The LockFile ransomware emerged in July 2021. The ransomware has been exploiting the ProxyShell vulnerabilities in Microsoft Exchange servers in its attacks. The flaws are deployed “to breach targets with unpatched, on premises Microsoft Exchange servers, followed by a PetitPotam…
ProxyToken, or CVE-2021-33766 is a serious security vulnerability in Microsoft Exchange that could allow an unauthenticated threat actor to access and steal emails from the victim’s mailbox. The issue was reported to the Zero Day Initiative in March 2021 by…
Microsoft researchers detected a new phishing campaign leveraging open redirector links (open redirects) in emails in an attempt to bypass security software and trick users into visiting malicious pages. Related: Microsoft and Google’s Cloud Infrastructure Abused by Hackers in Phishing…
In July, Kaseya announced three new zero-day vulnerabilities impacting its Kaseya Unitrends service. The vulnerabilities were represented by an authenticated RCE flaw on the server, a privilege escalation flaw from read-only user to admin on the server, and an undisclosed…
Palo Alto’s Unit 42 researchers shed light on four emerging ransomware groups making the headlines this year. The discovery comes after an extensive research and analysis of the underground including web leak sites and fresh onion sites. These ransomware-as-a-service operators…
What are the threats endangering Linux systems? Security researchers from Trend Micro just released a report focused on the “pressing security issues including malware and vulnerabilities that compromise Linux systems in the first half of 2021.” Related: The Facefish Operation:…
Security researchers are reporting emails soliciting company insiders to install the Demon (Black Kingdom) ransomware on their organizations’ networks. Nigerian Threat Actor Behind the Campaign According to a report by Abnormal Security, a Nigerian threat actor is trying to recruit…
According to an alert released by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), cybercriminals are currently exploiting the so-called ProxyShell Microsoft Exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. CISA Warns against ProxyShell Attacks The agency’s strong advice is for organizations…
There is a recently disclosed unpatched flaw in Fortinet’s web application firewall appliances. The vulnerability could be exploited by remotes authenticated attackers to execute malicious commands. Related: Top Exploited Vulnerabilities in 2020: Hackers Take Advantage of Remote Work In other…
AdLoad is a well-known adware and bundleware loaders family which has been targeting macOS users since 2017, or even earlier. The threat installs a backdoor on the system to drop adware and potentially unwanted applications (PUAs), and also collects information.…
Facebook is rolling out optional end-to-end encryption for video and voice calls on Messenger, along with updates controls for disappearing messages. The new features are coming to address users’ expectations and needs for security and privacy, allowing users to be…
Heimdal security researchers were just informed about a new ransomware strain, signed by a group called DeepBlueMagic. Apparently, the new strain is rather complex, displaying innovative approaches in terms of its file encryption. The compromised device the researchers analyzed was…
A new nefarious information stealer has been detected in the wild. Dubbed Ficker and detected by the BlackBerry Research & Intelligence Team, the infostealer is sold and distributed on Russian underground forums by a hacker known as @ficker. The malware…
FortBridge security researchers recently achieved remote code execution and privilege escalation on cPanel, the popular web hosting control panel software, and WHM using a stored cross-site scripting (XSS) flaw. cPanel Flaws Discovered During Black-Box Pentest The team discovered multiple vulnerabilities…
Accenture is the latest victim of the LockBit ransomware gang. LockBit Ransomware Hits Accenture The cybercriminals recently posted the name and logo of the company, which is a global business consulting firm. As such, Accenture’s clients include 91 names of…
Poly Network, a China-based cryptocurrency platform for exchanging tokens across multiple blockchains, was a victim of an attack due to a vulnerability in its system. As a result, the staggering amount of $611 million worth of cryptocurrency were siphoned from…
Microsoft’s August 2021 Patch Tuesday just rolled out, addressing 51 security vulnerabilities, including more Print Spooler issues, a zero-day, and seven critical flaws. Reports indicate that the zero-day, known under the CVE-2021-36948 advisory has been actively exploited in the wild.…
There’s a newly developed malware on the radar of security researchers who believe that it could be released into the wild soon. The malware, which is still under construction, is called Chaos and was spotted in underground ads where it…
A recently disclosed vulnerability in routers running Arcadyan firmware is currently being exploited in the wild by unknown threat actors. The vulnerability, which was disclosed by Tenable researchers on August 3, has been around for at least a decade. Affected…
Security researchers Dan Petro and Allan Cecil from Bishop Fox Labs recently shared their findings regarding an RNG vulnerability in the foundation of IoT (Internet of Things) security. The critical flaw resides in hardware number generators (RNGs) and affects 35…
