Attacks

10 Mar

Xenomorph Android Malware Now Steals Banking Data

Attacks, Malware

Considering its current distribution channel, the Zombinder, users should be cautious with apps they install from Google Play, read reviews, and run background checks on the publisher. Generally, it is advisable to keep the number of apps running on your phone to the minimum possible and only install apps from known and trustworthy vendors. Source: https://www.bleepingcomputer.com/news/security/xenomorph-android-malware-now-steals-data-from-400-banks/

Read More
10 Mar

What are DDoS attacks?

Attacks, Data Breaches

Distributed denial of service attacks, or DDoS attacks, see malicious actors attempt to disrupt a site by overwhelming its infrastructure with a large amount of internet traffic. As DDoS attacks overwhelm a site’s bandwidth, this prevents users from accessing it.  Here, Cyber Security Hub explores why malicious actors launch DDoS attacks, who they usually target and some key examples of these disruptive attacks.  Contents  Why do malicious actors launch DDoS attacks? How big was the…

Read More
10 Mar

Fortinet has released its March…

Attacks, Insights, Malware

Fortinet has released its March 2023 Vulnerability Advisories to address vulnerabilities affecting multiple products. An attacker could exploit one of these vulnerabilities to take control of an affected system.    CISA encourages users and administrators to review the Fortinet March 2023 Vulnerability Advisories page for more information and apply the necessary updates. Please share your thoughts. We recently updated our anonymous Product Feedback Survey and we’d welcome your feedback.

Read More
09 Mar

New ScrubCrypt Crypter Used in Cryptojacking Attacks Targeting Oracle WebLogic

Attacks, Malware

It is highly recommended to make sure all systems are fully up-to-date on patching, particularly systems that are externally facing. It appears that the threat actors are exploiting an Oracle WebLogic vulnerability from 2017, dubbed CVE-2017-10271, to establish an initial foothold in the environment. Newer versions of Oracle WebLogic are no longer vulnerable to this, so upgrading to the latest version is recommended to help prevent this attack. Likewise, implementing and maintaining endpoint security controls,…

Read More
09 Mar

Fortinet Warns about Critical Vulnerability in FortiOS and FortiProxy Could

Attacks, Malware

Security patches are available in the following versions: • FortiOS v.6.2.13, v.6.4.12, v.7.0.10, v.7.2.4, v.7.4.0• FortiOS-6K7K v.6.2.13, v.6.4.12, v.7.0.10• FortiProxy v.2.0.12, 7.0.9, v.7.0.9 Fortinet also advises customers to disable the HTTP/HTTPS administration interface or restrict the IP addresses that can access it as workarounds. It is recommended for organizations to implement these changes to secure administration interfaces, regardless of their vulnerability management cycle and patch deployment. https://thehackernews.com/2023/03/new-critical-flaw-in-fortios-and.html

Read More
09 Mar

Qilin Claims Ransomware Attack on Elderly Care Facility

Attacks, Malware

These attacks can have severe consequences for both the affected organization and its clients or customers, as sensitive information can be leaked or lost, and operations can be disrupted.To prevent these attacks, organizations must take measures to secure their networks and train employees on how to spot and avoid phishing emails and other types of social engineering attacks. It is also essential to have a robust backup system in place so that data can be…

Read More
08 Mar

CapraRAT Targets India and Pakistan in Espionage Campaign

Attacks, Malware

Espionage groups using social engineering tactics on government and military officials are nothing new. This campaign demonstrates the risks associated with downloading apps outside of app stores that are maintained by a trusted source. Furthermore, this highlights the importance of segmenting personal and professional devices. Compromising a personal phone, while impactful, could have a greatly reduced impact if that device doesn’t contain confidential information that an attacker could be seeking out. Source: https://thehackernews.com/2023/03/transparent-tribe-hackers-distribute.html

Read More
08 Mar

New Malware Variant Features a “Radio Silence” Mode to Evade Detection

Attacks, Malware

While many of the capabilities of this malware framework are rather typical, this “Radio Silence” mode is somewhat novel and is not seen displayed by many malware implants. Many times, malware in an environment can be identified through abnormal communications, such as a large number of connections from a host over the weekend that is typically dormant. With this feature, however, the operators can pick and choose when they want their communications to be sent,…

Read More
08 Mar

CISA has added three new…

Attacks, Insights, Malware

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2022-28810 Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability CVE-2022-33891 Apache Spark Command Injection Vulnerability CVE-2022-35914 Teclib GLPI Remote Code Execution Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Note: To view other newly added vulnerabilities in the catalog, click on the arrow in…

Read More