Category: Attack Feeds

Attack Feeds

New Malware Technique Could Exploit Windows UI Framework to Evade EDR Tools – [email protected] (The Hacker News)

– [[{“value”:”A newly devised technique leverages a Windows accessibility framework called UI Automation (UIA) to perform a wide range of malicious activities without tipping off endpoint detection and response (EDR) solutions. “To exploit this technique, a user must be convinced to run a program that uses UI Automation,” Akamai security researcher Tomer Peled said in a report shared with The...

Attack Feeds

Latest round of MITRE ATT&CK evaluations put cybersecurity products through rigors of ransomware  – Greg Otto

– [[{“value”:” MITRE Corporation released findings Wednesday from its latest round of ATT&CK evaluations, assessing the capabilities of enterprise cybersecurity solutions against some of the most prevalent ransomware tactics and North Korean malware. The sixth such evaluation from the nonprofit research organization measured 19 different vendors’ ability to protect enterprise systems by evaluating them against two prominent ransomware strains -—Cl0p...

Attack Feeds

ZLoader Malware Returns With DNS Tunneling to Stealthily Mask C2 Comms – [email protected] (The Hacker News)

– [[{“value”:”Cybersecurity researchers have discovered a new version of the ZLoader malware that employs a Domain Name System (DNS) tunnel for command-and-control (C2) communications, indicating that the threat actors are continuing to refine the tool after resurfacing a year ago. “Zloader 2.9.4.0 adds notable improvements including a custom DNS tunnel protocol for C2 communications and an interactive shell”}]]  – Read...

Attack Feeds

Microsoft MFA AuthQuake Flaw Enabled Unlimited Brute-Force Attempts Without Alerts – [email protected] (The Hacker News)

– [[{“value”:”Cybersecurity researchers have flagged a “critical” security vulnerability in Microsoft’s multi-factor authentication (MFA) implementation that allows an attacker to trivially sidestep the protection and gain unauthorized access to a victim’s account. “The bypass was simple: it took around an hour to execute, required no user interaction and did not generate any notification or provide the”}]]  – Read More  –...

Attack Feeds

Why Americans must be prepared for cybersecurity’s worst – Greg Otto

– [[{“value”:” The interconnected world we live in has brought incredible opportunities for growth in America. It’s made life better in ways we don’t think about — from the phone in your pocket to the groceries at your local store, networks touch and affect almost all aspects of our daily lives. But there is an old adage in war: every...

Attack Feeds

Researchers Uncover Espionage Tactics of China-Based APT Groups in Southeast Asia – [email protected] (The Hacker News)

– [[{“value”:”A suspected China-based threat actor has been linked to a series of cyber attacks targeting high-profile organizations in Southeast Asia since at least October 2023. The espionage campaign targeted organizations in various sectors spanning government ministries in two different countries, an air traffic control organization, a telecoms company, and a media outlet, the Symantec Threat Hunter Team”}]]  – Read...

Attack Feeds

What is Nudge Security and How Does it Work? – [email protected] (The Hacker News)

– [[{“value”:”In today’s highly distributed workplace, every employee has the ability to act as their own CIO, adopting new cloud and SaaS technologies whenever and wherever they need. While this has been a critical boon to productivity and innovation in the digital enterprise, it has upended traditional approaches to IT security and governance. Nudge Security is the world’s first and...

Attack Feeds

Chinese EagleMsgSpy Spyware Found Exploiting Mobile Devices Since 2017 – [email protected] (The Hacker News)

– [[{“value”:”Cybersecurity researchers have discovered a novel surveillance program that’s suspected to be used by Chinese police departments as a lawful intercept tool to gather a wide range of information from mobile devices. The Android tool, codenamed EagleMsgSpy by Lookout, has been operational since at least 2017, with artifacts uploaded to the VirusTotal malware scanning platform as recently as”}]]  –...

Attack Feeds

LevelBlue SOC Analysts See Sharp Rise in Cyber Threats: Stay Vigilant – [email protected]

– [[{“value”:” This holiday season our SOC analysts have observed a sharp uptick in cyber threat activity. Specifically, they’ve seen a rise in attempted ransomware attacks, which started during the American Thanksgiving holiday period (November 25–31, 2024) and are expected to continue throughout the holiday season. We’re sharing details on the threat actors involved, their tactics, as well as recommendations...

Attack Feeds

Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability – [email protected] (The Hacker News)

– [[{“value”:”Microsoft closed out its Patch Tuesday updates for 2024 with fixes for a total of 72 security flaws spanning its software portfolio, including one that it said has been exploited in the wild. Of the 72 flaws, 17 are rated Critical, 54 are rated Important, and one is rated Moderate in severity. Thirty-one of the vulnerabilities are remote code...

Attack Feeds

U.S. Charges Chinese Hacker for Exploiting Zero-Day in 81,000 Sophos Firewalls – [email protected] (The Hacker News)

– [[{“value”:”The U.S. government on Tuesday unsealed charges against a Chinese national for allegedly breaking into thousands of Sophos firewall devices globally in 2020. Guan Tianfeng (aka gbigmao and gxiaomao), who is said to have worked at Sichuan Silence Information Technology Company, Limited, has been charged with conspiracy to commit computer fraud and conspiracy to commit wire fraud. Guan has...

Attack Feeds

Ivanti Issues Critical Security Updates for CSA and Connect Secure Vulnerabilities – [email protected] (The Hacker News)

– [[{“value”:”Ivanti has released security updates to address multiple critical flaws in its Cloud Services Application (CSA) and Connect Secure products that could lead to privilege escalation and code execution. The list of vulnerabilities is as follows – CVE-2024-11639 (CVSS score: 10.0) – An authentication bypass vulnerability in the admin web console of Ivanti CSA before 5.0.3 that allows a...

Attack Feeds

Patch Tuesday, December 2024 Edition – BrianKrebs

– [[{“value”:” Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common Log File System (CLFS) driver — used by applications to write transaction logs — that could let an...

Attack Feeds

Microsoft closes 2024 with extensive security update – Greg Otto

– [[{“value”:” In its final Patch Tuesday update of 2024, Microsoft has addressed 71 new security vulnerabilities, including a zero-day flaw that is currently being actively exploited.  The zero-day vulnerability, documented as CVE-2024-49138, is a bug in the company’s Windows Common Log File System (CLFS). It poses a significant threat as it enables attackers to achieve system-level privileges via a...

Attack Feeds

Wyden legislation would mandate FCC cybersecurity rules for telecoms – Tim Starks

– [[{“value”:” Sen. Ron Wyden, D-Ore., introduced legislation Tuesday that would require the Federal Communications Commission to regulate the cybersecurity of telecommunications companies under federal wiretapping law. Wyden’s proposal is the latest response to the breach of telecom firms by Salt Typhoon, the Chinese government-connected hackers who carried out a potentially yearslong espionage campaign by infiltrating telecom networks. Those hackers...

Attack Feeds

The December 2024 Security Update Review – Dustin Childs

– [[{“value”:” We have made it to the end of the year and the final Patch Tuesday of 2024. As expected, Microsoft and Adobe have released what (hopefully) will be their last patches of the year. Take a break from your holiday preparations and join us as we review the details of their latest security alerts. If you’d rather watch...

Attack Feeds

The AI Fix #28: Robot dogs with bombs, and who is David Mayer? – Graham Cluley

– [[{“value”:”In episode 28 of The AI Fix, the new version of ChatGPT does a surprisingly good job of telling Mark how to defend himself from a flame thrower-wielding robot dog in his living room, Graham loses 30,000 robots on the head of a pin, our hosts meet a human washing machine from the fifties, and Dr Who finds a...

Attack Feeds

3AM ransomware: what you need to know – Graham Cluley

– [[{“value”:”The 3AM ransomware first emerged in late 2023. Like other ransomware, 3AM exfiltrates victims’ data (demanding a ransom is paid) and encrypts the copies left behind. Here’s what you need to know. Read more in my article on the Tripwire State of Security blog.”}]]  – Read More  – Graham Cluley 

Attack Feeds

Treasury sanctions Chinese cyber company, employee for 2020 global firewall attack – mbracken

– [[{“value”:” A Chinese cybersecurity company and one of its employees were sanctioned Tuesday by the Treasury Department for their roles in an April 2020 cyberattack that unleashed malware on tens of thousands of firewalls around the globe, including a huge chunk belonging to U.S. critical infrastructure operators. Treasury’s Office of Foreign Assets Control said Guan Tianfeng, who worked as...

Attack Feeds

Cleo File Transfer Vulnerability Under Exploitation – Patch Pending, Mitigation Urged – [email protected] (The Hacker News)

– [[{“value”:”Users of Cleo-managed file transfer software are being urged to ensure that their instances are not exposed to the internet following reports of mass exploitation of a vulnerability affecting fully patched systems. Cybersecurity company Huntress said it discovered evidence of threat actors exploiting the issue en masse on December 3, 2024. The vulnerability, which impacts Cleo’s LexiCom,”}]]  – Read...

Attack Feeds

Steady leadership prepares TSA to face evolving cyber threats – Greg Otto

– [[{“value”:” New presidents bring new policies. But amid rapidly expanding cyber threats, steady leadership at the federal agencies charged with securing critical infrastructure is, well, critical. David Pekoske, a retired U.S. Coast Guard vice admiral and administrator of the Transportation Security Administration, is uniquely positioned to provide that leadership. Congress showed foresight in 2018 by creating five-year terms for...

Attack Feeds

Fake Recruiters Distribute Banking Trojan via Malicious Apps in Phishing Scam – [email protected] (The Hacker News)

– [[{“value”:”Cybersecurity researchers have shed light on a sophisticated mobile phishing (aka mishing) campaign that’s designed to distribute an updated version of the Antidot banking trojan. “The attackers presented themselves as recruiters, luring unsuspecting victims with job offers,” Zimperium zLabs Vishnu Pratapagiri researcher said in a new report. “As part of their fraudulent hiring process, the”}]]  – Read More  –...

Attack Feeds

What Is a Brute Force Attack? – [email protected]

– [[{“value”:” In the ever-evolving landscape of cybersecurity, threats continue to become more sophisticated and pervasive. Among various cyber threats, brute force attacks stand out due to their simplicity and effectiveness. Despite being a basic form of attack, they remain a significant threat to businesses. This blog aims to demystify brute force attacks, explore their various forms, and offer actionable...

Attack Feeds

The Future of Network Security: Automated Internal and External Pentesting – [email protected] (The Hacker News)

– In today’s rapidly evolving threat landscape, safeguarding your organization against cyberattacks is more critical than ever. Traditional penetration testing (pentesting), while effective, often falls short due to its high costs, resource requirements, and infrequent implementation. Automated internal and external network pentesting is a game-changing solution, empowering organizations to stay  – Read More  – The Hacker News 

Attack Feeds

Hackers Weaponize Visual Studio Code Remote Tunnels for Cyber Espionage – [email protected] (The Hacker News)

– [[{“value”:”A suspected China-nexus cyber espionage group has been attributed to an attacks targeting large business-to-business IT service providers in Southern Europe as part of a campaign codenamed Operation Digital Eye. The intrusions took place from late June to mid-July 2024, cybersecurity companies SentinelOne SentinelLabs and Tinexta Cyber said in a joint report shared with The Hacker News, adding”}]]  –...

Attack Feeds

Phone Phishing Gang Busted: Eight Arrested in Belgium and Netherlands – [email protected] (The Hacker News)

– [[{“value”:”Belgian and Dutch authorities have arrested eight suspects in connection with a “phone phishing” gang that primarily operated out of the Netherlands with an aim to steal victims’ financial data and funds. As part of the international operation, law enforcement agencies carried out 17 searches in different locations in Belgium and the Netherlands, Europol said. In addition, large amounts...

Attack Feeds

CERT-UA Warns of Phishing Attacks Targeting Ukraine’s Defense and Security Force – [email protected] (The Hacker News)

– [[{“value”:”The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new set of cyber attacks that it said were aimed at defense companies in the country as well as its security and defense forces. The phishing attacks have been attributed to a Russia-linked threat actor called UAC-0185 (aka UNC4221), which has been active since at least 2022....

Attack Feeds

Ongoing Phishing and Malware Campaigns in December 2024 – [email protected] (The Hacker News)

– [[{“value”:”Cyber attackers never stop inventing new ways to compromise their targets. That’s why organizations must stay updated on the latest threats.  Here’s a quick rundown of the current malware and phishing attacks you need to know about to safeguard your infrastructure before they reach you. Zero-day Attack: Corrupted Malicious Files Evade Detection by Most Security Systems  The analyst”}]]  –...

Attack Feeds

New ‘Termite’ ransomware group claims responsibility for Blue Yonder cyberattack – Greg Otto

– [[{“value”:” A newly formed ransomware group known as Termite has claimed responsibility for a ransomware attack on Blue Yonder, which disrupted operations at several major companies, including Starbucks and leading U.K. grocery chains Morrisons and Sainsbury’s. Blue Yonder, headquartered in Arizona, disclosed on Nov. 21 that it was experiencing disruptions within its managed services-hosted environment due to the attack....

Attack Feeds

Black Basta Ransomware Evolves with Email Bombing, QR Codes, and Social Engineering – [email protected] (The Hacker News)

– [[{“value”:”The threat actors linked to the Black Basta ransomware have been observed switching up their social engineering tactics, distributing a different set of payloads such as Zbot and DarkGate since early October 2024. “Users within the target environment will be email bombed by the threat actor, which is often achieved by signing up the user’s email to numerous mailing...

Attack Feeds

Patch or Perish: The Forgotten Virtue of Diligence in Digital Security – [email protected]

– [[{“value”:” In the ever-evolving landscape of digital security, the adage “patch or perish” encapsulates a stark reality. The timely application of software patches is not just a best practice—it is a necessity. The vulnerabilities that lurk in unpatched software can serve as gateways for cybercriminals, leading to severe breaches, operational disruptions, and substantial financial losses. The imperative to keep...

Attack Feeds

⚡ THN Recap: Top Cybersecurity Threats, Tools and Tips (Dec 2 – 8) – [email protected] (The Hacker News)

– [[{“value”:”This week’s cyber world is like a big spy movie. Hackers are breaking into other hackers’ setups, sneaky malware is hiding in popular software, and AI-powered scams are tricking even the smartest of us. On the other side, the good guys are busting secret online markets and kicking out shady chat rooms, while big companies rush to fix new...