CyberSecure Specialist

17 Feb

CISA Warns of Windows and iOS Bugs Exploited as Zero-days

Attacks, Malware

While CISA’s directive only applies to United States federal agencies, it is encouraged and best practice that organizations also follow this timeline to patch their vulnerabilities. In cybersecurity, a timely patching schedule is an important factor of securing an environment, as many threat actors will attempt to exploit recently released 0-days before organizations have a chance to patch them. On top of a timely patching schedule, it is also important to employ a defense-in-depth strategy.…

Read More
17 Feb

New Mirai botnet variant V3G4 targets Linux servers, IoT devices

Data Breaches, Malware, Social Engineering

A new variant of Mirai — the botnet malware used to launch massive DDoS attacks —has been targeting 13 vulnerabilities in IoT devices connected to Linux servers, according to researchers at Palo Alto Network’s Unit 42 cybersecurity team.  Once the vulnerable devices are compromised by the variant, dubbed V3G4, they can fully controlled by attackers and become part of a botnet, capable of being used to conduct further campaigns, including DDoS attacks.  “The vulnerabilities have…

Read More
17 Feb

Newly Disclosed Vulnerability Exposes EOL Arris Routers to Attacks

Information, News

Malwarebytes warns of a remote code execution vulnerability impacting several Arris routers, for which proof-of-concept (PoC) exploit code has been released. Tracked as CVE-2022-45701, the bug exists because the router firmware does not properly neutralize special characters in requests, which allowed security researcher Yerodin Richards to perform shell script command injection. The impacted models have reached end-of-life (EOL) and are no longer supported by CommScope (the company that acquired Arris), meaning that they are unlikely…

Read More
17 Feb

‘Frebniis’ Malware Hijacks Microsoft IIS Function to Deploy Backdoor

Information, News

A recently identified malware family is abusing Microsoft Internet Information Services (IIS) to deploy a backdoor and monitor all HTTP traffic to the infected system, Symantec reports. Dubbed Frebniis, the malware injects code into a DLL that an IIS feature called Failed Request Event Buffering (FREB) uses when troubleshooting failed requests. FREB collects data about the tracked requests, including HTTP headers with cookies, originating IP address and port, and more. As part of the observed…

Read More
17 Feb

IOTW: Russian hackers target NATO sites with DDoS attack

Attacks, Data Breaches

The North Atlantic Treaty Organization (NATO) has been the victim of a series of distributed denial of service (DDoS) attacks, causing temporary disruption to some of its sites. The DDoS attacks have been linked to the Russian hacktivist collective Killnet which had posted via an encrypted channel on social media platform Telegram that it was planning to launch attacks against NATO. The group also appeared to be asking for cryptocurrency donations to launch further attacks.…

Read More
16 Feb

ChatGPT, will you be my Valentine?

Information

Spoiler alert: it turned me down. But that’s far from the only thing I learned while playing around with the bot that the world has fallen in love with so badly. When it was unleashed into an astonished world on November 30th 2022, ChatGPT became the fastest-growing web app ever, reaching a million users in the first five days before going on to clock 100 million monthly active users in January of this year. In so doing,…

Read More
16 Feb

10 signs that scammers have you in their sights

Information

Don’t be their next victim – here’s a handy round-up of some the most common signs that should set your alarm bells ringing We all spend so much of our time online these days. It’s estimated that the average adult spends the best part of seven hours per day glued to their screens. When we’re finished with work, we’re hitting up our apps to watch TV, do our online banking, play games, socialize with friends…

Read More
16 Feb

S3 Ep122: Stop calling every breach “sophisticated”! [Audio + Text]

Information

by Paul Ducklin CAN WE STOP WITH THE “SOPHISTICATED” ALREADY? The birth of ENIAC. A “sophisticated attack” (someone got phished). A cryptographic hack enabled by a security warning. Valentine’s Day Patch Tuesday. Apple closes spyware-sized 0-day hole. Click-and-drag on the soundwaves below to skip to any point. You can also listen directly on Soundcloud. With Doug Aamoth and Paul Ducklin Intro and outro music by Edith Mudge. You can listen to us on Soundcloud, Apple…

Read More
16 Feb

Malware authors leverage more attack techniques that enable lateral movement

Data Breaches, Malware, Social Engineering

A new study of over a half-million malware samples collected from various sources in 2022 revealed that attackers put a high value on lateral movement, incorporating more techniques that would allow them to spread through corporate networks. Several of the most prevalent tactics, as defined by the MITRE ATT&CK framework, that were identified in the dataset aid lateral movement, including three new ones that rose into the top 10. “An increase in the prevalence of…

Read More
16 Feb

Havoc Post Exploitation Framework Observed in the Wild

Attacks, Malware

Here are some recommendations on how to defend against Havoc: Keep software up to date: As with Cobalt Strike, keeping your software up to date is essential in defending against Havoc. This includes both operating systems and software applications. Use strong authentication: Implement strong authentication methods to prevent unauthorized access to your systems, and use unique and strong passwords for all accounts. Monitor network traffic: Monitor your network traffic for any unusual activity, such as…

Read More