Michael Friedrich

Executive leader. Zero Trust, Cyber, Cloud and AI evangelist. Thoughts and opinions are my own

[Michael Friedrich @SecureFriedrich]

@DisneyFoodBlog Was a mess and so hot. Had to leave. Line for La Cava was over 90 minutes.

[Sami Laiho @samilaiho]

CISA confirms Veeam vulnerability is being used in ransomware attacks https://t.co/8HcAa2Jl6N

[BleepingComputer @BleepinComputer]

Cisco investigates breach after stolen data for sale on hacking forum - @LawrenceAbrams
https://t.co/Mh3FQJMNLa

https://t.co/Mh3FQJMNLa

[Ryan Naraine @ryanaraine]

Palo Alto warns that attackers can access usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. https://t.co/kmvVMSB7sm

[BleepingComputer @BleepinComputer]

AT&T, Verizon reportedly hacked to target US govt wiretapping platform - @Ionut_Ilascu
https://t.co/PFpdopPwPF

https://t.co/PFpdopPwPF

[BleepingComputer @BleepinComputer]

SonicWall warns of critical access control flaw in SonicOS - @billtoulas
https://t.co/SVBFPE5iQD

https://t.co/SVBFPE5iQD

[BleepingComputer @BleepinComputer]

Ivanti urges customers to patch a critical Virtual Traffic Manager (vTM) authentication bypass vulnerability that can let attackers create rogue administrator accounts - @serghei
https://t.co/QEVjpDgVHQ

[BleepingComputer @BleepinComputer]

CrowdStrike sued by investors over massive global IT outage - @billtoulas
https://t.co/FdpVbbxylf

https://t.co/FdpVbbxylf

[Nicolas Krassas @Dinosn]

Researchers Uncover Massive Quad7 Botnet Targeting Microsoft 365 https://t.co/TdVpuYmblG

[Nicolas Krassas @Dinosn]

Microsoft Defender Flaw Exploited to Deliver ACR, Lumma, and Meduza Stealers https://t.co/Z7thEbLEkZ

[BleepingComputer @BleepinComputer]

CrowdStrike: 'Content Validator' bug let faulty update pass checks - @billtoulas
https://t.co/ob8odarxPT

https://t.co/ob8odarxPT

[R A W S A L E R T S @rawsalerts]

🚨#BREAKING: Hackers have stolen and leaked internal documents stolen from Leidos Holdings one of the largest IT services providers to the Pentagon, Homeland Security, NASA, and other U.S. government agencies, according to Bloomberg.

[Dark Web Informer @DarkWebInformer]

🚨#BREAKING🚨'Nearly all' AT&T customers’ call and text records exposed in a massive breach. The data contains records of calls and texts between approximately May 1 and Oct. 31, 2022, and on Jan. 2, 2023.

https://t.co/brld1qxy3l

On April 19, 2024, AT&T Inc. (“AT&T”) learned that a threat actor claimed to have unlawfully accessed and copied AT&T call logs. AT&T immediately activated its incident response process to investigate and retained external cybersecurity experts to assist. Based on its investigation, AT&T believes that threat actors unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31, 2022, as well as on January 2, 2023, as described below.

The data does not contain the content of calls or texts, personal information such as Social Security numbers, dates of birth, or other personally identifiable information. Current analysis indicates that the data includes, for these periods of time, records of calls and texts of nearly all of AT&T’s wireless customers and customers of mobile virtual network operators (“MVNO”) using AT&T’s wireless network. These records identify the telephone numbers with which an AT&T or MVNO wireless number interacted during these periods, including telephone numbers of AT&T wireline customers and customers of other carriers, counts of those interactions, and aggregate call duration for a day or month. For a subset of records, one or more cell site identification number(s) are also included. While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number.

AT&T has taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access. AT&T will provide notice to its current and former impacted customers.

On May 9, 2024, and again on June 5, 2024, the U.S. Department of Justice determined that, under Item 1.05(c) of Form 8-K, a delay in providing public disclosure was warranted. AT&T is now timely filing this report. AT&T is working with law enforcement in its efforts to arrest those involved in the incident. Based on information available to AT&T, it understands that at least one person has been apprehended. As of the date of this filing, AT&T does not believe that the data is publicly available.

As of the date of this filing, this incident has not had a material impact on AT&T’s operations, and AT&T does not believe that this incident is reasonably likely to materially impact AT&T’s financial condition or results of operations.

[David O'Brien (he/him) @david_obrien]

Love it when Microsoft tells customers "don't use public endpoints on your services" and then forces you to deploy premium SKUs to make things private.

/Slow clap

[Nicolas Krassas @Dinosn]

Coding error in forgotten API blamed for massive data breach https://t.co/QIAGyKoBtF

[Nicolas Krassas @Dinosn]

An unpatched bug allows anyone to impersonate Microsoft corporate email accounts https://t.co/q6t6WeJFfc

[Lorenzo Franceschi-Bicchierai @lorenzofb]

NEW: An unpatched bug allows anyone to spoof any Microsoft corporate email address, giving malicious hackers a better chance to send credible and harder to spot phishing emails.

Researcher demonstrated to us the bug, which only works with Outlook emails.

https://t.co/wXugKxSVxd

[Dark Web Informer @DarkWebInformer]

🚨MAJOR BREACH🚨IntelBroker has allegedly breached data belonging to U.S. Army Aviation and Missile Command

"In August 2023, the government agency known as 'United States Army Aviation and Missile Command' suffered a data breach."

The documents, both images and PDFs are related to "Boeing CH-47F Chinook" and "Sikorsky H-60 Black Hawk"

IntelBroker previously leaked this on BF2, but "the forum was f*cked 1 hour later. Killed 2 forums in a row."

[Dark Web Informer @DarkWebInformer]

🚨MASSIVE BREACH🚨TheSupremeGodKing on behalf of IntelBroker is selling access to a range of companies.

They state: I breached a company that works with contracting to over 400 companies, mostly all American based. Access include: Jira, Bamboo, Bitbucket, Github, GitLab, SSH, SFTP, DA, Zabbix, AWS S3, AWS EC2, SVN & Terraform. XMR ONLY.

Example of company Revenue:

Comp 1: $67.6 Billion
Comp 2: $197 Billion
Comp 3: $42.3 Billion
Comp 4: $381.6 Billion

[Dark Web Informer @DarkWebInformer]

🚨MAJOR DATA LEAK🚨TheSupremeGodKing has announced a breach by IntelBroker belonging to the company CBRE. CBRE has a revenue of $32.5 billion.

"In June 2024, CBRE was breached by exploiting a recently found Atlassian Jira zero-day, and was leaking its AWS config settings in the Jira."

Compromised Data: Email Addresses, Passwords, Full names, IP addresses, Dates