CVE-2022-41040 and CVE-2022-41082, the two exploited MS Exchange zero-days that still have no official fix, have been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog. But mitigating the risk of exploitation until patches are ready w…
Author: Zeljka Zorz
Global Security News, North America
Attackers use novel technique, malware to compromise hypervisors and virtual machines
by Zeljka Zorz •
Unknown attackers wielding novel specialized malware have managed to compromise VMware ESXi hypervisors and guest Linux and Windows virtual machines, Mandiant threat analysts have discovered. They named the malware VirtualPITA (ESXi & Linux), Virt…
Global Security News, North America
Two Microsoft Exchange zero-days exploited by attackers (CVE-2022-41040, CVE-2022-41082)
by Zeljka Zorz •
Attackers are leveraging two zero-day vulnerabilities (CVE-2022-41040, CVE-2022-41082) to breach Microsoft Exchange servers. News of the attacks broke on Wednesday, when researchers with Vietnamese cybersecurity company GTSC released a warning saying t…
Global Security News, North America
MS SQL servers are getting hacked to deliver ransomware to orgs
by Zeljka Zorz •
Cybercriminals wielding the FARGO (aka Mallox, aka TargetCompany) ransomware are targeting Microsoft SQL (MS SQL) servers, AhnLab’s ASEC analysis team has warned. They haven’t pinpointed how the attackers are getting access to the targeted …
Global Security News, North America
To encrypt or to destroy? Ransomware affiliates plan to try the latter
by Zeljka Zorz •
Ransomware gangs are planning on trying out a new tactic, and it involves the destruction of the victims’ data. Targeting the data Researchers from Symantec, Cyderes and Stairwell have recently analyzed a new version of the Exmatter data exfiltra…
Global Security News, North America
RCE in Sophos Firewall is being exploited in the wild (CVE-2022-3236)
by Zeljka Zorz •
Sophos has patched an actively exploited remote code execution vulnerability (CVE-2022-3236) in its Firewall solutions, and has pushed the fix to customers who have automatic installation of hotfixes enabled. If this news triggers a feeling of déjà vu,…
Global Security News, North America
Critical ManageEngine RCE flaw is being exploited (CVE-2022-35405)
by Zeljka Zorz •
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2022-35405, a critical remote code execution vulnerability in ManageEngine PAM360, Password Manager Pro, and Access Manager Plus, to its Known Exploited Vulnerabilities (KEV) …
Global Security News, North America
US to award $1B to state, local, and territorial governments to improve cyber resilience
by Zeljka Zorz • • 0 Comments
The US government will award $1 billion in grants to help state, local, and territorial (SLT) governments address cybersecurity risks, strengthen the cybersecurity of their critical infrastructure, and ensure cyber resilience against persistent cyber t…
Global Security News, North America
Uber hacked, attacker tears through the company’s systems
by Zeljka Zorz •
Uber has been hacked, again – this time by an 18-year-old (allegedly). According to The New York Times, the breach happened on Thursday. The hacker claims to have gotten in by social-engineering an Uber employee: Apparently there was an internal …
Global Security News, North America
US government software suppliers must attest their solutions are secure
by Zeljka Zorz •
The Office of Management and Budget (OMB) has issued a memo requiring US federal government agencies to use software that has been built according to secure software development practices and whose developers follow practices for software supply chain …
Global Security News, North America
Attackers mount Magento supply chain attack by compromising FishPig extensions
by Zeljka Zorz •
FishPig, a UK-based company developing extensions for the popular Magento open-source e-commerce platform, has announced that its paid software offerings have been injected with malware after its distribution server was compromised. How the attackers c…
Global Security News, North America
Phishers take aim at Facebook page owners
by Zeljka Zorz •
Phishers are looking to trick owners of Facebook pages with fake notices from the social network (i.e., Meta, the company behind Facebook, Instagram and WhatsApp), in an attempt to get them to part with sensitive information. The method they are using …
Global Security News, North America
Microsoft fixes exploited zero-day in the Windows CLFS Driver (CVE-2022-37969)
by Zeljka Zorz •
September 2022 Patch Tuesday is here, with fixes for 64 CVE-numbered vulnerabilities in various Microsoft products, including one zero-day (CVE-2022-37969) exploited by attackers. About CVE-2022-37969 CVE-2022-37969 is an elevation of privilege vulnera…
Global Security News, North America
U-Haul reports data breach, customers’ info exposed
by Zeljka Zorz •
U.S. moving and storage rental company U-Haul has suffered a data breach due to an unauthorized person having accessed an unspecified number of rental contracts, U-Haul’s parent company Amerco has revealed in a last week. It is not known have man…
Global Security News, North America
Apple fixes actively exploited zero-day in macOS, iOS (CVE-2022-32917)
by Zeljka Zorz •
Apple has fixed a slew of vulnerabilities in macOS, iOS, and iPadOS, including a zero-day kernel vulnerability (CVE-2022-32917) exploited by attackers in the wild. About CVE-2022-32917 CVE-2022-32917, reported by an anonymous researcher, may allow a ma…
Global Security News, North America
Thousands of QNAP NAS devices hit by DeadBolt ransomware (CVE-2022-27593)
by Zeljka Zorz •
QNAP Systems has provided more information about the latest DeadBolt ransomware campaign targeting users of its network-attached storage (NAS) devices and the vulnerability the attackers are exploiting (CVE-2022-27593). About CVE-2022-27593 CVE-2022-27…
Global Security News, North America
You should know that most websites share your in-site search queries with third parties
by Zeljka Zorz •
If you are using a website’s internal search function, chances are good that your search terms are being leaked to third parties in some form, researchers with NortonLifeLock have found. They tested 512,701 of the top 1 million sites that had int…
Global Security News, North America
High-risk ConnectWise Automate vulnerability fixed, admins urged to patch ASAP
by Zeljka Zorz •
ConnectWise has fixed a vulnerability in ConnectWise Automate, a popular remote monitoring and management tool, which could allow attackers to compromise confidential data or other processing resources. The severity of the vulnerability is merely ̶…
Global Security News, North America
DeadBolt is hitting QNAP NAS devices via zero-day bug, what to do?
by Zeljka Zorz •
A few days ago – and smack in the middle of the weekend preceding Labor Day (as celebrated in the U.S.) – Taiwan-based QNAP Systems has warned about the latest round of DeadBolt ransomware attacks targeting users of its QNAP network-attache…
Global Security News, North America
Google invites bug hunters to scrutinize its open source projects
by Zeljka Zorz •
Google wants to improve the security of its open source projects and those projects’ third-party dependencies by offering rewards for bugs found in them. “Depending on the severity of the vulnerability and the project’s importance, rewards …
Global Security News, North America
Should ransomware payments be banned? A few considerations
by Zeljka Zorz •
Several U.S. states have recently moved to ban local and state agencies and organizations funded by taxpayers’ dollars from paying off ransomware gangs, and a few more are gearing up to it. In this Help Net Security video interview, Alex Iftimie,…
Global Security News, North America
US-based CISOs get nearly $1 million per year
by Zeljka Zorz •
The role of the Chief Information Security Officer (CISO) is a relatively new senior-level executive position within most organizations, and is still evolving. To find out how current CISOs landed in that role, their aspirations, the compensation they …
Global Security News, North America
Patch critical flaw in Atlassian Bitbucket Server and Data Center! (CVE-2022-36804)
by Zeljka Zorz •
A critical vulnerability (CVE-2022-36804) in Atlassian Bitbucket Server and Data Center could be exploited by unauthorized attackers to execute malicious code on vulnerable instances. About CVE-2022-36804 Bitbucket Server and Data Center are used by so…
Global Security News, North America
LastPass breach: Source code, proprietary tech info stolen
by Zeljka Zorz •
“An unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information,” the makers of the…
Global Security News, North America
Phishing PyPI users: Attackers compromise legitimate projects to push malware
by Zeljka Zorz •
PyPI, the official third-party software repository for Python packages, is warning about a phishing campaign targeting its users. “We have additionally determined that some maintainers of legitimate projects have been compromised, and malware pub…
Global Security News, North America
How attackers use and abuse Microsoft MFA
by Zeljka Zorz •
Microsoft has been pushing for the use of multi-factor authentication (MFA) to thwart attackers for many years. But threat actors are keeping up with the increasing enterprise adoption of MFA and are constantly coming up with ways to bypass the additio…
Global Security News, North America
Critical RCE bug in GitLab patched, update ASAP! (CVE-2022-2884)
by Zeljka Zorz •
GitLab has fixed a remote code execution vulnerability (CVE-2022-2884) affecting the Community and the Enterprise Edition of its DevOps platform, and has urged admins to upgrade their GitLab instances immediately. The vulnerability was reported through…
Global Security News, North America
Fake DDoS protection pages are delivering malware!
by Zeljka Zorz •
Malware peddlers are exploiting users’ familiarity with and inherent trust in DDoS protection pages to make them download and run malware on their computer, Sucuri researchers have warned. Hidden malware and fake DDoS protection DDoS protection p…
Global Security News, North America
Vulnerability in Amazon Ring app allowed access to private camera recordings
by Zeljka Zorz •
A vulnerability in the Android version of the Ring app, which is used to remotely manage Amazon Ring outdoor (video doorbell) and indoor surveillance cameras, could have been exploited by attackers to extract users’ personal data and device’s dat…
Global Security News, North America
Apple fixes exploited zero-days: Update your devices! (CVE-2022-32894, CVE-2022-32893)
by Zeljka Zorz •
Apple has released security updates for iOS, iPadOS, and macOS Monterey to fix CVE-2022-32894 and CVE-2022-32893, two code execution vulnerabilities exploited by attackers in the wild. About the vulnerabilities (CVE-2022-32894, CVE-2022-32893) CVE-2022…
Global Security News, North America
Microsoft makes tamper protection for macOS endpoints widely available
by Zeljka Zorz •
The tamper protection feature in Microsoft Defender for Endpoint for macOS is getting rolled out to all customers, the company has announced on Monday. The feature is meant to: Protect the endpoint security solution/agent from being uninstalled or its …
Global Security News, North America
DigitalOcean customers affected by Mailchimp “security incident”
by Zeljka Zorz •
A recent attack targeting crypto-related users of Mailchimp has ended up affecting users of cloud infrastructure provider DigitalOcean, the latter company has announced on Monday. “On August 8th, DigitalOcean discovered that our Mailchimp account…
Global Security News, North America
1,900 Signal users exposed following Twilio breach
by Zeljka Zorz •
The attacker behind the recent Twilio data breach may have accessed phone numbers and SMS registration codes for 1,900 users of the popular secure messaging app Signal. “Among the 1,900 phone numbers, the attacker explicitly searched for three nu…
Global Security News, North America
Cisco has been hacked by a ransomware gang
by Zeljka Zorz •
U.S. networking giant Cisco Systems has been hacked, the company confirmed on Wednesday, after Yanluowang ransomware operators claimed the attack on their leak site. #Yanluowang #ransomware is claiming to have breached #Cisco ! Without any further info…
Global Security News, North America
Microsoft fixes exploited zero-day in Windows Support Diagnostic Tool (CVE-2022-34713)
by Zeljka Zorz •
The August 2022 Patch Tuesday has arrived, with fixes for an unexpectedly high number of vulnerabilities in various Microsoft products, including two zero-days: one actively exploited (CVE-2022-34713) and one not yet (CVE-2022-30134). Vulnerabilities t…
Global Security News, North America
Microsoft fixes exploited zero-day in Windows Support Diagnostic Tool (CVE-2022-34713)
by Zeljka Zorz •
The August 2022 Patch Tuesday has arrived, with fixes for an unexpectedly high number of vulnerabilities in various Microsoft products, including two zero-days: one actively exploited (CVE-2022-34713) and one not yet (CVE-2022-30134). Vulnerabilities t…
Global Security News, North America
Kali Linux 2022.3 released: Packages for test labs, new tools, and a community Discord server
by Zeljka Zorz •
Offensive Security has released Kali Linux 2022.3, the latest version of its popular penetration testing and digital forensics platform. Packaged apps to set up test labs The Kali Team knows the importance of practicing instead of relying on theory, an…
Global Security News, North America
Twilio confirmes data breach after its employees got phished
by Zeljka Zorz •
Cloud communications company Twilio has announced that some of it employees have been phished and that the attackers used the stolen credentials to gain access to some internal company systems and customer data. What happened? The attackers impersonate…
Global Security News, North America
Phishers use custom phishing kit to hijack MFA-protected enterprise Microsoft accounts
by Zeljka Zorz •
An ongoing, large-scale phishing campaign is targeting owners of business email accounts at companies in the FinTech, Lending, Insurance, Energy and Manufacturing sectors in the US, UK, New Zealand and Australia, Zscaler researchers are warning. The at…
Global Security News, North America
VMware: Patch this critical vulnerability immediately! (CVE-2022-31656)
by Zeljka Zorz •
VMware has released fixes for ten vulnerabilities, including CVE-2022-31656, an authentication bypass vulnerability affecting VMware Workspace ONE Access, Identity Manager and vRealize Automation, which the company considers critical and advises to pat…