Multiple threat actors are exploiting CVE-2023-4966, aka Citrix Bleed, a critical vulnerability in NetScaler ADC and Gateway.

Mass Exploitation of ‘Citrix Bleed’ Vulnerability Underway

Citrix Bleed, the critical information-disclosure bug that affects NetScaler ADC and NetScaler Gateway, is now under "mass exploitation," as thousands of Citrix NetScaler instances remain vulnerable, according to security teams.

'Mass exploitation' of Citrix Bleed underway as ransomware crews pile in

Earlier this month another vulnerability was found in Citrix Systems Inc.’s NetScaler and NetGateway product lines. This time around, the Citrix Bleed exploit is a lot more dangerous and harder to snuff out.

New Citrix Bleed vulnerability of NetScaler network devices

North Korea’s evolving and flexible hacking structure encompasses a wide range of malicious activity beyond stealing from cryptocurrency exchanges, fueled by a small but nimble cyber workforce.

North Korea’s state hacking program is varied, fluid, and nimble

U.S. critical infrastructure organizations have been urged by Mandiant Intelligence Chief Analyst John Hultquist to accelerate efforts to discover and mitigate threats by Chinese state-sponsored threat operation Volt Typhoon,

Significant Volt Typhoon threat requires immediate US critical infrastructure action

Google’s AI strategy in Google Cloud, project Gemini, Vertex AI, and GenAI into security products boosts sales and innovation, said Sundar Pichai in Q3 2023 earnings.

Google CEO’s 8 Boldest AI Remarks On Cloud, Gemini And Security

The Canadian government report exposed China’s Spamouflage campaign designed to use social media to influence public opinion and politics in target countries.

China Falsely Denies Disinformation Campaign Targeting Canada’s Prime Minister

Critical infrastructure defenders should urgently work to find and remove traces of Volt Typhoon, a Chinese government-backed hacking team.

Mandiant Intelligence Chief Raises Alarm Over China’s ‘Volt Typhoon’ Hackers in US Critical Infrastructure

It carries a severity score of 9.4 and affects NetScaler ADC, and NetScaler Gateway. Prior to Citrix’s reaction, both Mandiant and CISA warned about the flaw. Mandiant said hackers were probably using it to hijack authentication sessions and steal ...

Citrix urges users to patch immediately after serious bug discovered

Cloud giant Citrix has confirmed earlier reports of a critical vulnerability in some of its products being abused in the wild. It released a patch for the flaw and urged users to apply it immediately and make sure they’re safe from hackers.

Mandiant

fireeye

As far as data breaches go, this one was a beauty and happily I don’t need to tell you what happened or how it happened, others already did that for me. I am not going to write about the that we cannot protect, or even raise any eyebrows about the . inherent flaws with tying your entire financial identity to a social security number unprecedented size of the breach You are not here to read about how , despite having more than a month to properly prepare for it, nor did you come to read something that you have already read elsewhere. Equifax completely bungled their public response Equifax Cybersecurity Is A Shambles You came to find out who poured oil onto the fire, you came to find out who is going to get burned and who will be sacrificed to the gods of #netsec. I don't blame you, it's the only angle in this story that really interested me too, if only because we have all seen this movie so many times before. What we have not seen before though is the series of unfortunate events that are beginning to act as a catalyst and make this story burn brighter. Lets start with our first red flag. Time To Notify Lets ignore the fact that Equifax knew that their customers in a timely manner if their personal details were exposed. they had an obligation to notify Equifax first discovered the breach in , but waited more than two months to notify their customers, the site they are using to notify others about the breach (equifaxsecurity2017.com) was first registered in August, but the contents of the site were not uploaded until September. late May or early July They were not even ready to handle the volume of calls from their customers, who could not answer any questions, like ‘has my social security number been stolen in the breach’. shifting them off to a 3rd party call center Its also worth noting that if you sign up to their credit monitoring service, the one they are happily giving you for free for one year, you are basically signing away your right to sue them for the damage the breach causes. ‘Protecting You’ While Removing Your Right To Sue Who is responsible for this time to notify and this arbitration notice, both of which were embarrassingly mishandled by whoever that person was. Selling Off Equity Holdings Three senior executives at Equifax, their CFO John Gamble, a divisional President Rodolfo Ploder and Joseph Loughran their President of Information Systems, all in a sale that was not pre-planned with the SEC, just before the notification came. very sold upto $1.8 Million worth of shares Those Executives No Longer Exist Where before all three had Linkedin profiles, not they no longer exist and to make matters worse, all three are on record saying about the breach before they sold their shares, despite being so high ranking. they had no idea I don't believe for a second that these guys didn't know about the breach, by the time they sold their shares, Equifax knew about the breach for quite some time and there is every indication of insider trading here. Fire Eye Registering Equihax.com Before The Notification As if to rub salt into the wounds, Brandan Schondorfer, an employee of Fire Eye publicly registered the Equihax.com before the official notification. Being that Fire Eye were the cybersecurity team who were supposed to be protecting Equifax, this domain registration is in very bad taste and surprise, surprise, Brandan’s LinkedIn profile is also no longer available. This is either some very bad #OPSEC or they have been compromised. Others however have suggested that this is connected to Fire Eye and Equifax efforts to divert from the breach in some way, but that seems like pure speculation to me, even though the data has already appeared for sale. Equifax Data For Sale On The Darknet Although we have as yet no real idea of who the culprits behind this attack where, what is suspicious is that almost two months after the attack and just days after the public notification, the data was on sale on the darknet. Equifax Data For Sale We have absolutely no idea of who is behind this, but what is very curious is that the people behind it seem to want to hand the data back to Equifax in return for 600 bitcoins, roughly $2.6 Million at todays rate. They seem to be responding only to emails from Equifax employees and their stated reason for doing so is because of the Equifax executives who sold $3 million dollars worth of shares using insider trading. If they don't get their bitcoin, they say they are going to publish the whole database at that domain by September the 15th, so we have to wait and see. This darknet site raises a whole lot of questions though, why did they not sell the data sooner and why have we not seen the data appear for sale on the darknet markets, or have we seen it and not yet realized it? There is something very fishy about this whole thing, why are the perpetrators only willing to provide samples of the data they hold to Equifax employees and nobody else? Why not just sell the data on the open market? These are the immediate red flags that jump out at you right now, I will update this story with any new information as it arises. ? Let me know in the comments below! What do you think What’s that? You like the cut of my jib? Follow me on Twitter then and give me a CLAP using the clap button, you can clap more than once :) ** Please note that this article is in the public domain, reproduce it.

A Series Of Unfortunate Events or How Equifax & Fire Eye Threw Oil On The Fire

First FireEye, then SUNBURST, and after that, SUPERNOVA. Here's why the SUNBURST incident is more alarming than the FireEye’s hack. A security company that got hack is like a doctor who got sick. While everyone is talking about the , “SUNBURST" (or “Solargate”) is more dangerous, which is a cyberattack that required patience, skills, and new thinking. And in all that, it FireEye incident created a wound that we previously overlooked. After discovering the SUNBURST malware, was revealed by security researchers as another backdoor found in SolarWinds software. This malware is a web shell that SUPERNOVA allowed attackers to run arbitrary code on machines running the software's trojanized version. It is already on the news but mostly for technical people. I want to make a more friendly explanation to understand why it is alarming and, more importantly, how to prepare for the next attack. First, they are related. (and SUPERNOVA) is an advanced malware that compromised the Orion® Platform of SolarWinds, an IT monitoring software company, according to a . SUNBURST blog post released 13 Dec 2020 FireEye Wait, why FireEye was the one who released the information, not SolarWinds? In short, you can think of Solarwinds as the “upstream” of the attacks, while When FireEye Inc a well-known cybersecurity company, their investigators immediately try to figure out how attackers got past their defenses. FireEye is one of the “downstream.” ., discovered that they were hacked this month , It is believed that the discovery is by accident. The investigator realized that it wasn’t just FireEye who got attacked but also discovered a vulnerability in a product made by one of its software providers, SolarWinds Corp. Technical Background (Simple Version) According to deep-dive reports published last week by multiple security companies: FireEye Palo Alto Networks Fortinet Microsoft McAfee Symantec Kaspersky US Cybersecurity and Infrastructure Security Agency ( ); CISA On infected systems, hackers compromised SolarWinds’s Orion IT monitoring and management software with a trojanized version of “ SolarWinds.Orion.Core.BusinessLayer.dll.” These embed the SUNBURST malware. Hiding in was then downloaded by booby-trapped updates legitimate software via official update channels over 18,000 computers. Infected machines would collect information about the infected company’s network, then wait 12 to 14 days, and then send it to a remote (C&C). command and control server SUNBURST would when infected for validation: execute the following steps Machine domain name validation. It checks the domain name of the compromised machine to ensure: - It doesn’t contain certain strings. - It is not a SolarWinds domain. - It doesn’t contain the string ‘test’. It validates that no analysis tools, such as WireShark, are running. It also checks to ensure that unwanted security software is not running. As you can see, SUNBURST is malware with intelligence to . If all of the validations are completed, it calls “home” to the attacker and sends information to identify the breached organization. check if it could successfully bypass security measures There are victims across different sectors, such as cybersecurity firms such as FireEye and And the worst part is, the list is still growing. local governments, schools, hospitals, banks, and telecom companies. Like and , big tech companies also confirmed installing the trojanized updates on their internal networks. Fortunately, they also specified that they did not find any evidence of escalation from the attackers. VMware Microsoft From the quality of the threat design, the range of techniques used, and its victims’ nature, this was a for sure. The malware was thoroughly crafted and secretly embedded in upstream suppliers’ legitimate software to finally hack the high-value assets downstream. nation-state scale attack Implications I read reports after reports. These are, from a security design perspective, beautiful attacks. It requires dedications of years of studying of the targets (probably with someone working with/from inside), with patience to find a way to bypass the monitoring of security analysts and skills to hide the code from the developers. Conceivably the most alerting character of the SUNBURST attack was how it propagated itself by This is the perfect storm much more influential by today's security policy's . installing itself as part of SolarWinds’ regular distribution and update operation. automation and fast patching practices The problem of trust again, but in a different thinking Knowing what companies are the SUNBURST victims won’t help explain the extent of the damage done. As the scale of attacks are so extensive and involves too many heterogeneous IT infrastructures from various supply-chains. It does, however, highlight . the fundamental problem of trust Supply-chain attacks rely on trust between suppliers and customers. There is no defense customers can implement against a compromised vendor or supply-chain that transfers legitimate code or services that are, in fact, jeopardized. Regular measures, such as only work if the reference (upstream) isn’t ravaged. If you consider , it is solely a special case of that concept of a chain of trust (signing is built on trust). Though, is more resilient in its community's proportion and interest . checksums and hashes, signed code open-source software but still not immune to such attacks The Mitigations You and your colleagues are probably preparing for the holiday, security professionals should know that this will not be the last one, and hackers will not take Annual leaves. What is more important is to To achieve that, it is a good time for me to re-introduce the Security Mindset when talking about mitigation. learn from it and prepare not to be the next Solarwinds or FireEye. Technology Pillar medium.com Integrating Security Mindset with PPT Framework Reintroduction of The 3 Pillars of Security Concept FireEye released on Github that can identify the SUNBURST malware last week, including the Security Vendors are catching up, and most of them had already released counter-measures for SUNBURST. countermeasures Indicators of Compromise (IOCs) and MITRE ATT&CK Techniques. , with collaboration with GoDaddy and Microsoft, released information about a killswitch: In the statement from FireEye As part of FireEye’s analysis of SUNBURST, we that would prevent SUNBURST from continuing to operate. identified a killswitch This killswitch will affect new and previous SUNBURST infections by that are still beaconing to avsvmcloud[.]com. However, in the intrusions FireEye has seen, this actor moved quickly to establish additional persistent mechanisms to access to victim networks beyond the SUNBURST backdoor. disabling SUNBURST deployments To detect malware as such, we may need a dynamic analysis tool like sandboxing in dedicated isolation. But hackers also know about it and developed malware with sandbox-aware validations. It then becomes between offense and defense. a cat-and-mouse game The first and second stages of impacts could be reduced soon with the joined efforts from the communities. Yet, relying on tools and advanced technology is only effective DURING the incident. While I am in line with most security vendors, we need to develop more innovative PDC solutions ; But “Adapt” cannot be put out of the picture. (Prevent — Detect — -Correct) Adaptation helps us respond better next time. In Technology Pillar, as this time, software defects are already presented, the fixes can only be applied to the last attack. How to adapt to a more approving response to the next war is more valuable. That’s why we should shift our focus to the other two pillars. Process Pillar Hackers would try to get Vendors and Partners become the possible targets and as a new way to penetrate. Attacks related to the , reported by access to your company using the already established highways. supply-chain rose 38% since the start of the pandemic Bitdefender (A Security Vendor) . This, in fact, is a wake-up call for security professionals to see what is missing in the past truly. All update processes from vendors should be reviewed, and consider monitoring is in place. Trust between vendors should not be taken for granted. Automation and patching were originally incorporated in the best practice of security operations; efficiency becomes the weapon. Therefore, implementing into security designs become necessary. the concept of “Zero-Trust” it clearly: Palo Alto Networks presented The Zero Trust model recognizes that trust is a vulnerability . Once on the network, users — including threat actors and malicious insiders — are free to move laterally and access or exfiltrate whatever data they are not limited to. Remember, the point of infiltration of an attack is often not the target location. with the development for testing updates and patches should become the norm. Implementing change control in update channels for live files to maintain a higher resilience against external sources. Segmentation from a production network While is resource-demanding, no one will underestimate the importance of that after the SUNBURST. With careful selection of data collection points by focusing on trust, building a tracking system could not be as resource-hungry as traditional log collection methodology. keeping a tap on the trusted processes It is worth considering to reach out to the company’s ecosystem It is as essential as internal procedures to reassess key partners’ risk. to ensure both internal and partners are still meeting all compliance requirements. People Pillar The hackers understand well the IT infrastructures of enterprises and As mentioned in Technology Pillar, the SUNBURST malware was splendidly obfuscated, fastidious in its use of steganography and diversion layers. the psychology of developers and operators. It is why it can bypass layers of security defense in SolarWinds, from hiding from developers' code review to not triggering alerts in behavior analysis of the security operation team. As a result, SUNBURST will produce another round in . No one is immune does not mean we are hopeless. It just likes what we are how we handle the COVID-19. the arms race between hackers and cybersecurity researchers Giving you a pill to cure Covid may not help you prevent the variants, as the virus is mutating. To prevent infections are still the best way to minimize the impact. We thus introduce the concepts of social distancing, frequent hand-washing. We keep washing our hands over the fear of the deadly viral pandemic yet fail to do basic things to our cyber self like security updates and use strong passwords. Regarding cybersecurity, what we need is a new way of thinking and the introduction of “Cyber-Hygiene. Cyber-Hygiene Bringing up the awareness of the importance of cyber hygiene goes a long way. Until you get the security basics right, all the fancy and most advanced technology in the world cannot protect us from cyber-attacks. is no surprise to experienced security professionals. Keeping the attack vector at minimal, continuing education, full visibility to the system, and patching and updating… these are all the basics. This fundamentals-first strategy Meanwhile, we relied heavily on advanced threat detection tools, AI-assisted SOC indicating the usefulness of those techniques, but do not help remove the cybersecurity risks. To put it in simple terms, good Cybersecurity hygiene should be the real “Silver Bullet” that can dramatically reduce the risk of the weakness link in the picture (the people pillar) . Final words Before that, there were attacks such as . SolarWinds Orion infected software updates are only the most current examples of software supply chain attacks. NotPetya and Havex Adversaries and ransomware groups will not wait too long in mounting as they have many vendor targets to choose from. their own software supply-chain attacks Absolutely we need to that bring up security issues in the dynamic and conflicting cybersecurity environment. We need to rethink the reconsider the growth of automated, continual distribution and patch practices balance between friction-less continuous deployment and layered security with verification in mind. Not just in how to fight this war, but in . How to processes with a security mindset, from internal to the vendor and in the complete supply chain. designing for resilience model the chain of trust and verification To cheer you up at the end of this story, we all know that we have had to adapt and grow to overcome the new security problems at every stage in our evolution with self-correction capabilities. The best aspect of SUNBURST, or the latest SUPERNOVA incidents, which will become old news like the others over time, is a highly evolved real tragedy of substantial impact. As a cybersecurity professional, on the side of good guys, we have to evolve ourselves by learning from this cyber-attack campaign, which is well-planned with years of effort; we must devote similar resources to our defenses. Thank you for reading — Happy reading and preparing well not to be the next Solarwinds. To know more about SUNBURST, please refer to and . the official statement CISA Alert (AA20–352A)

Why the SUNBURST Incident is More Alarming than the FireEye’s Hack

Let's learn about via these 24 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Hacker News /Learn Repo 1. While You Were Weekending 2. Black Hat Hacking Forums Get Hacked: Possibly a LulzSec Attack Presently, the world of black hat forums appears to be engulfed in a series of cyberattacks. According to a Telegram channel, on 18th June 2019 it was reported that three leading black hat hacking forums were reportedly exploited, affecting an aggregate of over 260,000 hackers. From the disclosed data, it appears as though the creator of the aforementioned Telegram Channel has access to certain Ukrainian police files which may have led to the leak. 3. Hackers Are Stealing NFTs, and It’s Not As Easy as You Think Unfortunately, even though NFTs are relatively new, there’s already been an issue of hackers stealing non-fungible tokens. Here's a closer look. 4. Introduction to One Gadget: A Necessary Tool for Exploitation This post uses a concrete CTF problem to show you step-by-step how to find and execute a one gadget and eventually spawn a shell. 5. 7 Best Workflow Automation Software Available Online A business's success depends upon the amount of work its employees do. However, every employee has a priority list for their tasks meaning that certain tasks are more important than others. Unfortunately, this prioritization sometimes leads to them ignoring/rushing the smaller yet crucial tasks that are important to the smooth functioning of a business. 6. 3 Impressive Cyberattacks of 2020: What we Can Learn From Them When it comes to cyberattacks, everybody is at risk, whether it be big corporations, government bodies, small businesses, or private individuals. 7. How I Hit the Front Page of Hacker News 5 Times First, let me turn off your warning bells. 8. Why a YC Rejection Isn't The End of The World If you've been following tech entrepreneurs on social media channels, you've probably seen many people sharing their stories about getting rejected from YC—the famed startup accelerator in Silicon Valley. A few others shared their success stories, and the vast majority of applicants remained silent as the decision letters were rolled out. 9. EU Drafts Data Regulations for Voice Assistant Developers On March 2, 2021, the European Data Protection Board (EDPB) released Guidelines on Virtual Voice Assistants (VVAs) to protect users’ privacy. 10. How I Got 78 Criticisms on Show Hacker News for My Zoom Competitor Last month, I launched the app on Show HN. As a result, it got 82 points and 78 comments. Ranked in the toppest 10 of popular posts in a day also. Actually, we have pros and cons about it and people tend to criticize it more. Anyway, it felt so amazing that a lot of the people across the world visited my website and said hi to me. What an exciting moment! Today, I’d like to share how to develop and launch a landing page. 11. How Hacker News Home Page Got Us 300+ Stars on GitHub in 24 Hours Hacker News is said to be the Holy Grail for tech folks. There’s one thing that a company, startups in particular, wants desperately: RIGHT traffic for free. 12. Can you Hire a Hacker on the Dark Web? If you are here, you have probably heard about how to hire a hacker on the dark or deep web. Using regular web browsers, we can only have access to four percent of the net. The other 96% must be accessed through a unique browser, Tor. 13. MakeMySummary Software Update:  June 2020 We recently released an update for MakeMySummary. The following are the highlights of the update. 14. How I Made My Side Project Going Viral on Hacker News In December 2019, I finally decided to kill my side project after 12 months of coding. It was a tough moment, I felt disappointed and angry. 15. Analyzing 110 Million Comments from Hacker News In this article, we’ll observe another test with1.1M Hacker News curated comments with numeric fields 16. DAOMaker and Eminence Included in The Biggest DeFi Hacks of 2020 Decentralized finance (DeFi) was created back in 2015, when the pioneer application, MakerDAO, allowed any crypto holders to take out loans in the DAI stablecoin. Years of steady growth followed and a palpable buzz around DeFi started to emerge in the crypto community, leading to the breakout year that was 2020. 17. 22 Internet Stories From Hacker News, and Beyond! This is the first weekly list of top content collected from hacker news and other sources about tech, science, privacy, and other interesting news. 18. Houston, We Have a Pizza Robot And other very important tech news from today. 19. A Guide to Staying Safe on the Internet Now, more than ever, we must remain vigilant of the evolving threats brought about by cunning and mischievous hackers. 20. From Idea to MVP to Hacker News in 44 Hours A day by day account of how I went from initial idea to coding and releasing my new app in 11 days, culminating in a Hacker News post. 21. 17 Best Animation Software for Beginners in 2022 Looking for the best animation software for beginners? You are at the right place! 22. Collecting Data from 1.1M Hacker News Curated Comments In this test we use the data collection of 1.1M Hacker News curated comments with numeric fields from https://zenodo.org/record/45901. 23. How A Week-Long Project Took Me To #2 On Product Hunt and The Front Page of Hacker News The month of May has been a fairly crazy one. It started out like any other, with me trying to come up with a decent, catchy name for my latest side project that still had an available domain name associated with it. Since it was a tech-related startup, I was considering top-level domains (TLDs) like .ai, .io, .co, and .com. 24. Why the SUNBURST Incident is More Alarming than the FireEye’s Hack Why the SUNBURST incident is more alarming than the FireEye’s hack. Thank you for checking out the 24 most read stories about Hacker News on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

24 Stories To Learn About Hacker News

132 Stories To Learn About Information Security

108 Stories To Learn About Cybersecurity Tips

219 Stories To Learn About Cyber Security Awareness

85 Stories To Learn About Cyber Attack

There was a computer virus that was created back in the year that was known as Shamoon or W32.DistTrack if you want to go with the technical name. What does this particular computer virus do to systems in order to try and cause some damage? 2012 Well, this particular computer virus was literally created to target 32-bit NT kernel versions of the Microsoft Windows operating system - hence why the more technical name includes ‘W32.’ This virus was particularly notable because it would not just attack the operating system, but it would be able to spread to other computers on a network. Once a system is infected by this particular computer virus, the virus continues to compile a list of files from specific locations on the system, upload the list to the attacker, and then erases a lot of the files mentioned. In fact, this particular virus is interesting because it was specifically to erase and overwrite data that is stored on the hard drives of the computers it infects with corrupted images. designed This particular virus also has a logic bomb that would trigger at a particular time that was designed to have the malware trigger. The virus was originally created for attacks against national oil companies including Saudi Arabia’s Saudi Aramco and Qatar’s by hackers who targeted the Saudi government & provided this message during the attack: RasGas We, behalf of an anti-oppression hacker group that have been fed up of crimes and atrocities taking place in various countries around the world, especially in the neighboring countries such as Syria, Bahrain, Yemen, Lebanon, Egypt and ..., and also of dual approach of the world community to these nations, want to hit the main supporters of these disasters by this action. One of the main supporters of this disasters [ ] is Al-Saud corrupt regime that sponsors such oppressive measures by using Muslims oil resources. Al-Saud is a partner in committing these crimes. sic It's [ ] hands are infected with the blood of innocent children and people. In the first step, an action was performed against Aramco company, as the largest financial source for Al-Saud regime. sic In this step, we penetrated a system of Aramco company by using the hacked systems in several countries and then sent a malicious virus to destroy thirty thousand computers networked in this company. The destruction operations began on Wednesday, Aug 15, 2012 at 11:08 AM (Local time in Saudi Arabia) and will be completed within a few . hours Then there was a message that references a portion of the malware and how it was able to mess with the systems in various ways: mon 29th aug, good day, SHN/AMOO/lib/pr/~/reversed We think it's funny and weird that there are no news coming out from Saudi Aramco regarding Saturday's night. well, we expect that but just to make it more clear and prove that we're done with we promised, just read the following facts -valuable ones- about the company's systems: internet service routers are three and their info as follows: Core router: SA-AR-CO-1# password (telnet): c1sc0p@ss-ar-cr-tl / (enable): c1sc0p@ss-ar-cr-bl
Backup router: SA-AR-CO-3# password (telnet): c1sc0p@ss-ar-bk-tl / (enable): c1sc0p@ss-ar-bk-bl
Middle router: SA-AR-CO-2# password (telnet): c1sc0p@ss-ar-st-tl / (enable): c1sc0p@ss-ar-st-bl Khalid A. Al-Falih, CEO, email info as follows: password:kal@ram@sa1960 Khalid.falih@aramco.com security appliances used: Cisco ASA # McAfee # FireEye :
default passwords for all!!!!!!!!!!
We think and truly believe that our mission is done and we need no more time to waste. I guess it's time for SA to yell and release something to the public. however, silence is no solution. I hope you enjoyed that. and wait our final paste regarding SHN/AMOO/lib/pr/~ angry internet lovers #SH

Shamoon: The Modular Computer Virus Created in 2012 to Attack Big Oil

As the world becomes increasingly digital, nearly every company is looking for to code—no matter the industry. The phenomenon has been great news for software engineers and programmers who can now command high salaries for their hot, in-demand talent. software engineers Perhaps it is no surprise that software engineers in the San Francisco Bay Area, home to Silicon Valley and its many tech giants, can command an even higher premium with their pay packages. According to the more than 5 million verified professionals on the professional social network Blind, these are the top 17 best-paying cities for software engineers in the San Francisco Bay Area. Blind considered the annual base pay and the total compensation package, including the annual salary and any stock-based compensation or bonuses a company might offer. 1. Los Gatos, California n: $500,449 Average Total Compensatio : $475,000 Median Total Compensation : $470,015 Average Salary : $451,000 Median Salary Los Gatos is the best-paying city for software engineers in the U.S., according to Blind. The small town is home to Netflix, which prefers to hire more senior or experienced professionals and pays accordingly. The video-streaming giant typically pays large salaries and gives few employees stock-based compensation. 2. Menlo Park, California : $328,423 Average Total Compensation : $297,000 Median Total Compensation : $167,004 Average Salary : $165,000 Median Salary Menlo Park might be home to only 34,000 people, but its population can swell in size with tech workers during the workweek. Menlo Park is home to the headquarters of Meta, the owner of Facebook and one of the highest-paying technology companies. Google and Roblox were also founded in the city. 3. Cupertino, California n: $279,391 Average Total Compensatio : $255,850 Median Total Compensation : $165,753 Average Salary : $165,000 Median Salary Cupertino is home to Apple and its futuristic Apple Park corporate campus. Software engineers at Apple have enjoyed large paychecks recently, as the iPhone maker briefly topped a jaw-dropping $3 trillion market cap early in 2022. 4. San Bruno, California : $278,368 Average Total Compensation : $225,900 Median Total Compensation : $161,269 Average Salary : $149,500 Median Salary YouTube moved its headquarters to San Bruno in 2007 and has become the city’s largest employer. The Google-owned video streaming service employs more than 2,000 professionals. 5. Mountain View, California : $275,181 Average Total Compensation : $242,000 Median Total Compensation : $160,790 Average Salary : $156,000 Median Salary Mountain View is synonymous with Silicon Valley. Long before startups were birthed in San Francisco Bay Area garages, the city was home to silicon semiconductor producers, which gave the region its name. Of course, the city is now well-known as the headquarters of Google, but other tech companies with prominent presences include 23andMe, Intuit, Mozilla and Synopsys. 6. Oakland, California : $266,869 Average Total Compensation : $197,750 Median Total Compensation : $192,240 Average Salary : $168,750 Median Salary Oakland has become a hub for many financial-technology companies. Credit Karma moved its headquarters from San Francisco to downtown Oakland in 2020. Block and Marqeta also have major offices in “The Town.” 7. San Francisco, California : $265,050 Average Total Compensation : $225,000 Median Total Compensation : $165,042 Average Salary : $160,200 Median Salary San Francisco might be the crown jewel of the technology industry, as the home of too many tech startups and companies to count. The city by the bay is home to Airbnb, DoorDash, Lyft, Twitter, Uber and more, but its top employer is . The cloud giant employs more than 9,000 employees, and its headquarters has made a permanent contribution to the downtown skyline. Salesforce 8. Sunnyvale, California : $260,048 Average Total Compensation : $238,000 Median Total Compensation : $160,499 Average Salary : $160,000 Median Salary Sunnyvale maintains its Silicon Valley roots as home to the chip-maker AMD and advanced technology and networking companies, including Juniper Networks, Microsoft-owned LinkedIn and NetApp. 9. Palo Alto, California : $234,739 Average Total Compensation : $200,000 Median Total Compensation : $157,488 Average Salary : $154,000 Median Salary The tony city of Palo Alto is one of the major cities of Silicon Valley. Cloudera and VMware are some of the largest technology companies based in the city. 10. San Mateo, California : $234,066 Average Total Compensation : $187,875 Median Total Compensation : $158,629 Average Salary : $155,500 Median Salary Companies that call San Mateo home include Coupa, Roblox and Snowflake. Before being acquired by Zendesk, Momentive, which was founded as SurveyMonkey, was headquartered in the city. 11. Pleasanton, California : $225,058 Average Total Compensation : $202,000 Median Total Compensation : $150,887 Average Salary : $150,000 Median Salary Pleasanton is home to many business parks, but the suburb’s top employer is the HR-technology giant Workday. 12. Foster City, California : $220,293 Average Total Compensation : $190,000 Median Total Compensation : $158,319 Average Salary : $148,500 Median Salary Foster City is the headquarters site of the biopharmaceutical giant Gilead Sciences and the enterprise software company Zuora, among other companies. 13. Fremont, California : $218,913 Average Total Compensation : $180,000 Median Total Compensation : $144,638 Average Salary : $142,500 Median Salary Notable companies with headquarters in Fremont include Corsair, Synnex and more, although the city’s No. 1 employer is Tesla. 14. Santa Clara, California : $214,168 Average Total Compensation : $197,000 Median Total Compensation : $153,885 Average Salary : $150,000 Median Salary AMD, Intel, NVIDIA and Palo Alto Networks are some of the most well-known tech companies headquartered in Santa Clara. 15. San Jose, California n: $210,801 Average Total Compensatio : $183,000 Median Total Compensation : $153,390 Average Salary : $145,000 Median Salary The largest city by population in the San Francisco Bay Area, San Jose is home to Adobe, Cisco, eBay, PayPal, Zoom and more. 16. Redwood City, California : $207,955 Average Total Compensation : $190,000 Median Total Compensation : $156,248 Average Salary : $151,000 Median Salary Redwood City is the headquarters location for several global technology companies, such as Box, Carbon, Electronic Arts and Informatica. 17. Milpitas, California : $188,146 Average Total Compensation : $165,750 Median Total Compensation : $154,073 Average Salary : $138,000 Median Salary Some of the top employers in Milpitas are tech employers, including Cisco, FireEye, SanDisk and more. Methodology Blind analyzed the base salaries and total compensation of software engineers in the San Francisco Bay Area on its platform. Cities were ranked by the average total compensation, including annual base salary and, if applicable, stock-based compensation and cash bonuses. All data is self-reported by verified professionals on the professional social network Blind. Also published on Teamblind's blog

17 Highest-Paying Cities in the San Francisco Bay Area for Software Engineers

Las 17 ciudades que mejor pagan en el área de la bahía de San Francisco para ingenieros de software

17 villes les mieux rémunérées de la région de la baie de San Francisco pour les ingénieurs logiciels

सॉफ्टवेयर इंजीनियरों के लिए सैन फ्रांसिस्को खाड़ी क्षेत्र में 17 उच्चतम-भुगतान वाले शहर

ソフトウェア エンジニアにとって、サンフランシスコ ベイエリアで最も給料の高い 17 の都市

17 cidades mais bem pagas na área da baía de São Francisco para engenheiros de software

17 thành phố trả lương cao nhất trong khu vực vịnh San Francisco cho các kỹ sư phần mềm

旧金山湾区软件工程师薪酬最高的 17 个城市

The word ‘unprecedented’ has been used a lot over the past year, and with good reason given the huge impact of COVID-19 on societies and businesses around the world. Alongside the global pandemic, there was the volatile and bitter U.S. election and Britain’s departure from the EU: and to add to the disruption, 2020 also saw the discovery of a cyberattack that was truly unprecedented in its sophistication and scale. On December 8, 2020, the cybersecurity company FireEye revealed to the press that they’d been breached by an APT (advanced persistent threat) group and had some of their ‘white hat’ cyber assessment tools stolen. In the following days, Microsoft, SolarWinds and even the US government revealed that they’d all experienced breaches that were traced back to a hack on SolarWinds’ core IT management software. The APT group had added a backdoor known as ‘ ’ to the SolarWinds Orion system which was then distributed to SolarWinds customers globally, hidden in what appeared to be a routine software update. This backdoor gave the APT group access to thousands of SolarWinds customers’ networks, enabling them to explore those networks under the security radars of the organizations’ security teams. Sunburst Cooperating fully, SolarWinds shared documents revealing that more than 18,000 customer organisations had downloaded the compromised Orion software update, including hundreds of Fortune 500 companies. However, while the hack itself impacted thousands of companies across the US, Europe, Asia and the Middle East, the threat actors involved seemed focused on targeting leading technology companies, government agencies and consultancy firms. Those targeted victims included , from Homeland Security to the U.S. Treasury, and more than 100 private companies including Intel, Cisco, Microsoft, and Belkin. several US departments of state Reports also recently emerged that the ATP group responsible involved Russian hackers who launched their attack from within U.S. borders in order to cover their tracks and complicate efforts to investigate their activities. In a , more than 2 months after the incident, the U.S. deputy national security advisor said that investigators were still in the “beginning stages” of understanding the scope and scale of the attack. Microsoft president, , also spoke out, calling the hack the “largest and most sophisticated cyberattack ever.” press conference Brad Smith Understanding the attack So how was the attack constructed and executed by the threat actors? What we currently know shows that it involved top-tier cyber-capabilities and must have been months, if not years, in the making. How SolarWinds’ networks were first breached is still being investigated, but one is that the initial phase involved hacking the company’s Office 365 accounts. This enabled the threat actors to gain access to SolarWinds’ internal network, then move laterally to the cloud to steal sensitive files and credentials. They could then forge a token for a highly privileged account in the Azure Active Directory and gain admin privileges using those stolen credentials. prevailing theory What makes the SolarWinds hack particularly dangerous is that it leveraged cloud-based services to orchestrate a supply-chain attack. Because access to those services was obtained via authentication systems based on already-compromised networks, the attackers were able to breach companies’ defences without raising any alarms. The current trend toward cloud migration and digital transformation sees countless businesses adopting a hybrid approach that combines cloud-based and on-premise networks. The SolarWinds hack is designed to exploit this hybrid vector perfectly, meaning that a huge number of businesses globally are potentially vulnerable.  Check Point first predicted these types of multi-vector, fast-moving, large-scale Gen V attacks two years ago, and they are hitting organizations globally more frequently than ever before. Building stronger security links Supply-chain attacks such as the SolarWinds exploit show just how insidious and damaging these ‘unknown unknown’ threats can be, where no-one is aware of the flaw apart from the attackers who are exploiting it.  To prevent future attacks, organizations need to ensure that they employ the basic core security practices of endpoint protection, email security, least-privilege access and network segmentation across their infrastructure, to make it harder for adversaries to infiltrate networks and move laterally within the organization to access critical assets. Organizations also need to deploy defense-in-depth, ensuring that multiple protections operate in harmony to identify and prevent different attack vectors in real-time, such as blocking command and control traffic as well as exploits of vulnerable elements.  It’s critical that organizations have holistic visibility and automated protections in place across their entire environment, including their on-premise networks, SDN and public cloud deployments, because the old cliché still apples:  a chain is only as strong as its weakest link.  If organizations cannot identify when a weak link is being targeted, then they risk falling victim to an attack. Find out more about the Sunburst attack and the threat of similar supply-chain attacks in . Check Point’s new 2021 Security Report

Stories, News & Mentions about FIREEYE

Fireeye’s Stories on HackerNoon

Fireeye's News & Mentions