y_F8W!IBIR uFe[^eJ3L'so~T*zpPRGi/(8MN;WiVOr!+(_i+q'XbɯQrV~͜I;y8d5Gr}vY &hN|: 95<k|.1JFW`v0I4> >r:aޗdu0K8H?X*FRح Va2ON~wڲfVfe>vF-l-JX&sߘ h|m-DZnTުr>|}4Oo+׾s oˮ~|Uξz{8?zs> cf1?'ћŬLKm<=:?-(ͧk[PWفFQ7j{QnȂ)9 5.guo^f4Y>͎ogI{Q o󣧹=z{dGGǧ(w{Um}ߝ"`_Sl=Uv/arJ=O׾0~t:yZAĝ `kc*`hlקcͣ܎FӃE~duM͙Z:k;~xzxjo⷟Z9C뢬Tٮf+HսZrSs `y cd+0N0Dv.>-_vܑ@1?/WI=-\Nn8%C G~^q{egŬ.j73 R9FU=:` 8 |izu*  ̕ ^JK\%~Zo"?Ujg{{Λa'orz O,D92hiڳ[x*gosU6VZf.NePD|wi\ζ{뷋IWщN}`pr@қ~{?*sT8_MI**ur1ovim˧&s{b]-U+m/At_Aet̯7ɞI>Vje@ymt7[w={j+B~/7utD-GKr&߿o2SiZWl/ޞF\YnuNus8?ܪG壋z̕{_Ej1MΫ *+d?Εc󯎎ܹ_?*r S-n~^URo|biZ>Jm7r ILR[p~`ςkZvKgaEtl7rpNjjOJpgmu2yW[vPvʈ_}soqE "(%X/ӏ`s˫,6 \?~Sq+ f7<*@'߿՞ηO3)Ukcy @-*tN*Z\ǹU#Tpg`T\):??o SΣ(_]8qz]njdA>E\z09i-OO|r>HwxEq A^ׯT@9Zv3 %|zp#}ܒ5=Wo\v !/2N΀u|]<[9sC"<.{gK~.|z}^\=|VgSXŋ1;TtqQ ٙ|'l}|ʞV ~]C:T_~3]z2טOߨP$x˾k>xi/|ykޞ'5vί)u;8j7;9d]䌐7QRn//9m zl8Ig͖%$#.,n*^Rp`:HӽE1`w ܱzav`U[> k{HBp"(|iE9 KjteTU0v[p{g H!0xYNR$@҅# x*{`h#3ts*N ѥq}*A(tsIiZ9x{x*:xcr9-'jRlzTX68KvrlOKj =yFyI$?EAm[t:o>#D9nOE9 d/NsY ȏBQ~ppH>#/L>;Ǝ$i̟_ v-{U|f3r ~wdU"BFp6TL!<d?dΠAYS7OTRސo6 MK@ ŗ77[T/8CnF]V ZD(ri).#AGQG`1}OU]?{H n 0򘼁ɳ[^?U|KAlEK12q;C̡asR-l/5ٛ_yz=>FwU0)A9-!\)"_3 @AW|NE-xIX-dISh~F)&obyھ=WJc*08_ɹ\2ϾFmI J3ͫv@H` sh%trB oR]_]g n?Py]uz)N''xV<9? Pdǀ&k/udcd;\ n>3܊k>r +_'Sd=Y2_Llz0x?``@*g] '7"D0 `Gjp*X|`yg/_w<\#ોpJ@+ݷ{+ii^}BCJp&c@wWnp՝PxZ#GkAF&rA0lbh ݿ+?1qlU&ZF)Ih} ћ&V.WR1.8=MDt3"h'*{upM:{ݟF!Ww6 >vAUR<[;Adh4']$i`!XȿBfa!@fV}WNEFciI5:Eh4b06":\C M5dmze ʼnPDhؽ^FקHyN.D[| +4*:PՓY(ʉ+kgBkf? f&@#SohQ+@!&;|QZ77׮=p71.c~;>$ˎҽy=C*{/@;s<)؃6 @6H[*P]WO{GQ;LW/rG{ܳ^EoGKȥZ"&~NlZ}D]5B/OyxEB3,<]lrf@Xw.?}P! 2! ~H#@mGz. TbwE, &[N@|pD萀69y wq䎏O6ZEtv{ɄNLcXLjfhyhnbMםb4BxvJAdϿÿUG봐82zUƺMA#` xj1T沦~%({XBpHPOdx5g 61t6ӳkBŬr>nwg?!; ïH|9 ۝^oжE*;jq%Z5Hj{:!doژxxc$\0SjR.y+ $:{} 8_p_~OLt\C<{tɎJw"q?rhK QET^`&q)B7&;l>,Fh _tgO__*/ aw /@qΪB.X԰+ۛazQvpQ{߿a|W~8VnŇὪN/Ztu0|zW\Y_m654-ۣ{_図Hb?V?|mU?֝|{~&ؿ*zZYož},~{Wm5[;6~rt}._ڞZirrjٸpy䞽} Uox]kÇssE:8bn+Iz9 ѧpuw/ pUɺnPg6}'XK.\O}z}wtq7[Z90rośꃽuOΗSQ7//+o?m[Mon6oVi;n  eY=X~q/=ݷ3ك5WzOc/89~KE/fk߿;6jq'՗G3;8wlA|gWp>W?R>zqt}[=}_[c9"~+W߾_97wg??^~|^_MJ vUپm|E~տʗ}ϳǫG_Jo{|5{|km:<\)`EyFԣOwOGWvZ}SnoݍlWIz<|)aћǻ4gj{-(o\q *077mZ~,t]*nׇ_foi%~Zۧ]vtUl.~ɇOڋۻ7՛?G1mC#^t;wʷֱwۧ7P5jϽhiܳ6j|V/[In/>Mq[&~\衳|Zԃw"9.nկ^}Qϗշ-杷VE:r/{7˳u]{gEzTV헶l:zǯW~ 旯vv'bw&7CKu~=&fKe|mr4_mCcUk?ų73k0< W;ʯVZC|Tz ~Ti,8SN+v[uY_Xnrٻ.;C'/ct0<-ˉ57_o?_UlmcYAz===ǫ3eok}ro"?_?}'nWg:ܿ{koZpUYݷ/JruNK|q/?<y8rLf+{AwuYQ[w>Zw{n{ݙP|Ov[SKex)WxZ?6o?ַG}Syvj>ߎ6oWWq;*^\Ϗcc8ԇzx΂4xj{>o+{ʧm` ?]hЯ/{?U!y鍣*mK{&vv~{muߧ{ZjqAOYK=>|׺W/żuX= N|}+_7o}Sc]{}RY/{O 8y8|%W+[ $=pnKou`?w7nӧquY>:WoVw{WCkxANB?{HY}l 7W=X}+g73q_ďoë\yqqO G{?5*3rQ9M{u^~ݻ}\6.=m_4NnR^ ó헛Ż7O{3[OWo7wgύ/w۫Wipr|pE~;{s.c_}~\eo?] O?jLhzuxvjx}*+pmoӷU{cxt:o~v]Cwjoe 8u[^CcM~3W?U>?\JgCݫmn./o\|V?=<^~9]ꀨU+߮MէoK@Au6[༻f>iL`U{a{x{V^=o^=}XT>k~j-X_Zn.,axXԧ:#>}7ه=|Z}Rսq[\:7Wo~ڞVw˳٧ۏ_/|wpuzz^||Tm8F?˧j~px:~b?]|?&^)QWd ,L3iK\Z Y2 ,|ֻ `hJ l5$ۯM>0pѫ8̣\Q APɌ)q#MHJ  @˶xzqGa m92`F- ge˄H4f5SVԒekii˴3P.es(d" ?L׿q=7=:-tl؞}4|(/:@~;*qlOrϣBeB鞠Ɣtﯗ $PT]=%<gL?~;:]0TbksQ>ϯa-v.O]4?lC}Nsc?nՑL/m{W;msS=0=D r-c3M Bu~ˎR2߻=87XSόP ?ðsB }oowS2 [owq{% f@( 'comB/1EbB?yv SEEs;cn|\Lg8"ĦppEEj]\?yvǼny+Z(d_~abwb>{cT6ձ}K_[Հ/kkwܢc!1נ9 9/ `}.oE_ ޖ`dz:RJiTTϏYwAY.Bг!ja"0ʂPEqp Rvg=0jѻ^sK= my;u rWQkox3X9g'2BK]N!2|""}~c ̅%E3 =/1f">v؇Yp#v120 @5A5~8Er,BlW@fZDmKCk`8 /#'ˑ j0W qZ޸r<Ǒx}cuoλ9JD?E77^0~!j qX}̌w(|ƊV_Avc6Ev}E_u6 D^;]4]侢Dα<=^Id6]l>Q!%o/8y̮ |5Uk}ϟu`s LJ / lx%r8 ,|NѤZoNNI-zoq_o^w?eՐ sЀ' 0 Cq)ń}l F\]j@AFFɯkAw%TyOW O~Qw(n%hȂT|}y?ŗ&||<׿qz?^8|ࣻE ||>; U>}Ÿk߿r>,|h6n緯W|l_݁O^o|ʼDrGt4o +8w+l W?W :&8J8'jr>>s8Ygq™ ?Yp/>{ Ww|^tq2h'<j%56F ,&UU|ܨ7F%A-~[{W 8)֪fOGDj8* !ҠF5Y:u 5 2{MO>h:Z aP\CYQv'F|֩5 F9[ä" iG4*Ie}Bݑ3cuDvVs{Coa-FӖ.2_-baXaLсy!Y=]a$4ge꧚tfwm`n_ћ^0o.X8´5&NP,eg n0zO:#'+aVINЏdM^kcvm3u{nIsx_'N7aU u4=S[ڬƖR(`(2@P[Qe,} }s .Y *VyhAHn\2vm:#W]qB3m'd'Uķ3'B36A߶釛w?ytzS+ ExpkTǞ錻+>mZ&Ϟ[=,]05xrhˠ3<4ؤL~<]BLR5.ӑڲ,30玛-jhOcctr/${2Ǭ T [;T|:(X&f6?N/б!`L6I,(Q2C8ڰЕNhR(obl2^#k6 ;'ĴWZ/p#SWi8{t #ɐT|UȯZ-RL bY-*m"(QU]F]]ukCTL~F:77<% `Q7y+%~䍂fV "(A*$X5 2*oNA޹IS^Փ`P{gZV]6W>,iKi< nݵjYV:;HH8)d73&E0:N{Bpr>y4~4 t\ll-4wVR`|UjBֳdCȹbIN#;hn;"|l[ ,>%H%gp-tK{hk0Epr!iű>Fˎ@F NvUŬ$rݳG-8C|ЦFX-zn-^ƫ=1` <%pr~kvVM==Oǩ9uBT8_+m`4"y`.uUBqX:s!DqzQIX|&AS8Gu7{j0--i<+?_aіet#%a܃@y#c[!a(1QțD.W>9߽6d1*lS+voh:yvlS'!= Ax[dDdۈ;XLܑ&\8FkvfH]dzg O8dwJ걇c&^[dr񡘋LT\S}R[mSo8m>7r.zQC-6`>Qﵓ ŪeHFvrs(a]Ҕ[ٲ LVݰ?okxb 7wԅMPɁGFPͯDw@.Xp򓵿= oBMȞd ٺ >Lq$~LD0`*'xo?SpNdM+tiWl8ZtpsZmK\LCqsMKA7,,::5J 9OG' ܖZܰ~QBUĤDEѦYwm;h ݟ7PÃd^m~0Bюapo1 ӑVeHPusKf[vF1Scľ;p0c<ΉbMǩd/[֔vMt5C"BjwgLIZ,3^ED#q/u:H!S+!J/M7Nn顚 wPpހ"O3jLZ5[PoxٵzKhhk"c8 š7퉝̭b`|rRt^+s(i5j?T`O~&vvԾ1|1:X!œߘHfvz h ppc2c-) ۂ3[qgRAr\([8TaAazBNFq.7/`y\ q.s9ugvyE&l@![gقP:;̔a%ٚHSڛ_@\k8G#Sr\qJќKF MHT.2ܓ sE^-W =|vrײ&h7NKV7c<=FmOzN4[6USYFjeݷ;3YtZP׆ Rn䭠nr{t|OǭIbŠ[?D|#O8i .|M0f`p< yC%F;jUo  E9 !VItCnC7m%ê]\+1Axu2=e=COq9C9/EOq! 2zV]/ SWq tgt4 bć@tafꇫH9 YSӰ@/A"(l- ⻄KݠE5%gDI*|gdh}u G9iV Z)3M+XS a ]`ՙx4WGY$E{.SS=SKRBQ#$.fpkfMf YR ⎴3W^GWA隼wi^#f4rӏ`l \]uΠD J Vbd {/II$Y3ȠG גO/dv@qCJjj맻9lM\w,W3T~c7jQC{Օb LK#1ҳ vưH؈M1Fu<)I7p60 hH;B5+)t~23 4ђUMp,OHѩK6 [ YyhP)юcLp}eyW:Ҏ6m~ZX td :etTC-U~-ab@N}'Qz~ &w-ZNh,[zXp 3I}fA2'`wnCJMZHØ٪'ZbllG&4ઑh6;k=dKh;zYi[5:v]'l.|o;;W)NA=먤תkRf9Z%\EjĞxCa<]FmUhiڞ.G˖ 1;AaByBB( )G ~ uI:Dד7 F܍Ӥh  ޏU~RTϠG/Lgf8?Rמ Ziy*^I[^6zЍC9Xi"&J/5Қy^m |s[ ޸߿o+U%S;+z _b6;PNS ƭU_}-<I-3щv7+1ںRFssޢbn,)s9-C '4 .ѓYWUn|PBH۟Ӄc0TeN`AC VHp>j|] /+Ưt&jX*"i0dSV0zg8j ߮yiңeӡ=IэN$vEcJϹ pcvĸ( N*-pjغT~+V3u_ܓR2ĕ̲S<۽U3nBu͇O'djTnoٞ`ѱC3~ 9`Y=f´ -\2¤ kX 0z e ~E7DӴmiYPpdvnQq/r j USq8W~:2Oj鎰Nt܌i4׍#OSO*no'F-Fevά~jNx~&h2 ʟi\*Y<2gQlКOF&V`e& kzT 4#WЛEQ,tzvl.-~`qCP>)jv_]҇B1YZ (\X Z Pv^Isgs`9]摡r= ؈& 9Zuft| 2[ۮ>z >׈m6JĞLEGԸV;$3:(Ѱv JZ⾘pEȨH-*Ccs{dΒy(g+^0;>gPKNj!dLudY :p0prl981; }zA>=)Q/(r0h%f1ȰVyGiv<{@۷'l&7`vbݞO en@l$# 7Ő`n 40Ռn!iq1u$q1JG!JNQ7H^ < t~3Ώ#jFZn19P2b6oA1qcBX#Le_bd!U7u{v865 1MQt:ݵ WTAF :mĠcyNE(GҪ]n^i 7I `ZsvDL%@ X)#&),:iFK}2hcb$Z` '2 bVIr'f Q鯦(5Å9ڬck&c{zZbn/vgS mL8l^nvԙE,qQ,JÔJG Xt{[ ֋qtbfzX$p(菃ֺc2'RrT$(ưbDG&ƌ?5,\_z5ZĬ`}}YIh6~iX.dG&]ʳgd Ki?nz0\}JWOCa%>jualiKc_jYEEnEIf(ZX: ?g5\~TGm/Lf=ky>Xw_q4ySp+0* N,z=&LzU=gbèaK=1S}I3@fRny3Iyt=5ҵ DȡtH`jGHwQgsJEX)Q;?=9ҋyunO6LyٙVhi/43i4"z|{uz'a `FPx` @ HSB)mI!u]J*=HVNvW0dA0N>$Zrp-Vw곙?Њ K7\+6C CdPvwҎ3Ek,[;rd"`I3D llbhZjM% )K)K:1LjjL^5,Q]33%s8F~;@5㳙 U%wyO,>2mQsNW3 Xbμ/\ 2$0feڙi8Ylq)}.R=Y7<UϵFH1,ٙ~A˸jqH%~< ֳ85:͍n]VSc1[![;u 2])5ovJJ0 4\`jM{fʼGf1?  B><[9dn [+Bte 7Khgl_.5n[S,%wm#8VSH%>Z/~t]vNwnlBt;CC8֑fFt)\^Ji+ph I6Ud#S$*fLyl1i.˱Vv082Nt.˶PF7XsX(x w򈌴+-x舱QtaRй.< &0Nj*ܒtSEᲭ:p_rJRDBu3ߋ/TC0] ^9;. $#%mŚyB IWeM⾓FਙˀDp4ZI)腊~ @O;;d`e5g"dv MhD |([-P(֦ aa2 jr*bp\W !u6ht{p.!'NY[Kiò Cq;ոQ-"IS뷣I,%)2e <@d+쏗V֛d`q9Oxk7آh, Cbcw8Fhx@s9+Qb_oQ\g xiw&<[wfZq<ǥylK@(}S˽+s V ' 8x&5˗~QPbh( [g4 6gWV8v6_jilKNaRotkZ wہӅ*wm-Gk4$(y\ϓ^L|)id^ ug8 רI%ҰkE3g F'bYYtP  $}d[9LRA+imuIR USclBvYh83 #``*5J͎QT"Aj47#UPBΚ+R`g-(+ LnYzf 2( n.s}XQ9.WTJ2>\ىp4E Vh']Jr˟ dM:H4S\>EIJ6)lw!Ze[&AjeKx̌3 x)pOBbc!훆IDclZMfG2iר2 empδ,ȳ3,MyO$<1-嗝x!Jie\[<"8>rRgRGvvrXmdTtĈLY3 iQF·k,S[u$D?g絗MgԛW Ap0in4 Mk2םyt  uAYAR3Rw0MF06߻ѿEYGb`LC,˯ٮ̾&4&I5VwTi'OhQj1Cz13IH#G%YKJ}q 83b\7'J9斤E!D\`q`R];jFT_Y *"DaKq0Kй99GJFaGpҙ.1R?jG 9qhs3T٨nZA)pTK/f Y {YC*[>`{q.QXu ]Sی8`onj.` K2 UA\h؞pѧˎzC?]c:GU+Qu0r:f]-]>g i%MJnpx3T- n0)eb=\a=MLNd{& s4(H|ijWpKeb(, KXMi.F2A%F%c Ma7 :=W dleqiq̘\ rt&٭,n5inKhPϿGIb s gdP^.޲=MMF`uLx5WD&pȎL,qx\0,":g' 7D*&b299颸 MnUVcX2 b/ )΢3DsųmoLp>rq$~/H~SQ'G> ֛M%:g؋F;h(?J zUvs2 A⃸ xi{ώ-2t 2ïTAO(/UZ)jeOH@}XͣP*egDV&|FV >|yɧD6t &:%g^a#KQL/ʰݥ4( 78]dQ 懛h7@~eBp!1ʎ_ ]߂ZYm}ensb+-&a و6%ˢyI45x.S+䩱PC)QA5R hN- :Ȕ/ HoPvi¼,&޺GIT8J<ՑdGvaGiYSt91Mfe8s@-N@~sQk MІ*[a(lqG\NyN+i4bmE1Va/a4ORn,;i0jOAKljM_w; wƶU{A2Kao/J=w, 9c#@V$mU&}&;W &+|!tW+a.6NhH0ɰJ.oķx}[RڤM;Flې #5lc3)z2F>`Re=KBH1^@5AA>\yF$ )}LVJU_,=#XLGHF˝20,\Bp>h* %JϹ۪Aڬc To7,::dB;Zx2v$n{twug%ںl56T[1­IvjVE1Ȑm(ʾ%O5PZƉ=ë&U轡$H?F<n0PBf'3K _6@kurxzMu9i0>v:1]j;v[nȤiϢnӂ(GBw*B7l@Pdbmٓ,U+I"l!ȅSӐ) ˙(#d^O+Mgx|bdNvbKP쫰)܏0%M-d.4(H=O$5&R+8,nZK#dzYЋno=gR;"a), K*+[Xmb+qzc:uB-]m#sI%pccn5N2thgpQ,\i'~:Us/$9gt k (.mKe`0f.-G@}L{QG鄩)l*עzjw=7͑Ar2bQ_Ѭ<7$wn4^;]h&gD9-`\"]FH_GjWUPLL"A 9~ A[d2|_B> Y~H4U(\N3ڭQz:Ђb52lw#愯WfKTK؅ L`JwHƞߠdvWqǞZgcY!\V}] XthM66.5; Y0, #. f,nbăɰp-HMS qWb-` ^JoXw(ɀ0Ň˿?5 \KVS*R,z{LC#+.dpޔ4x|D,6?fd@ǒ 6ǣUj{gvS;~'L#~ MQŵXx>SuZ\7Φgu:w].N{kwlA?QRqPF5[12 犦=G!:AP*1/ZSWت,b6tEItUJ5/Ӗ0e ~ˊ=h{jfb=rw=V7e<̕dFG_ʻ?.p4JģB*-LE# -mf vxUHϽDRߕQ7ɝ*EDʈ.m [1'{^YssɀW]ǛFvXBl5, g?q!Ǘc(42pj(XC'JEW?;`*Ih9$-̒=ke<\PfvTQ.>U#XBLS@n4D~;H`vٺPW8&BS6 [7X,LNӖFo$U0NJQtUkfUJ;]S޺v?UX(HqtTP@ " `+H!hwSZggZb>Govx.k_'.x&Q!r'>hGajiZbҳH<mA}BP&JiW;x[!m;A~p#&vY|#vەi'l )<6`Un 8huC !7+3[u6cb >hss!&2ں Iaل89.z ƶ 4qZ1oTEtuJr eE+'Er0mXsYOμQߡُߎy0Y6I)kăgLj7 usF]VmD${f^xP=:j.{׈dh.ÍcOxٱIū`6t]a=J,qe:f"}/}ȯ(a Ɖ00R(I:ALx:i <0tu&ӤZMb5Gva7oKy{%1 q,uІ7[~*qlC,K%C)md3伸\XuYb`LVm%vJO• m*Mjd/ `]k8E x[X%cxIm:@M.6e&M_23^2 | b,6fo{v :FזUb: .L-JWbB#YE&%y#4coݍb*zU{4kW1!U1 UـHferd@CЉhXN{ 'Ag[JpF6bbVXN+f̓J5v2I]5qZ9NZ&7V-I8(O{՞FTؕLj[\t lG4uL f Q26qM(x@~0QyY ya|(qݝQ8z-0ՇH$ $~<E;/6csZ:u¹39 3CpGp?#V Ͷl2ϻt4ww*ya(q#M' 3%:U󹟷  ße~.l&f2F00+ .ÁQ8\¹E:yoSVRlIu`h<]l[gm#skSM|F^\VlwPUߵ^D2g*ZӑQA5OI2lt(6RmEݴy0XM0)hh^eS#A_deM0ǒA֑Tq0Yմdf. /8H<S8REJnELrF~( 01kߋKy [F)g+KBbP6h$xՊt-v[enjyxF M ;bfXJEk}gˬAgj9GA~  3taǜ!%i4YȰU|afiұ\N(T{ C6ްiMgMvkfpX`C Ihz(b%LIe &&9U WJgwj΂ iWlhC-p5,#tfzn[DM#lŪ!nr}|_>}pzC;BF =9w]?kX[cVؙ ؕDF@k|:??;z %+7IJg|8YunUZm~3![/cq'eL͡+S;*8Ds#2^Qr(?(R%ڞnu!k ޴H7lis'KTaNt#]#J4Z=G$!sϑd!<ڕm=%>*IcH04v,$KVnKzmDQ3cGJf!^&)bjt!;g+wx?&oRPDzrVFmȄLywj7)ǘ/ R6Q-J ]."\.h$ hK7b[v:\}񅘧?f8^LZivLRMq8^!pT$CDqeDm[$Zh\c;44 wptqx{ daFtT:o>W dnq0n OBcM;荪\"[ċC2987iZDMwtP&/*@MOM¨r.%ce<=z@HEL&&-3/,塦B?JEJt6cOU*~Z\ ;a鋥!y=qDXa"04&IPz# w@YJ|@WC5Z5W /z]c2n ];~khZk}{I1n,9EVq+&Z1WdRGk[ivL?/?6;k~:nXhn686ȧ9Uz4wh61a +5^@KhCd OLeQPDgݿ5ÑҎ Y@S.#j[a3Uo8yҙl4j%u&Ӧӏ]+F#2i4 ڣz|8P$(/m0^fwJfi8n 6Y f1tNc]%qiyM;tbMF}W+k@kr@y3hFw!aIEYm,uFBnvo&l?}^L2k7b VžD=fM FDήybQYzy92Xγf:_)Jr +_ ɚwcDfGO6N!f*}9L˩ƆTE,aO{ҿ,B1ɂ8͑mNuoto&uXE1C]8gybp=N;Y޲k9tLӡ8 ҙ9+^vF5l<}RJ~:CʥLU &M]3N"?KҗHE5lO;AJ5I,, 34!F\h $ޚgࢾ..DejrFqZ׵ev3c{R͈l-/ڱg^]#o'f'rwiÏ P6a0܁ђq]SPv#OE@2pzc$1б2,ȞzuW 'Wi/P$,[vSzc7vWK8vMIf^v %!J=,qB0PCI.5Wͽ!g/c B"0u^x40+Yo:mo5%~ǺL^vjL s% :hff3#$qY]ޝ`k,(\+FE>xM@* -8r"D.{&-79E`~٪ p#M/8/Xgň൦E~< Bqj3jL R=&YMs{, m0? NJ{nǛLph,g6}ӎDac AsOVzleJ'T\:,8̄tkPmx@,Ի#ȼ~{'fM!C,if?p ," sa/w9E&˗[>=FdL~lٙ c;jWa~<'Ka=YN~\PT{{5I2=pgBQ0;%r`SӸs4]z;?jG4cE3NjZ-}[URSYi:oLODyIO) ?q<;`b~cL#iB1*<9I0ic}+#7^ ۩I%Srm0%L*0ZsO_lQ4ZQ$`{j y$Jb9wqZuWgAce0*CCSm%mÓqBis ؗ;n S\ YfaSJ!MgǙJ -jOi"6+ȈO"1`7)I; ` &mB,ZfH,rw"ͮjjVYYtW(jZ|߄Z^ՠ>f1KXLQۘYgrzUb*p7V{ TyvxM^ uϵB%UZQZ]Sّ^!"68?2se#̞IR@ymry~xl+kvS_iqUE ~97KWXn l<)펠Ҧ+w.y4tO'`=eBqɠ١!h ? /l6Σ &cG@W2l#6]:ƚ~BݥB@+}m)5gDqN6TAhvd 6i>/T8}|vm wӊbCuҌV(N¦, 8C;ӫGqe؁%t٨gA-,~b ODˉ3;6eFNGgn7(zڤ3+dcASD, Ep,alUakn4]ĺifpF䷇AG4~*CtMV^(5I# BltuCޤM@zIeiS-fKasRtdhM~`G^92inq-t '-RR&K[~N PF<"#GM92S.d,7#06w۾>ƀu &0^LN[B:f Q#&ɵ LJ5'=*dj͆f>iqRYѰ3{ޢ`+Y^2"k[[aXIx*M-a24*qI<#w9<<RtS7Ժf]K9Z" O% R2UILH, ^AJ>ΥWQk} jt$2I3\M:>E5jddd3_Qm *O[1{Bw}l|?ɮPa"mĐx6! ؅Rsٳa\~UiDNpo5NvIE?WH)WHY{qb#?ː< >vܬ#JX@*%*@7jJ…QHZ%t݂AU3d :Q#XF(OXCuŚEg ^,꜔@Ȣ%*. A'Ja !VϞiVdK%cǙ|Jg7$725r(\5R = fO4+Mu '-.@hɦc1A~a3@Nl4׈miI [(^e{%\u4c& Xv>Ft9V.5R ԋHQCfj2qg6~ ESn!,]z3 mZd쎮ä1.]_+r ;P zęBr4c&x,U$`5ACe|L)FG.V rʪ39YA<'< iD($ḣ(&+6b׵$Yd "䩞_tKR]<9N~p$;K%}W)Oˮfh-t,u'fXW]c=ҹ>MzEc.EI[2@y2O¶$.Qd HuMTfF _YrSwjLΈ [h v23X,i3Tb8yuW+aGV+1{] t.k~5qQGlC/eYl:(6зMDʎd":<~*1 *w;L[P陡bBf $H۪V~r{}G5cF&OøJ^B##^MwhQmOU^ίJۇ\+$,, um=Mե⎦I@e7F2 i$ZcR̨Q)40!1?ElsI43OM @EԜ= tO=AZ;,32ERBn}.TB:T _H|mVƶ[`#?IcV\K xGe4-$ShuÖ,9]O^_gV8Ź<nMhtBFx:i:06"ZY6w#;cyZɩQʣgCWOYXܟHQB N'أehWƹSZ~F W#s1 &tG03aǡ RH^-g%V..!k@]$n5Ӥ;=h9o#dnTg=rJ$w t<:YfhP.Aۚ /W.v+ͦH9!=lV: 6(F/Nۙ\'KUǞuuڌp2 ʪ8.rK#>(LQY)2]qzyW6 ̕ lf$3TvI[yR鮢x=]ԫ_pqFL Usp\s@v򧗏9>ıCj9EF- 2HVU rD+h&6s@\DR?I#O3j8J9qj5֐eR3v2u'_=īPb03];8);X Y8jo [e%bGxaBVV4гi9vy.RUFJ1e<3_5_Pn35pN% K Y]ٶel;OCHnhgxx(6#;m< }21LzxvϭUqTA槯gp*4Zٲ gGŕtj3,{33PRb.6pa]`ՙx4WGYeVzN2`D]#c0+YQqgt#W gT7Αy\ME)J$<vQ`TbU奏@ S%}~se&}UJ2[ jPϧw0Na aFW߿^RUU4sA`а[˕ ,`N쵣2h4)2:3 M8]~nz2N3 B1qc'׃,ÖGs03`4[zQpkL 1/dkȘ$,EuֳCIhh +LL@[7hHۭ(CjTj1PJtVHrfX"9c:XPXʵ`j{d|9n~` c jy䚙3 I˱ NT-NgO*N (3ul/7ˉnc?M I2F՟%P:)LS(3Yu=KRؒ z%z?ŮnZ!5?݂'$­#_vYt$^gV5&ɳe&9pMHA6 B,"ZxYf;+DRv!Ǹc5aniY 8`w؟WݏpK4藿'hC.􂱃]iSɈ|lmT Ϩ.`UvwQH;;B KS*S gFREg2I SvVVݎ9re`"f}_(SDGo=բ8[2Vt4Vm f(G5a kǟ# +\f0>y*M:֔> 턱U+\N-bZh%YHLI5|nJ'rҀn&8*d%Llg;eLbI°$sdCc4 0ZY'i,iaL`Ԟ ӜŤGlih6F$t2!́t>rኑ!+-3Yѱ\cPO%IZ cBb_Phu%*7L6Sa0iBF}3.ʋ,  MLrG1& bG8(׹y2L|??pej+7|79*=^iW$^I6H$H U^\6O'NJgq XX{xFy*$n;V5n5kiFVT~m%r9p} c떚 ab)hsY\K:z&ǹ\c7(/lCL2Q}Sqg+ڄR,H@FGϐYKL\f;+>DiZGe+xxܭbJ6"r/doWa+o6]H`Qqaig ;pˤ3p:bqΗ\DUw*[=B`>٦xCDmG%IG>E̟gŻg7WaheldW}Zd#$k*3srk}[?? *Q!KĭAl =47Ђ=r.&+5ϒ,` UgZ2z/1~{2(D@[>Ҵ'U:k(tHD"s@Y gwq NQm6 L2&A1?0[Uׂ^E AfA3nc:.5W b`Jb='BOca8}]vp(c&q3$Uo>^xMK#Z }O ;񇣟?{c!לAɴy:㣑7"r(ûaluX_J%k/ozU$Qg3(ư.KOD/ `b3%S)DFRn Ъ/̞qV}Ml¹JWG,eu՜rEXVrEq;SyvXU8j FWAG`SK|K 9h5-i=N2p4groMOxq֑yEp1@G6ֈeQmLOΎ0K1(_UGCKXD2}+ni3[W JsvIQRz6OZzƻ,x[Got9]Z):ʖӋMc3{oAԉ u;ä $S=!G!-rTeڔ:%*&ڜV\&WI%uCggyi]EMJG]z=rJT- bu+lS=- B0krxхpY!Nt5el*;|KdA>I Ő?K|pį4v+LYseZRڥei뗵6<LA\@1Q"<CL#|_+@FlW#J, ༘IN4<j+rY0+CN],Xy{T%ȳzK,CWsD KY!% hpcǐaG_p b_w.)O4Yi̾~eB_K[D@K8SA_O}!=@UwcѰ"hET({\DNO2: OϿ3.Nsbm::|:$|-9mL~f 9R]7rNnI+9 (C4ue㲙;=`-. DAgy裉nɀb_(;lCG&ƣi攣d  o }MxrrYEjXVbfN,qEd9ղ&iEy:dWRڿxXbBL|{@&)-#ϴ3*V:aa^ T$ _*b@8rŖ@v:G3f,O PNmt:fCW a|+^ c]=^k10LbX'_D'{ö {rsʜ0✚q :+(߾(5Acl:5FNlx1};Q%Rbvo>VPYBWFWi k*z7lMN63sjpd)p]sШ)ˢ?yl4? Q7k b g>U5M:#?qWWp1R,(Ǭ>3LS;r`V~c)qU: 6}i}-;f QVE(ULUxqƏT026( j uвj|e/ZJ@?m4L lI ?,}p56+g D-[fJw SB_MJMaUs9Aܿ0;Vyi<`x_oE+oknuN Q!&>64HdMYU~d&aif݇IqK?Rwb>Qp҃PM;/wij)@#Mۄul)"lw#@-Y?do~ҩi&#j鷷@̈/ӶEw@@\-)N-ԼtNƵ ͼ#C"$-pCwg L9&^5BA8kI[h Ѵzy[^9HAyh 8[ n 3``AD$%E]F gfdxO<@vp Wk2 &h0qCTO%4A9p6m{*/h9Ǥ/yM ]@#ЈtbvOO_0OjW`@TRc0ŏ-Ufˈ>N@-wUf7aX/بbϟ]]IW>! jvvv?}?#]O'@o{son2G7nM~ >ˉ-Z鰝AWO-mǎwп S a*v:gN8DQi`Տ}]L*z\Bw*fᷧKbxeo^LOKnC#۠*+*!z(qN88L8.bA_"9wm7֤p8;2$=]npTi ^FLrŖPIv\(0C ãD"s(gjhgDz3Brc|ؐOZ*Cqd{L<}*\50TTa)6:q#\D sل_41]rX'#i&DӺɍ%-HdUO0ueejUF8Xjg}Kzh/:JP{ejoȝbcG.T˪ }KχSĉ<ʣܩV-C  P|(R}F>w87e|},AS#iKF6^5aiZf;&U)1a r(DwӍ9{!M i;g@ E?}c n?PLaNX%8mq$mQ$ ykX"+} !yrq]ߚj-}ޗf$NQ(yv_sBe8ۼԦ~m#1Guu@ %e]W[%Foâ}/@%: 0'ٸ6?4Ym}T@BQ!m_~/?H1mH~oCϏ/sa߾O6!Gj=BQ)wf<^5-Fe^,F4,xOR?Z>{9]h07*|i ߶7DfOkĵnc6r:~:G/z=[;߳{\gVio\ЮRWvk.Io e "Lcl{u%1L twV#`zOy뒎9狷mN\Q :2k qo|Dpc՚1\u'A־m3JZ3>7u-6B6Z VE{ѣ 6h_Nd{Bfqa[ qDE^ՒZ%~uk}W7m꬞X#%J\+dѴĉ ml e\PӺZVq+N;8GMN/v\Kvȓw"#*U?yqqU^]bTT+vyҵUxYN.PLlS**DTyN?p]RW*FxSu<}b}lb{"u V-C"{a8,~ MOMĄAx^1( p@,1`!UhZh)z(+4/ QpOf0"hh>qhhI~s x 8W"0Eàd"ZjCJ:0$!e+W}l. /Wxp,W.tZrH?oڿ1y/ȣQW}kނcpIeWIg>5$&#͔YF+5d Ak1jp.Y]FcP= *Gv־ ї' D9\A=EڒvzxN1 E]n}wH *vɲ8d Ssv\W3O|}U2]M²}0a(w.ԂFT1ee_|KQ>SB Un/ֿK4[%X3D `A{AT!n@#`''g_ei*X[L@}7ume3/2Nm#<ֻҺYt 84.p|y96.eK`0H-=q贙M/_j8[_eRQ4sdqBFۯza|!ɟ{kۃVuQ,˸]B"__^7I<%8dM.%cЄNM@{dbYNΉ= BxZq"(58+ОDZ`fS懑Aybrıf ZCUⰑM1v7~}E"4~IpמˈjevN CZ ћFDH| h(>WkE3fOvR&wF,w*HkH0݁󑖵y/׹/ziUQ `oetXaoSG`8]%p(%qa8LM–U7U:O{S|@*Tupg4 JJ`a>k`<s篂UbTUX?v1a>֧t[RDobO6sh;˪փSX cApx玏ީO\u1<+bj*@D1~ćb<ϰN1A8O8TBT Dȕlب'.,&?cK YR8< MM%A^AF!z>X{.܆YD,m4xǵʄ  ,-٣"ԜnDQvpR>VIJp۔%2cX0m@֑=4v^ۑe`Pb76= w 0-hqB$Y=cK+fl@r$L`-h@'}o~_M_0:j^G>OFpУT 6IBad縦۠^+*xNrC%L Rz腡G -duʼ{c] eq+n#~-/YE8듛3ߵ;w Ew$B*a}o[SV SVxRnʙyO|$;YZ(}@:knܰH.7c>[yx%WT >h.1?;lT6KI@<R r_q`v/x[7HA piʼv4" q=M7 C֔I/ ҕ@,m2t v[GM2$i/w0ٸ|rY^3z_ܐ]FTЌzFwr$}Qd%fj%6+cbك;PqSPN-lknZZ0Z vIWD ݆uH:n8}i徆f t4((u1{Me&l6~R~%ݓOZZ^)|wDfq`f0[Յ˫HuzA$*FԲ>QG`d>>YX52P ( Pҗ4SI0yL>Y6S Sbct:Q} ߄;}|YsM e uoi\m]R$|6Շ >1ַy_kpvz2%&Iz0_~O?__~& WjP0$ 6Tyv}i^d6 ;0[NG6Yp aKղ Ƿ6Ѿvw24gT$ 鈐s9!]⃘t2(Nճ940 9qc>Pq-nB0~QYD$i-Ί|$exB@,k"w0UFM&{){#0 ur܌}0F-ĢMHšs=/2),BxK=]B$}4"6dy^h(f9]r>si' ]9i9=Px4}r4J~}w*ԽrObeyluI q ,n ~dnDq`ȼp%M5Ih *{yzm'}t@`]:PIe|aKH; 'ԉyb?1;V]1+I|YJ #fIq8,*Ֆ'8!f֢Z+umR0GQ81Ytb!2EӲ̵{^ǎųׅ=R@br@!e$owlw"'x'F4e؆_] X??aaq\elCda$UE\ɶKꁷsOfmC{_GUV$A}[F n}{Z[\UO s1/2,~AEvRYl-[HzY.-dY+a7~QDbosYw%V;L/xZ8  ? PYŃ.=&0 phishing attacks – Penloom https://penloom.com News articles and more Tue, 26 Nov 2024 11:03:48 +0000 en-US hourly 1 https://wordpress.org/?v=6.7.2 https://penloom.com/wp-content/uploads/2022/01/cropped-favicon-32x32.png phishing attacks – Penloom https://penloom.com 32 32 Cloud Phishing: Modern Techniques and the Crown Jewel https://penloom.com/cloud-phishing-modern-techniques-and-the-crown-jewel/ https://penloom.com/cloud-phishing-modern-techniques-and-the-crown-jewel/#respond Thu, 04 May 2023 08:24:53 +0000 https://penloom.com/?p=8109 With cloud computing, phishers now have got a new place to gather information and expand their businesses. But that’s not all. The effects are much bigger and more dangerous than that. No business, no matter how big or small, is safe from phishing attacks. So, it’s important to know how you could be targeted and what you can do to stop it.

Phishing based on SaaS is already well-known. For example, more than 90 percent of all data breaches are caused by phishing, including stolen passwords and malicious URLs. In addition, a report from Palo Alto Networks Unit 42 states that researchers have observed a large surge in this type of misuse, with the firm’s data indicating a 1,100% expansion from June 2021 to June 2022.

What Is Cloud Phishing?

Cloud phishing is a type of phishing in which fake cloud computing services are used to trick people into clicking on malicious links. Most of the time, these kinds of campaigns target via:

  • Video conferencing platforms
  • Social Media platforms
  • Cloud-based file-sharing platforms
  • Text messages or emails
  • Workforce messaging platforms

Hard To Detect SaaS-to-SaaS Phishing Techniques

All these frauds might occur without the attacker touching the on-premises computers or network of the victim. Since everything occurred SaaS-to-SaaS, none of the existing security mechanisms, such as sandboxes, Anti-Spam gateways, and URL screening, can inspect it. Therefore, no alarm is generated.

In a phishing attack, the first step is often a fake invoice or secure PDF document hosted on cloud services. This document can be downloaded, but it’s important to know to make it easy to use, these cloud services open the PDF so it can be viewed. This means it will load in your web browser without restrictions or warnings.

It’s hard to find because it only sometimes hits the protections that were put in place. As we saw in the news with the AWS Cloud Phishing attempts in August, it will never happen if phishing detection is built into how emails come in and go out.

All of the actions took place in the Cloud (or in more than one cloud), and everything looked legit and encrypted when the scanning and detection took place. The victim’s computer will most likely get the phishing email, and all the magic will happen in the browser.

Here are some types of SaaS-to-SaaS cloud phishing techniques that you should know:

Multi-Stage Cloud Phishing

Microsoft issued a warning earlier in 2022 about new phishing attacks using Azure ADs that target individuals who do not utilize multi-factor authentication.

This assault is flourishing now but not in the past because attackers take advantage of the Bring-Your-Own-Device (BYOD) idea by registering devices with newly obtained credentials, and cloud authentication is accessible at any time, from anywhere.

A unique attack strategy that combines standard phishing with second and even third-phase operations. Phishing attacks begin by stealing an employee’s email address.

The second stage establishes an Office 365 account in the victim’s name on a fake device. Once installed on the new machine, the victim’s user account (and Azure Ad, in this case) is used to conduct phishing attacks on the organization or customers using the real email address.

They can use internal phishing to take the second account if they want more power or a better “host” from the first victim. These multi-stage attacks look real and potentially infect the company’s OneDrive or SharePoint systems.

Crown Jewel = Developer Accounts

What motivates threat actors to attempt to breach developer accounts? What could go wrong if they were stolen? Attackers have access to almost everything depending on the developer’s position:

  • Access to CI/CD pipelines,
  • SSH keys,
  • API keys,
  • Source code,
  • Production infrastructure, etc.

Under the ‘best case’ compromise, a junior engineer’s account could be stolen. This engineer can at least ‘commit’ changes to the source code. On the other hand, let’s say the company doesn’t use software engineering best practices like reviewing code and limiting who can commit to the main branch. In this case, the attacker can change the organization’s source code to change and infect the final product.

In the worst-case scenario, the attacker will get access to a senior developer with elevated privileges. This account might manually circumvent some code checks and gain access to key resources. This situation, in which an account of this type is compromised, would be catastrophic for an organization.

QRishing

Currently, attackers are attempting to distribute malware URLs via QR codes included in emails, making them impossible for most email security solutions to detect.

QRishing combines the terms ‘QR Codes’ and ‘Phishing.’ This means that the assault is in QR code format. It may direct victims to connect to an insecure Wi-Fi network, while someone can easily grab their keystrokes.

Some bad guys even put bad QR codes in restaurants and other public places. Since the pandemic makes it hard to talk to people in person, threat actors often use QR codes. We use it to look at menus, sign up for vaccines, and learn about public events.

Adding fake QR codes to a phishing text (SMishing + QRishing) or social media platform is another form of social engineering. When users scan the malicious code, they are sent to phishing sites, where they may be asked to log in, and their login information is stolen.

Various Methods To Improve Your Phishing Defense Techniques

While you cannot eliminate the danger of phishing attempts, you may learn from observed trends and occurrences to handle them more effectively. For example, the current Zscaler report includes the following recommendations:

  • Learn about the risks to make better decisions about policy and technology.
  • Use automated tools and information that can be used to stop phishing.
  • Use zero-trust architectures to limit how far successful attacks can spread.
  • Give users training at the right time to make them more aware of security and encourage them to report problems.
  • You can find holes in your programme by simulating phishing attacks.

Knowing that phishers will find a way to get to you eventually, being more cyber-resilient is a great place to start.

Final Words

The truth is that no one can completely stop phishing as long as there are people involved. So, the best long-term solution for email security is to use Zero Trust Architecture. It would be a much more detailed version of the multi-layered defense approach.

By focusing on Authentication (Verifying User/Device Trust), which makes sure that emails entering the corporate environment or landing in end users’ inboxes are from real people, brands, and domains, a Zero Trust approach to email can help organizations defend against email impersonation attacks.

In every technical organization, software developers have a special place. They are the most important part of any modern company because they have access to the products that are sold to customers and the systems and infrastructure used to make those products. If developers weren’t protected, the security organization would fail, which would be a disaster.

]]>
https://penloom.com/cloud-phishing-modern-techniques-and-the-crown-jewel/feed/ 0