Welcome

News, Announcements, Tech Discussions

42269 Topics

TripleHelixModerator

posted in Security Industry News

CVEs have been published or revised in the Security Update Guide November 20, 2023

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:CVE-2023-36013· Title: PowerShell Information Disclosure Vulnerability· Version: 1.0· Reason for revision: Information published.· Originally released: November 17, 2023· Last updated: November 17, 2023· Aggregate CVE Severity Rating: ImportantCVE-2023-36049· Title: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability· Version: 2.0· Reason for revision: Revised the Security Updates table to include PowerShell 7.2, PowerShell 7.3, and PowerShell 7.4 because these versions of PowerShell 7 are affected by this vulnerability.· Originally released: November 14, 2023· Last updated: November 16, 2023· Aggregate CVE Severity Rating: ImportantCVE-2023-36049· Title: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability· Version: 2.1· Reason for revision: Updated the build numbers. This is an informational update only.· Original

TylerMSr. Security Analyst & Community Manager

published in Threat Reports

Nastiest Malware 2023Nastiest Malware

Stream the Webinar on demand!Check out our Nastiest Malware infographic attached below! We've been doing the Nastiest Malware series for over 5 years now and in that time, we have seen a steady increase in the number and sophistication of malware attacks. Ransomware has been the most prevalent type of malware, with cybercriminals increasingly targeting businesses and organizations. Criminal actors in the Ransomware sector have come up with new “business models” and ransomware-as-a-service (RaaS) is dominating. Elite Ransomware authors appear to have concluded that profit sharing and risk mitigation are top contributors to their consistent success and reliable evasion from authorities. Malware payloads are becoming more sophisticated and difficult to detect, and we expect their tactics to be ever evolving. Reflecting on the past five years of the malware landscape offers invaluable insights into the evolution of cyber threats. In 2019, the most prevalent malware was Emotet, a botnet th

Jasper_The_RasperModerator

posted in Security Industry News

CISA Launches Pilot Program to Address Critical Infrastructure Threats

CISA expects to extend this program to include up to 100 critical infrastructure entities in its first year. November 20, 2023 By Dark Reading Staff Last week, CISA announced that it is launching a pilot program designed to provide cybersecurity services to critical infrastructure entities in need.The blog post, written by Eric Goldstein, executive assistant director for cybersecurity at the agency, detailed how cyberattacks are affecting the day-to-day operations of critical infrastructure organizations and are increasing in volume and impact, citing the ransomware attack on Colonial Pipeline and increasingly advanced threat actors that specialize in critical infrastructure.The pilot program is a response to this threat environment and CISA already has it underway, deploying its Protective Domain Name System to organizations that are participating in the pilot, a resource that was previously limited in its availability. >> Full Article <<

Jasper_The_RasperModerator

posted in Security Industry News

Kinsing malware exploits Apache ActiveMQ RCE to plant rootkits

November 20, 2023 By Bill Toulas The Kinsing malware operator is actively exploiting the CVE-2023-46604 critical vulnerability in the Apache ActiveMQ open-source message broker to compromise Linux systems.The flaw allows remote code execution and was fixed in late October. Apache’s disclosure explains that the issue allows running arbitrary shell commands leveraging serialized class types in the OpenWire protocol.Researchers found that thousands of servers remained exposed to attacks after the release of the patch and ransomware gangs like HelloKitty and TellYouThePass started to take advantage of the opportunity. >> Full Article <<

Jasper_The_RasperModerator

posted in Security Industry News

Canadian government discloses data breach after contractor hacks

November 20, 2023 By Sergiu Gatlan The Canadian government says two of its contractors have been hacked, exposing sensitive information belonging to an undisclosed number of government employees. These breaches occurred last month and impacted Brookfield Global Relocation Services (BGRS) and SIRVA Worldwide Relocation & Moving Services, both providers of relocation services to Canadian government employees. Government-related information stored on compromised BGRS and SIRVA Canada systems dates back to 1999, and it belongs to a broad spectrum of affected individuals, including members of the Royal Canadian Mounted Police (RCMP), Canadian Armed Forces personnel, and Government of Canada employees.While the Canadian government has yet to attribute the incident, the LockBit ransomware gang has already claimed responsibility for breaching SIRVA's systems and leaked what they claim to be archives containing 1.5TB of stolen documents. >> Full Article <<

Jasper_The_RasperModerator

posted in Security Industry News

DARKCASINO JOINS THE LIST OF APT GROUPS EXPLOITING WINRAR ZERO-DAY

November 20, 2023 By Pierluigi Paganini The DarkCasino APT group leveraged a recently disclosed WinRAR zero-day vulnerability tracked as CVE-2023-38831.Researchers at cybersecurity firm NSFOCUS analyzed DarkCasino attack pattern exploiting the WinRAR zero-day vulnerability tracked as CVE-2023-38831. The economically motivated APT group used specially crafted archives in phishing attacks against forum users through online trading forum posts.“DarkCasino is an APT threat actor with strong technical and learning ability, who is good at integrating various popular APT attack technologies into its attack process. In the early days, the APT group DarkCasino mainly drew on the attack idea of an APT attacker named Evilnum and used malicious shortcuts, image steganography and other technologies to realize phishing attacks.” reads the report published by NSFOCUS. >> Full Article <<

Jasper_The_RasperModerator

posted in Security Industry News

LummaC2 4.0 infostealer uses trigonometry to avoid sandboxes

November 20, 2023 By Steve Zurier Researchers believe LummaC2 4.0 functions as a dynamic malware strain that remains under active development. (Sashkin via Adobe Stock Images)The ever-evolving LummaC2 infostealer now has a 4.0 version that makes use of a novel anti-sandbox technique that forces the malware to wait until “human” behavior is detected in the infected machine.The technique uses trigonometry to take into consideration different positions of the cursor in a short interval so the malware can avoid detonation in a sandbox and execute it on the target system when the malware detects a human moving a mouse.In a Nov. 20 blog post, Outpost24 researchers reported that infostealers such as LummaC2 4.0 pose significant risks because they have the potential to inflict substantial harm on individuals and organizations, including privacy breaches and the unauthorized exposure of confidential data. >> Full Article <<

Jasper_The_RasperModerator

posted in Security Industry News

Sophos Web Appliance vulnerability exploited in the wild (CVE-2023-1671)

November 20, 2023 By Helga Labus, CISA has added three vulnerabilities to its Known Exploited Vulnerabilities catalog, among them a critical vulnerability (CVE-2023-1671) in Sophos Web Appliance that has been patched by the company in April 2023. About CVE-2023-1671 CVE-2023-1671 is a pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance that allows attackers to execute arbitrary code.Sophos Web Appliance is a web gateway appliance that functions as a web proxy and scans potentially harmful content for numerous forms of malware.The vulnerability was disclosed in early April by an external security researcher through the Sophos bug bounty program . It affected all versions of the appliances prior to version 4.3.10.4.At the time, the company pushed out the update with the fix to all Sophos Web Appliance customers who haven’t switched off the “automatic update” setting (which is on by default). Sophos also advised customers to keep the device behind

Jasper_The_RasperModerator

posted in Security Industry News

Morgan Stanley Fined $6.5 Million for Exposing Customer Information

Morgan Stanley agrees to pay $6.5 million for exposing personal information through negligent data-security practices. November 20, 2023 By Ionut Arghire Morgan Stanley has agreed to a $6.5 million settlement over insecurely disposing of hardware containing unencrypted personal information.Through negligent internal data security practices, the multinational investment bank and financial services company potentially exposed the personal information of millions of customers, the Florida Attorney General’s Office says.An investigation into the company uncovered that it did not properly erase unencrypted personal information stored on devices that were being decommissioned. >> Full Article <<

Jasper_The_RasperModerator

posted in Security Industry News

Cybersecurity firm executive pleads guilty to hacking hospitals

November 20, 2023 By Sergiu Gatlan The former chief operating officer of a cybersecurity company has pleaded guilty to hacking two hospitals, part of the Gwinnett Medical Center (GMC), in June 2021 to boost his company's business.Vikas Singla, who worked for Securolytics, a network security company that provided services to the healthcare industry, pleaded guilty to hacking into the systems of GMC Northside Hospital hospitals in Duluth and Lawrenceville, as prosecutors said in a June 2021 indictment.During his attack on September 27, 2018, he disrupted the health provider's phone and network printer services, and he stole the personal information of more than 200 patients from a Hologic R2 Digitizer digitizing device connected to a mammogram machine on GMC's Lawrenceville hospital.On the same day, Singla used over 200 printers in the GMC hospital in Duluth to print stolen patient information and "WE OWN YOU" messages. >> Full Article <<

Jasper_The_RasperModerator

posted in Security Industry News

Konni Campaign Distributed Via Malicious Document

By Cara Lin | November 20, 2023 Affected Platforms: Microsoft WindowsImpacted Users: Microsoft WindowsImpact: Remote attackers gain control of the infected systemsSeverity Level: Critical FortiGuard Labs recently identified the use of a Russian-language Word document equipped with a malicious macro in the ongoing Konni campaign. Despite the document's creation date of September, ongoing activity on the campaign's C2 server is evident in internal telemetry, as shown in Figure 1.This campaign relies on a remote access trojan (RAT) capable of extracting information and executing commands on compromised devices. Operating for several years, this campaign employs diverse strategies for initial access, payload delivery, and establishing persistence within victims' networks. In this blog, we will elaborate on the behavior of the malware at each stage.Figure 1: Telemetry >> Full Article <<

TripleHelixModerator

posted in News & Announcements

Planned Upgrade - Webroot Management Console Scheduled for Nov 28, 07:00 - 10:00 UTC

Scheduled On Tuesday November 28th at 7:00 a.m. UTC, Webroot will commence an Upgrade to the Webroot Management Console. The maintenance window is scheduled to last up to 3 hours. During this period, console access will be unavailable. All other Webroot services will be working as normal, including scanning and protecting your devices. We apologize for any inconvenience caused by this essential maintenance window.The release will remove access to the Endpoint Protection Console.Posted 2 days ago. Nov 16, 2023 - 10:43 UTC This scheduled maintenance affects: SecureAnywhere® Protection for Windows® & Apple® Computers, Webroot Management Consoles, DNS Protection, and Security Awareness Training. https://status.webroot.com/incidents/sz0qmgnt7n9p