p0 Labs

34 posts

p0 Labs banner
p0 Labs

p0 Labs

@P0Labs

Cloud Threat Research and Detection Engineering is our Priority Zero (p0) at Permiso Security.

เข้าร่วม Mart 2022
31 กำลังติดตาม105 ผู้ติดตาม
p0 Labs รีทวีตแล้ว
Melinda Marks
Melinda Marks@melindamarks·
An area needing attention for protecting modern applications against threats👇 -access via IDP identities -LUCR-3 uses SaaS applications to learn how the victim organization operates and how to access sensitive information."  #cloudsecurity #iam #sspm #appsec @permisosecurity
1aN0rmus@TekDefense

Beware of LUCR-3! 🚨 Threat actor that overlaps with Scattered Spider, Oktapus, UNC3944, & STORM-0875, they exploit IDPs for initial access & aim to steal IP for extortion. They use victims' tools and evade detection with expertise. @permisosecurity permiso.io/blog/lucr-3-sc…

English
0
2
4
615
p0 Labs รีทวีตแล้ว
1aN0rmus
1aN0rmus@TekDefense·
Beware of LUCR-3! 🚨 Threat actor that overlaps with Scattered Spider, Oktapus, UNC3944, & STORM-0875, they exploit IDPs for initial access & aim to steal IP for extortion. They use victims' tools and evade detection with expertise. @permisosecurity permiso.io/blog/lucr-3-sc…
English
2
69
150
86.8K
p0 Labs รีทวีตแล้ว
Nick Carr
Nick Carr@ItsReallyNick·
📴Hopefully your org doesn't allow SMS for 2FA (especially for privileged accounts in Azure AD). Don't stop at disabling it. Monitor for threat actors trying to modify it. Nice transparency into threat actor tampering & recommendations @TekDefense/@p0Labs 📰Full blog: permiso.io/blog/lucr-3-sc…
Nick Carr tweet media
English
2
10
27
4.3K
p0 Labs รีทวีตแล้ว
Nick Carr
Nick Carr@ItsReallyNick·
Excellent 🆕blog from @permisosecurity on the most disruptive criminal intrusion set we're all working on. Blog details evasive techniques scattered across SaaS & multi-cloud environments.
Nick Carr tweet media
1aN0rmus@TekDefense

Beware of LUCR-3! 🚨 Threat actor that overlaps with Scattered Spider, Oktapus, UNC3944, & STORM-0875, they exploit IDPs for initial access & aim to steal IP for extortion. They use victims' tools and evade detection with expertise. @permisosecurity permiso.io/blog/lucr-3-sc…

English
1
43
123
36.1K
p0 Labs รีทวีตแล้ว
Nick Carr
Nick Carr@ItsReallyNick·
.@TekDefense & the @permisosecurity p0 Labs team get it. This time showing you how older techniques like HIST* mods can be combined with new signal to hunt for credential harvesting campaigns $hist1 = "HISTSIZE=0" $hist2 = "unset HISTFILE" 🆕 permiso.io/blog/s/christm… 🎅
Nick Carr@ItsReallyNick

Linux #DFIR reminders: 1⃣ Trojanized binaries are still a popular Linux infection vector - along with classics like web shells, tunnelers, & simple bash scripts 2⃣ HISTFILE modification behavior is suspicious - and detection may be as simple as HISTFILE string in ELF binaries

English
0
10
17
6.9K
p0 Labs รีทวีตแล้ว
Marco Lancini
Marco Lancini@lancinimarco·
🔖 Cloud Cred Harvesting Campaign A credential harvesting campaign targeting cloud infrastructure. The majority of the victim system were running public facing Juptyer Notebooks. From @permisosecurity permiso.io/blog/s/christm…
English
0
4
5
663
p0 Labs รีทวีตแล้ว
Marco Lancini
Marco Lancini@lancinimarco·
🔖 SES-pionage What do attackers do with exposed AWS access keys? This blog looks inside AWS SES to give deeper insights into the service, why & how its targeted and how to detect it. From @permisosecurity permiso.io/blog/s/aws-ses…
English
0
5
10
711
p0 Labs รีทวีตแล้ว
Daniel Bohannon
Daniel Bohannon@danielhbohannon·
I'm super excited to announce that I've joined @permisosecurity as a Principal Security Researcher! Stoked to be reunited with the fiercely fun & technical @TekDefense on the @P0Labs research team. Several weeks in & I'm super impressed by the team, tools, data & capabilities.
Daniel Bohannon tweet media
English
5
6
65
0

ค้นพบ

@permisosecurity @TekDefense @spiderspiders_ @danielhbohannon @gl4ssesbo1 @ExpelSecurity @akraut @darkreading