Attacks

26 Jan

JCDC Announces 2023 Planning Agenda

Attacks, Insights, Malware

Original release date: January 26, 2023 Today, the Joint Cyber Defense Collaborative (JCDC) announced its 2023 Planning Agenda. This release marks a major milestone in the continued evolution and maturation of the collaborative’s planning efforts. JCDC’s Planning Agenda brings together government and private sector partners to develop and execute cyber defense plans that achieve specific risk reduction goals focused on systemic risk, collective cyber response, and high-risk communities. Through this effort, CISA and partners across…

Read More
26 Jan

IOTW: Hackers steal the data of 37 million T-Mobile customers

Attacks, Data Breaches

T-Mobile, the Deutsche Telekom-owned mobile communications brand, has suffered a data breach that exposed the records of 37 million customers. The breach was first discovered by T-Mobile on January 5 after the company noticed “unusual activity” on its American networks and was then reported to the general public on January 19. The company said that it believed the hacker had gained access to customer information “using a single Application Programming Interface (or API)”. T-Mobile said…

Read More
25 Jan

LastPass Parent Company GoTo Suffers Data Breach, Customers’ Backups Compromised

Attacks, Malware

The company did not disclose how many users were impacted, but said it’s directly contacting the victims to provide additional information and recommend certain “actionable steps” to secure their accounts. GoTo has also taken the step of resetting the passwords of affected users and requiring them to reauthorize MFA settings. It further said it’s migrating their accounts to an enhanced identity management platform that claims to offer more robust security. Individuals who have been compromised…

Read More
25 Jan

New Stealthy Python RAT Malware Targets Windows in Attacks

Attacks, Malware

As with many campaigns, this malware is spread through phishing techniques. This demonstrates the benefit of employing an email monitoring solution in an enterprise environment. Additionally, it demonstrates the need for constant – and recurring – user education on common phishing tactics and how to detect and protect against them. Apart from these general statements that can apply to most new campaigns, this RAT also demonstrates a few different techniques that are possible to monitor.…

Read More
25 Jan

Vulnerable LearnPress Plugin for WordPress Impacts 75k Sites

Attacks, Malware

LearnPass site administrators should update the plugin to version 4.2 or above as soon as possible. It is critical for maintainers of WordPress websites to continuously update both WordPress core and all installed plugins. Binary Defense highly recommends WordPress users enable auto-updates wherever possible. https://www.bleepingcomputer.com/news/security/75k-wordpress-sites-impacted-by-critical-online-course-plugin-flaws/

Read More
25 Jan

Emotet Evolving with New Attack and Evasion Techniques

Attacks, Malware

Keeping Endpoint Detection and Response (EDR) systems up-to-date and properly tuned can help companies identify process injection attacks. To help prevent the macro bypass, companies should limit write access to the default Templates directories for Microsoft Office. The SMB spreader can be detected by collecting a baseline of standard SMB netflow traffic and alerting against deviations from that, though this requires a well-staffed security team. https://thehackernews.com/2023/01/emotet-malware-makes-comeback-with-new.html

Read More
25 Jan

CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

Attacks, Insights, Malware

Original release date: January 25, 2023 Today, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released joint Cybersecurity Advisory (CSA) Protecting Against Malicious Use of Remote Monitoring and Management Software. The advisory describes a phishing scam in which cyber threat actors maliciously use legitimate remote monitoring and management (RMM) software to steal money from victim bank accounts. CISA encourages network defenders to…

Read More
25 Jan

Top tips for employee cyber security training

Attacks, Data Breaches

In this article, Cyber Security Hub explores the best ways to educate employees on email-based cyber attacks and how to ensure they follow cyber security safety practices.  When surveyed by Cyber Security Hub for its Mid-Year Market report 2022, three in four cyber security experts said email-based threat vectors social engineering and phishing attacks were ‘the most dangerous threat’ to cyber security.  One of the reasons why these threats are so dangerous is because of…

Read More
25 Jan

VMware Releases Security Updates for VMware vRealize Log Insight

Attacks, Insights, Malware

Original release date: January 25, 2023 VMware released security updates to address multiple vulnerabilities in VMware vRealize Log Insight. A remote attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review VMware Security Advisory VMSA-2023-0001 and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
24 Jan

Apple Patches Critical Security Vulnerabilities Actively Exploited In The Wild

Attacks, Malware

The latest versions of the Safari browser, macOS, iOS, and watchOS address several recently discovered vulnerabilities. Not only does Binary Defense recommend that users upgrade their Apple devices to the latest software versions, but the Cybersecurity and Infrastructure Security Agency (CISA) has issued a notice for Federal Civilian Executive Branch (FCEB) agencies to patch their devices to secure them “against active threats.” https://www.bleepingcomputer.com/news/apple/apple-fixes-actively-exploited-ios-zero-day-on-older-iphones-ipads/ https://support.apple.com/en-us/HT213597

Read More