Attacks

09 Nov

Malicious Extension Lets Attackers Control Google Chrome Remotely

Attacks, Malware

It is recommended that users update to the latest version of Google Chrome to ensure systems have the most up-to-date security protections. Users can also stay better protected from malicious executables and websites by enabling Enhanced Protection in Chrome’s privacy and security settings. Enhanced Protection automatically produces a warning about potentially risky websites and downloads. https://www.bleepingcomputer.com/news/security/malicious-extension-lets-attackers-control-google-chrome-remotely/

Read More
09 Nov

VMware Fixes Three Critical Authentication Bypass Bugs in Workspace ONE Assist

Attacks, Malware

So far this year, VMware has patched critical authentication bypass vulnerabilities approximately every three months. This article highlights the importance of keeping systems up to date in an enterprise environment. Not performing timely updates could lead to software quickly becoming outdated, which could allow for an actor to gain administrator privileges and execute remote code. It is recommended to monitor any suspicious commands or downloads following the execution of Workspace ONE Assist. Additionally, while VMware…

Read More
09 Nov

ProxyNotShell Receives Patches from Microsoft

Attacks, Malware

Microsoft released the patches for ProxyNotShell on Tuesday, November 8th, 2022. Due to the high severity nature of these vulnerabilities, it is strongly recommended to update all Microsoft Exchange servers as soon as possible. https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-proxynotshell-exchange-zero-days-exploited-in-attacks/

Read More
09 Nov

Citrix Releases Security Updates for ADC and Gateway

Attacks, Insights, Malware

Original release date: November 9, 2022 Citrix has released security updates to address vulnerabilities in Citrix ADC and Citrix Gateway. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Citrix Security Updates CTX463706 and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
09 Nov

Hacker releases stolen Medibank data on the dark web

Attacks, Data Breaches

The hacker that stole 200GB worth of customer data from Australian health insurance provider Medibank has released files containing some of the data on the dark web. The data leak comes after Medibank publicly refused to pay the hacker a ransom on November 7. This prompted the malicious actor to post a threat on November 8 on a dark web site backed by Russian ransomware group REvil. It stated  they would release the data in…

Read More
08 Nov

Medibank Refuses to Pay Ransom, Ransomware Gang Threatens to Release Customer Data

Attacks, Malware

Companies have a few options when it comes to detecting unauthorized access of files, which may have helped catch the attack before a significant amount of customer data was exfiltrated in this case. Canary tokens can be leveraged to create files that appear highly valuable but create an alert when accessed. Companies can also implement canary accounts, baiting attackers into logging into accounts that trigger an alert on a successful login, that appear to be…

Read More
08 Nov

W4SP Stealer Found in Dozens of Python Packages in the PyPI registry

Attacks, Malware

PyPI is often treated as a very trustworthy source of packages; in reality, anyone can upload a package to be distributed by PyPI. It is recommended to install python libraries using built-in operating system package managers where possible. For example, on Debian based Linux systems using apt(8), it is recommend to use: apt install python3-. Repositories maintained by Linux operating system developers typically have more stringent requirements for new packages.In the event that using an…

Read More
08 Nov

Azov Ransomware Identified as Wiper Malware

Attacks, Malware

Downloading software from illegitimate sources always carries a risk. In this case, the malware is being spread via pirated software. Whenever software is being downloaded, it should be from a legitimate source. As a rule of thumb, any paid software being advertised for free is highly likely to include a type of malware or adware with it. Windows Applocker and other security solutions can assist in defining an allow list for software within a secured…

Read More
08 Nov

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

Attacks, Insights, Malware

Original release date: November 8, 2022 CISA has added seven vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow in the “Date Added to Catalog” column, which will sort by descending dates. Binding Operational Directive (BOD) 22-01:…

Read More
08 Nov

Hacker threatens to release data stolen from 9.7m Medibank customers

Attacks, Data Breaches

A threat to release 200GB worth of data stolen from Australian health insurance company Medibank has been posted to a site backed by Russian ransomware group, REvil. The threat comes after Medibank made a public statement that it would not be paying the ransom demanded by the hacker. In the message, the supposed hacker quotes Confuscious, implying Medibank is making a “mistake” by not paying the ransom. The malicious actor then said that they would…

Read More