Hello, welcome to the Friday, July 9, 2021 edition of the Santonet Storm Center's Stormcast.

My name is Johannes Ulrich, and then I'm recording from Jacksonville, Florida.

Ever needed to give your Python scripts more cranial access to elevated privileges? Well, Sudo, of course, is available on

Unix systems, but by default, Sudo does not usually enable its Python interface. So, Xavier put

together a brief diary describing, first of all, how to compile Sudo with the Python interface enabled and then

how to use it in your Python scripts and take advantage of Sudo's ability to allow elevated

privileges for fairly specific tasks.

And of course, like always with Sudo, be careful how you configure it.

It's often easy to assign privileges that really do more than you expect.

And these last couple days when I talked about Kasea and some of the detection tools that

were distributed, I always mentioned be careful where you download them from and make sure that they are authentic.

Well, it looks like the bad guys as expected are taking advantage of this event and there are a couple of

security companies, among them Malrabites, reporting that they are seeing some emails that are distributing fake security updates.

They're pretty rudimentary done in the sense that there are simple emails with attachments

or in some cases links to websites offering a patch for Kasea and of course what you're getting is not a patch instead you're getting additional malware like for example Cobalt Strike

Not really sure if any Kasea users will actually fall for this. This looks a little bit too obvious these emails that I've seen

But better to be aware and you never know what your users

will click on.

And Kaspersky is reporting that they are seeing a malware campaign that they are calling

wild pressure to spread out onto a Mac OS. Typically, it's spreading on Windows. It's a compiled

Python script, but later versions of this particular Malaver are now checking whether or not

they're running on MacOS and then will adapt themselves in order to support Mac OS.

...