SOC or doing incident response work.

The articles describes Cybersecurity Ethics Guidance Frameworks, Best Practices and a Practical Approach for Cybersecurity Ethics, including a set of commandments to adhere. For example

Do not use a computer to harm other people. Protect society and … Read more.