Search results for: vulnerability

malware

Researchers outline the Lazarus APT offensive toolset

ESET researchers uncovered and analyzed a set of malicious tools that were used by the Lazarus APT group in attacks during the end of 2021. The campaign started with spear phishing emails containing malicious Amazon-themed documents, and it targeted an employee of an aerospace company in the Netherlands and a political journalist in Belgium. The primary goal of the attackers was data exfiltration. Amazon-themed document sent to the target in the Netherlands. Source: ESET Both … More

malware

Detecting fileless malware infections is becoming easier

For some analysts, memory analysis is only an optional step in cybersecurity investigations. Their reasons are simple. One: Handling memory and volatile data is a complex endeavor, made more difficult by legacy tools. Two: The average analyst is a highly educated individual but is generally not an expert in memory architecture. That knowledge is often reserved for systems engineers. And three: The few analysts who do possess that expertise are writing code or concentrate on … More

week in review

Week in review: MS Exchange zero-days exploited, AD attack paths, developing secure APIs

SpyCast: Cross-platform mDNS enumeration tool SpyCast is a cross-platform mDNS enumeration tool that can work either in active mode by recursively querying services or in passive mode by only listening to multicast packets. Attackers use novel technique, malware to compromise hypervisors and virtual machines Unknown attackers wielding novel specialized malware have managed to compromise VMware ESXi hypervisors and guest Linux and Windows virtual machines, Mandiant threat analysts have discovered. To encrypt or to destroy? Ransomware … More

vmware

Attackers use novel technique, malware to compromise hypervisors and virtual machines

Unknown attackers wielding novel specialized malware have managed to compromise VMware ESXi hypervisors and guest Linux and Windows virtual machines, Mandiant threat analysts have discovered. They named the malware VirtualPITA (ESXi & Linux), VirtualPIE (ESXi), and VirtualGATE (Windows), and shared detection and hardening advice. The malware and techniques used by the attackers VirtualPITA and VirtualPIE are backdoors, which the attackers deliver by using malicious vSphere Installation Bundles (VIBs). VirtualGATE is a utility program that incorporates … More

Microsoft Exchange

Two Microsoft Exchange zero-days exploited by attackers (CVE-2022-41040, CVE-2022-41082)

Attackers are leveraging two zero-day vulnerabilities (CVE-2022-41040, CVE-2022-41082) to breach Microsoft Exchange servers. News of the attacks broke on Wednesday, when researchers with Vietnamese cybersecurity company GTSC released a warning saying that, “while providing SOC service to a customer, GTSC Blueteam detected exploit requests in IIS logs with the same format as ProxyShell vulnerability.” About the vulnerabilities (CVE-2022-41040, CVE-2022-41082) CVE-2022-41040 is a Server-Side Request Forgery (SSRF) vulnerability and CVE-2022-41082 allows remote code execution when PowerShell … More

Handshake

Cybeats partners with Veracode to help customers manage SBOM and software vulnerabilities

Cybeats Technologies and Veracode partnership will leverage complementary expertise to ensure customers receive the highest standard of cybersecurity solutions. Cybeats’ software supply chain security product, SBOM Studio, will be available to customers through Veracode Partners, and the companies will explore joint commercial opportunities. Once generated within the Veracode Continuous Software Security Platform, a Software Bill of Materials (SBOM) can enable greater software security by offering a full inventory of the third-party components used within an … More

fire

Office exploits continue to spread more than any other category of malware

The latest Internet Security Report from the WatchGuard Threat Lab shows a reduction in overall malware detections from the peaks seen in the first half of 2021, along with an increase in threats for Chrome and Microsoft Office and the ongoing Emotet botnet resurgence. Office exploits on the rise “While overall malware attacks in Q2 fell off from the all-time highs seen in previous quarters, over 81% of detections came via TLS encrypted connections, continuing … More

security platform

Aunalytics Security Patching Platform protects users against system compromise

Aunalytics initiated its Security Patching Platform, Co-managed Patching as a Service to complement the company’s Advanced Security solution suite. Windows OS and supported 3rd party patch management allow for tighter security in the defense against cyberattacks and the new offering ensures active remediation. According to a 2022 Data Breach Investigations Report by Verizon, around 70 percent of successful cyberattacks exploited known vulnerabilities with available patches, making it important to update operating systems and applications regularly … More

security platform

Malwarebytes enhances OneView platform to improve protection for SMB customers

Malwarebytes has expanded its OneView platform capabilities as well as grow the company’s Managed Service Provider (MSP) program. In addition to endpoint security, MSPs can now access vulnerability assessment, patch management and Domain Name System (DNS) filtering from Malwarebytes OneView. “At Malwarebytes, we aim to serve the underserved, which is what our MSP partners are doing every day for SMBs,” said Brian Thomas, Vice President of Worldwide MSP & Channel Programs at Malwarebytes. “I joined … More

Wolfi Linux

Wolfi Linux provides the control needed to fix modern supply chain threats

There’s been a massive push for supply chain security in the last few years: integrity protection, vulnerability management, and transparency. This push has left organizations struggling to secure their pipelines and manage vulnerabilities, especially when running in the cloud. Existing tooling doesn’t support supply chain security natively and requires users to bolt on critical features like signatures, provenance, and software bills of material (SBOM). In this Help Net Security video, Dan Lorenc, CEO at Chainguard, … More

security platform

CertifID launches PayoffProtect to authenticate loan payoff wiring

CertifID has launched PayoffProtect, which gives title, escrow and settlement companies peace of mind by preventing property loan payoffs from being sent to fraudsters. This launch comes on the heels of its recent $12.5 million Series A funding by Arthur Ventures, known for leading investments in business-to-business software companies. The new PayoffProtect solution combines CertifID’s expert knowledge and suite of intellectual property. The latter includes machine learning capabilities that are now being leveraged to automate … More

Handshake

Fortress Information Security collaborates with ONG-ISAC to improve supply chain cybersecurity

Fortress Information Security and the Oil and Natural Gas Information Sharing Analysis Center (ONG-ISAC) announced an industry-wide initiative focused on securing hardware and software components and supply chains. The software and hardware used by oil and natural gas systems are critical to the industry’s reliable and safe operation. In addition, the supply chains for these products are at increased risk of compromise. Fortress will enable ONG-ISAC members to manage these risks securely and cost-effectively. For … More