Attacks

27 Jan

Exploit Released for Critical Windows CryptoAPI Spoofing Bug

Attacks, Malware

It is highly recommended to install security patches on all Windows systems in an environment, particularly any that are exposed to the Internet. As vulnerabilities are discovered, maintaining a consistent patching cycle for devices can help reduce attack surface and prevent an environment from being breached. Threat actors have been known to still use fixed vulnerabilities that are months old, due to inconsistent patching among many systems around the world. It is also recommended to…

Read More
27 Jan

U.S. Federal Agencies Fall Victim to Cyber Attack Utilizing Legitimate RMM Software

Attacks, Malware

The authoring organizations encourage network defenders to:• Implement best practices to block phishing emails.• Audit remote access tools on your network to identify currently used and/or authorized RMM software.• Review logs for execution of RMM software to detect abnormal use of programs running as a portable executable.• Use security software to detect instances of RMM software only being loaded in memory.• Implement application controls to manage and control execution of software, including allow listing RMM…

Read More
27 Jan

ISC Releases Security Advisories for Multiple Versions of BIND 9

Attacks, Insights, Malware

Original release date: January 27, 2023 The Internet Systems Consortium (ISC) has released security advisories that address vulnerabilities affecting multiple versions of the ISC’s Berkeley Internet Name Domain (BIND) 9. A remote attacker could exploit these vulnerabilities to potentially cause denial-of-service conditions and system failures. CISA encourages users and administrators to review the following ISC advisories CVE-2022-3094, CVE-2022-3488, CVE-2022-3736, and CVE-2022-3924 and apply the necessary mitigations. This product is provided subject to this Notification and…

Read More
26 Jan

JCDC Announces 2023 Planning Agenda

Attacks, Insights, Malware

Original release date: January 26, 2023 Today, the Joint Cyber Defense Collaborative (JCDC) announced its 2023 Planning Agenda. This release marks a major milestone in the continued evolution and maturation of the collaborative’s planning efforts. JCDC’s Planning Agenda brings together government and private sector partners to develop and execute cyber defense plans that achieve specific risk reduction goals focused on systemic risk, collective cyber response, and high-risk communities. Through this effort, CISA and partners across…

Read More
26 Jan

IOTW: Hackers steal the data of 37 million T-Mobile customers

Attacks, Data Breaches

T-Mobile, the Deutsche Telekom-owned mobile communications brand, has suffered a data breach that exposed the records of 37 million customers. The breach was first discovered by T-Mobile on January 5 after the company noticed “unusual activity” on its American networks and was then reported to the general public on January 19. The company said that it believed the hacker had gained access to customer information “using a single Application Programming Interface (or API)”. T-Mobile said…

Read More
25 Jan

LastPass Parent Company GoTo Suffers Data Breach, Customers’ Backups Compromised

Attacks, Malware

The company did not disclose how many users were impacted, but said it’s directly contacting the victims to provide additional information and recommend certain “actionable steps” to secure their accounts. GoTo has also taken the step of resetting the passwords of affected users and requiring them to reauthorize MFA settings. It further said it’s migrating their accounts to an enhanced identity management platform that claims to offer more robust security. Individuals who have been compromised…

Read More
25 Jan

New Stealthy Python RAT Malware Targets Windows in Attacks

Attacks, Malware

As with many campaigns, this malware is spread through phishing techniques. This demonstrates the benefit of employing an email monitoring solution in an enterprise environment. Additionally, it demonstrates the need for constant – and recurring – user education on common phishing tactics and how to detect and protect against them. Apart from these general statements that can apply to most new campaigns, this RAT also demonstrates a few different techniques that are possible to monitor.…

Read More
25 Jan

Vulnerable LearnPress Plugin for WordPress Impacts 75k Sites

Attacks, Malware

LearnPass site administrators should update the plugin to version 4.2 or above as soon as possible. It is critical for maintainers of WordPress websites to continuously update both WordPress core and all installed plugins. Binary Defense highly recommends WordPress users enable auto-updates wherever possible. https://www.bleepingcomputer.com/news/security/75k-wordpress-sites-impacted-by-critical-online-course-plugin-flaws/

Read More
25 Jan

Emotet Evolving with New Attack and Evasion Techniques

Attacks, Malware

Keeping Endpoint Detection and Response (EDR) systems up-to-date and properly tuned can help companies identify process injection attacks. To help prevent the macro bypass, companies should limit write access to the default Templates directories for Microsoft Office. The SMB spreader can be detected by collecting a baseline of standard SMB netflow traffic and alerting against deviations from that, though this requires a well-staffed security team. https://thehackernews.com/2023/01/emotet-malware-makes-comeback-with-new.html

Read More
25 Jan

CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

Attacks, Insights, Malware

Original release date: January 25, 2023 Today, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released joint Cybersecurity Advisory (CSA) Protecting Against Malicious Use of Remote Monitoring and Management Software. The advisory describes a phishing scam in which cyber threat actors maliciously use legitimate remote monitoring and management (RMM) software to steal money from victim bank accounts. CISA encourages network defenders to…

Read More