Cyberleaf provides complete cybersecurity protection for businesses of any size via a subscription model, utilizing a range of integrated cyber protection tools and services.

Cyberleaf

Cyberleaf | 932 followers on LinkedIn. Managed cybersecurity services simplified for MSPs and small/medium enterprises | Cyberleaf is enterprise-grade cybersecurity for businesses of any size at a fraction of the time, cost &amp; complexity of DIY &amp; outsourced models. 

Our Cybersecurity-as-a-service (CaaS) approach is distributed through MSPs and supported by our professional services that are designed to help our clients effectively meet their regulatory &amp; security requirements.

CEO Waterleaf International LLC

Adam Sewall

EVP - Waterleaf International LLC and Cyberleaf

Marshall Howard

Taylor Treese

Director of Channel Sales I MSP Cybersecurity Growth Leader

Jonathan Meyn

#Cyberleaf touched down in Orlando at #ITNation24 ! Check us out at booth #264!

A new LightSpy version is out and on iPhones allowing access and compromise. “…Cybersecurity researchers have discovered an improved version of an Apple iOS spyware called LightSpy that not only expands on its functionality, but also incorporates destructive capabilities to prevent the compromised device from booting up…” Unlike Pegasus and known variants LightSpy has capabilities to delete, corrupt and replace files on the target/victim phone. BLUF Seen in Hong Kong over 4 years ago this new variant has added capabilities “…can delete media files, SMS messages, Wi-Fi network configuration profiles, contacts, and browser history, and even freeze the device and prevent it from starting again. Furthermore, LightSpy plugins can generate fake push notifications containing a specific URL…” Uses a know webkit vulnerability May be a for hire toolkit Can be used on mac OS and Android exploits as well Can run on newer iOS versions up to 13.3 The C2 is identifiable and can be blocked with proper PDNS https://lnkd.in/eGAM_aXk How to defend: Update always to latest OS – yes battery life might suffer lol. Use a smart/active PDNS – free ones are out there for personal use. Connect when you can through a corporate firewall with active monitoring on the FW and network. Conclusion – credit to Threatfabric The threat actors behind LightSpy closely monitor publications from security researchers, reusing newly disclosed exploits to deliver payloads and escalate privileges on affected devices. However, using "1-day exploits" (exploits disclosed publicly) provides only a short window for attackers to target victims, without guaranteeing a successful takeover. Typically, security researchers follow a responsible disclosure process, publishing details only after vendors release updates to the majority of affected devices. This allows most victims to update their devices before attackers learn about the vulnerability. Unfortunately, this process isn't foolproof. Some users, particularly in regions like China, may not receive updates due to restrictions from the “Great Firewall,” leaving them vulnerable until they can access a new device with an updated iOS version. A notable feature of LightSpy iOS is its destructive capabilities, - wiping the contact list or disabling the device by deleting system-related components. This suggests that the threat actors valued the ability to erase attack traces from the device. Interestingly, only one control server contained these destructive options, while others had a more limited feature set. This may imply that the destructive features were a "demo" intended to showcase capabilities to potential LightSpy customers. Finally, an interesting observation was found in the location plugin. The plugin contains a function that recalculates location coordinates according to a system used exclusively in China, strongly indicating that LightSpy operators are likely based in China.

Interesting attack into Russia per a Kaspersky report on X https://lnkd.in/eD2cvRHs the APT hacking group Awaken Likho launched a new attack campaign this summer targeting Russian government agencies and industries. “…Active since 2021, it has recently updated its toolkit and has replaced UltraVNC with MeshAgent, an open-source remote management tool. Additionally, the group is using AutoIt in the attack chain…” Key take aways: This is a phishing exploit utilizing targeted reconnaissance. This exploit takes advantage of vulnerabilities in the Mesh Agent a legit tool that remotely manages endpoints by connecting to an open source remote management server called MeshCentral. Users can install MeshAgent on Windows, Linux, macOS, and FreeBSD endpoints. It is primarily used by IT admins to remotely control and support multiple computers networks.… but to be candid this is like some of the RDP take overs and access that have gone on for years. And, this is a bit surprising as the MeshAgent vulnerabilities are fairly well known meaning into and through Mesh Agent. Also the use of AutoIt is well known as part of TTP’s so it seems that whomever was caught may have been missing some basic cyber defense…just saying. Be safe out there!

DOJ and the Dutch go after Redline. Redline run by Russian national Maxim Rudometov was indicted this week by the DOJ/FBI as part of an international program to respond to Redlines years long attack on the US government and others. “Prosecutors said Rudometov has been a key part of the Redline infostealer operation, describing it as being "one of the most prevalent infostealers in the world that has targeted millions of victim computers," as well as Meta, which is described as a "closely related" infostealer also designed to infect Windows systems.” BLUF: The info stealer worked off of browser extensions, Chrome Store URL’s and other bots that can and did exfiltrate data including passwords, usernames, bank accounts, crypto addresses, credit cards etc etc. These bots have been successful in penetrating DoD accounts, contractors, the US Army’s O-365 environment and more. Dutch investigators have infiltrated the servers and shut them down as well as the C2 has been shut down. Rudometov however is still presumably at large in Russia. Background: This was the result of a large international task force “…The DOJ said its investigation into Redline was aided by private industry, including an unnamed firm voluntarily disclosing to the government details it obtained from a licensing server used by Redline. "Investigators obtained a search warrant to analyze the data in the server and found additional evidence linking Rudometov to the development and deployment of Redline," according to the complaint. The U.S. task force has been working with Operation Magnus, a Joint Cybercrime Action Taskforce - or J-CAT - coordinated by Europol, which is the EU's law enforcement intelligence agency. Other participating agencies include the Dutch National Police, Belgian Federal Police, Belgian Federal Prosecutor's Office, Britain's National Crime Agency, Australian Federal Police, Portuguese Federal Police and the EU Agency for Criminal Justice Cooperation, aka Eurojust…” From data breach today. https://lnkd.in/etHGbS5C Contact us for security architecture and services. Be safe out there!

Link with "The Leaf" at IT Nation Connect 2024! https://lnkd.in/g5PFJ3Uj #cybersecurity #defenseindepth #itnationconnect2024

There's no easy answer to Cybersecurity! #Cybersecurity #MSP #defenseindepth

🌐 Join Us at OzSec 2024 This Week! 🌐 We're thrilled to announce that Adam Sewall, Cyberleaf CEO, will speak at this week's Cybersecurity Conference OzSec 2024. 📅 His topic? "Why Cyber Defense Fails." This insightful session will dive into the challenges and pitfalls in current cyber defense strategies and reveal how to fortify your security posture against evolving threats. Don't miss this chance to gain valuable knowledge from a leading expert in the field. See you there! 🔐🛡️ Registration: https://lnkd.in/eN8VqzC3 #cybersecurity #defenseindepth #cybersecurityconference #ozsec2024

"...Chinese researchers break RSA encryption with a quantum computer..." As reported in CSOonline a recent paper claims cracking of RSA encryption as well as attacking algorithms crucial to the Advanced Encryption Standard (AES), including Present, Rectangle, and the Gift-64 block cipher. I have been writing about this for some time and specifically the abilities to cobble together disparate algos for the sake of an attack on secure encryption keys as stated in this paper. This is a recent announcement and one that should give all CISO/CIO's and others pause as they consider the most effective Post Quantum Cryptography (PQC) choices. "In a potentially alarming development for global cybersecurity, Chinese researchers have unveiled a method using D-Wave’s quantum annealing systems to crack classic encryption, potentially accelerating the timeline for when quantum computers could pose a real threat to widely used cryptographic systems. Published in the Chinese Journal of Computers under the title “Quantum Annealing Public Key Cryptographic Attack Algorithm Based on D-Wave Advantage,” the paper outlined how D-Wave’s machines were used to break RSA encryption and attack symmetric encryption systems, raising serious questions about the future of cybersecurity." https://lnkd.in/eY-dSqF8 We will do an in depth analysis on this paper and look for peer review and reproduction of the techniques to see if the utilization of the D-Wave Quantum Annealing algos combined with other methodologies can be effective as stated. See our website for PQC/NIST and other recommendations. Be safe out there!

A recent vulnerability on Nvidia can allow extensive vulnerabilities for exploitation. While we have not seen this yet disclosed in public forums the information from NIST and MITRE warrants actions to mitigate these vulnerabilities. The NVIDIA Container Toolkit allows users to build and run GPU accelerated containers. The toolkit includes a container runtime library and utilities to automatically configure containers to leverage NVIDIA GPUs. Links to NIST and MITRE are included below. “…NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering…” https://lnkd.in/ej-apNmw The ability to delete files such as log files is concerning due to IDS and SIEM technology that is directed by log files. The following from MITRE delves into the vulnerabilities and exploits so far. This is a work in progress and we will post more as this is discovered. Utilizing a Defense in Depth that has multiple layers of awareness and observation can mitigate such. Contact us for more information as well. Be safe out there! Common Consequences Technical Impact: Alter Execution Logic; Unexpected State The attacker can gain access to otherwise unauthorized resources. Technical Impact: Modify Application Data; Modify Files or Directories; Modify Memory; Other Race conditions such as this kind may be employed to gain read or write access to resources which are not normally readable or writable by the user in question. Technical Impact: Other - The resource in question, or other resources (through the corrupted one), may be changed in undesirable ways by a malicious user. Non-Repudiation Technical Impact: Hide Activities If a file or other resource is written in this method, as opposed to in a valid way, logging of the activity may not occur. Technical Impact: Other In some cases it may be possible to delete files a malicious user might not otherwise have access to, such as log files. https://lnkd.in/ekE-trEv

CYBE

IO:CYBERLEAF

Cyberleaf