Attacks

16 Feb

Havoc Post Exploitation Framework Observed in the Wild

Attacks, Malware

Here are some recommendations on how to defend against Havoc: Keep software up to date: As with Cobalt Strike, keeping your software up to date is essential in defending against Havoc. This includes both operating systems and software applications. Use strong authentication: Implement strong authentication methods to prevent unauthorized access to your systems, and use unique and strong passwords for all accounts. Monitor network traffic: Monitor your network traffic for any unusual activity, such as…

Read More
16 Feb

Hackers Using Google Ads to Spread FatalRAT Malware Disguised as Popular Apps

Attacks, Malware

Malicious Google Ads are becoming popular among threat actors as an infection vector for malware. Due to this, it is highly recommended to use an adblocker software when performing Google searches, particularly when searching for popular applications like Chrome or Telegram. This can help prevent a user from accidentally clicking on one of these malicious advertisement websites as opposed to the software’s legitimate site. Likewise, it is important to always double-check the URL of a…

Read More
16 Feb

Russian Hacker Convicted of $90 Million Hack-to-Trade Charges

Attacks, Malware

Global joint law enforcement cooperation has been the key to taking down cyber criminals. Often operating out of several countries, threat actors are being exposed more and more due global cooperation among law enforcement. The director of the FBI stated in August 2022, that cyber threat actors have become a top priority for the FBI and other law enforcement partners. The director stated cooperation was the key to success, “We must impose consequences on cyber…

Read More
16 Feb

CISA Releases Fifteen Industrial Control Systems Advisories

Attacks, Insights, Malware

Original release date: February 16, 2023 CISA released fifteen (15) Industrial Control Systems (ICS) advisories on February 16, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations: ICSA-23-047-01 Siemens Solid Edge ICSA-23-047-02 Siemens SCALANCE X-200 IRT ICSA-23-047-03 Siemens Brownfield Connectivity Client ICSA-23-047-04 Siemens Brownfield Connectivity Gateway ICSA-23-047-05 Siemens SiPass integrated AC5102/ACC-G2 and…

Read More
15 Feb

Threat Actors Spoofing Emsisoft Certificates to Breach Networks

Attacks, Malware

This form of attack is not novel by any means and has been successfully leveraged by many groups in the past. Perhaps the best form of prevention is to ensure that all security analysts are aware of this form of attack. Apart from spreading awareness, an organization could also ensure that their security controls are set to block files with invalid signatures from running. Additionally, ensure that RDP ports are only open on devices where…

Read More
15 Feb

Microsoft Patch Tuesday Addresses Multiple Zero Days

Attacks, Malware

Due to the risks involved with these vulnerabilities, these updates should be tested and pushed to production environments as soon as policies allow. These attacks require initial access to be effective, and phishing emails are the most prominent method of gaining that first foothold. Ensuring that users know the risks of phishing emails and how to detect them can help protect an organization. Remote Code Execution and Privilege Escalation vulnerabilities are inevitable with the increasing…

Read More
15 Feb

Microsoft: Exchange Server 2013 Reaches End of Support in April

Attacks, Malware

It is recommended to upgrade any instances of Exchange 2013 to a newer version of Exchange as soon as possible. Exchange 2013 servers can also be migrated to Microsoft’s hosted Exchange Online email and calendaring solution, available as an Office 365 subscription or as a stand-alone service. Once mailboxes, public folders, and other data are migrated, admins can remove on-premises Exchange servers and Active Directory. Microsoft recently urged customers to keep their on-premises Exchange servers…

Read More
14 Feb

Mozilla Releases Security Updates for Firefox 110 and Firefox ESR

Attacks, Insights, Malware

Original release date: February 14, 2023 Mozilla has released security updates to address vulnerabilities in Firefox 110 and Firefox ESR. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Mozilla’s security advisories for Firefox 110 and Firefox ESR 102.8 for more information and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
14 Feb

Citrix Releases Security Updates for Workspace Apps, Virtual Apps and Desktops

Attacks, Insights, Malware

Original release date: February 14, 2023 Citrix has released security updates to address high-severity vulnerabilities (CVE-2023-24486, CVE-2023-24484, CVE-2023-24485, and CVE-2023-24483) in Citrix Workspace Apps, Virtual Apps and Desktops. A local user could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Citrix security bulletins CTX477618, CTX477617, and CTX477616 for more information and to apply the necessary updates. This product is provided subject to this Notification and this…

Read More
14 Feb

CISA Adds Four Known Exploited Vulnerabilities to Catalog

Attacks, Insights, Malware

Original release date: February 14, 2023 CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Note: To view the newly added vulnerabilities in the catalog, click on the arrow in the “Date Added to Catalog” column, which will sort by descending dates. Binding Operational Directive (BOD) 22-01:…

Read More