Last week, CrowdSec CEO @philippe_humeau presented at the @SANSInstitute Cyber Leaders event in Brussels.
The presentation looked at what real-world attack data tells us about vulnerability exploitation, from how quickly attackers move after a CVE is disclosed to the IPs actually involved in exploitation.
You can check out the presentation below 👇
Want to dig into the data yourself?
Check IP reputation and activity with IPDEX: https://t.co/6FmDqEDXIn
Track which IPs are exploiting which CVEs: https://t.co/OagZdn2RQt
🤖 When CrowdSec 1.8 introduced bot detection, some adventurous alpacas put the alpha feature straight into production. That gave us a new perspective: not just what an IP is doing, but what’s running behind it.
Our first investigation uncovered PaperPhone, a scraping network spanning 75K IPs across 43 countries, with 13 claimed device identities and some very suspicious fingerprints.
🌍 The geographic diversity? Not quite what it seems.
Read the full investigation: https://t.co/i475dcn1zd
#botdetection #WAF #cybersecurity
The launch of CCIP 2.0 is something we've been working on with the world's top financial institutions for a while, we have now implemented their feedback on what is needed for institutional grade bridging of data and the movement of the digital assets themselves across both public and private chains.
The response from the capital markets community here at Sibos has been very positive, and it is clear that the additional compliance, risk management, configurability and network participation capabilities of CCIP 2.0 are something that institutions find attractive and useful.
I think the digital asset industry will end up at a new level of risk management for their data all of their tokenized value; where digital assets that are not bridged via a secure method and/or are relying on data that can be manipulated, will be viewed as much more risky. If the digital assets that bridge via providers which are not secure by default and/or keep repeatedly losing bridging keys, then they will receive worse asset risk scores which necessarily leads to worse terms for their usage as collateral, their inclusion on a balance sheet, and various other use cases. In some cases we are already seeing that having unreliable bridging or easy to manipualte data for valuation is leading to some digital assets to not be accepted for collateral or other users cases at all.
We are now working closely with top FMIs, the leading banks, top asset managers, top GSIs and various capital markets technology providers to enable digital assets to operate in a derisked way, to unlock the liquidity found in public chains and to efficiently connect the next generation of digital assets to the benefits of DeFi.
https://t.co/rYzhSWCcPY
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year.
I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks.
Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi.
Alias 1 - Cc
Discord: cc02006
Discord ID: 1351486674386948148
Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363
Alias 2 - jack
Discord: jack_34808
Discord ID: 1553705721768714377
Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69
Alias 3 - Melon
Discord: under0346
Discord ID: 1394240539108573215
Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F
Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B
Alias 4 - lolo / Marin
TG: pvpcz
TGID: 6223514198
Discord: losern
Discord ID: 1024415186527985704
Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15
Alias 5 - HELP ME
Discord: helpme031897
Discord ID: 1554035533817188384
Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379