Attacks

10 Nov

New StrelaStealer Malware Steals Your Outlook, Thunderbird Accounts

Attacks, Malware

It is highly recommended to implement and maintain good email security controls, such as AV scanning and sandboxing, to help prevent phishing emails from being delivered to end users. Since the vast majority of malware is delivered via phishing emails, this step alone can help prevent a large number of malware campaigns from being unsuccessful in infecting an organization. It is also recommended to implement a blocklist of potentially suspicious email attachment file types, such…

Read More
10 Nov

Verified Mess — Twitter’s $8 Blue Tick Rollout Sees ‘Verified’ Fakes

Attacks, Malware

This issue is likely to get worse before it gets better. Threat actors will continue to use the new verified check marks as a means to spread misinformation as well as attempt social engineering tactics to take advantage of individuals. Users should be wary of “verified” twitter accounts and should validate any information received from a twitter account with a secondary reliable source. Individuals should also be cautious of direct messages from verified accounts enticing…

Read More
10 Nov

CISA Releases SSVC Methodology to Prioritize Vulnerabilities

Attacks, Insights, Malware

Original release date: November 10, 2022 Today CISA published its guide on Stakeholder-Specific Vulnerability Categorization (SSVC), a vulnerability management methodology that assesses vulnerabilities and prioritizes remediation efforts based on exploitation status, impacts to safety, and prevalence of the affected product in a singular system. As stated in Executive Assistant Director (EAD) Eric Goldstein’s blog post Transforming the Vulnerability Management Landscape, implementing a methodology, such as SSVC, is a critical step to advancing the vulnerability management…

Read More
10 Nov

CISA Releases Twenty Industrial Control Systems Advisories

Attacks, Insights, Malware

Original release date: November 10, 2022 CISA has released twenty (20) Industrial Control Systems (ICS) advisories on November 10, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations: ICSA-22-314-01 Siemens Parasolid ICSA-22-314-02 Siemens Missing Web Server Login Page of Industrial Controllers ICSA-22-314-03 Siemens SINEC Network Management System Logback Component ICSA-22-314-04 Siemens SINUMERIK…

Read More
09 Nov

Microsoft Releases November 2022 Security Updates

Attacks, Insights, Malware

Original release date: November 9, 2022 Microsoft has released updates to address multiple vulnerabilities in Microsoft software. An attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s November 2022 Security Update Guide and Deployment Information and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
09 Nov

Malicious Extension Lets Attackers Control Google Chrome Remotely

Attacks, Malware

It is recommended that users update to the latest version of Google Chrome to ensure systems have the most up-to-date security protections. Users can also stay better protected from malicious executables and websites by enabling Enhanced Protection in Chrome’s privacy and security settings. Enhanced Protection automatically produces a warning about potentially risky websites and downloads. https://www.bleepingcomputer.com/news/security/malicious-extension-lets-attackers-control-google-chrome-remotely/

Read More
09 Nov

VMware Fixes Three Critical Authentication Bypass Bugs in Workspace ONE Assist

Attacks, Malware

So far this year, VMware has patched critical authentication bypass vulnerabilities approximately every three months. This article highlights the importance of keeping systems up to date in an enterprise environment. Not performing timely updates could lead to software quickly becoming outdated, which could allow for an actor to gain administrator privileges and execute remote code. It is recommended to monitor any suspicious commands or downloads following the execution of Workspace ONE Assist. Additionally, while VMware…

Read More
09 Nov

ProxyNotShell Receives Patches from Microsoft

Attacks, Malware

Microsoft released the patches for ProxyNotShell on Tuesday, November 8th, 2022. Due to the high severity nature of these vulnerabilities, it is strongly recommended to update all Microsoft Exchange servers as soon as possible. https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-proxynotshell-exchange-zero-days-exploited-in-attacks/

Read More
09 Nov

Citrix Releases Security Updates for ADC and Gateway

Attacks, Insights, Malware

Original release date: November 9, 2022 Citrix has released security updates to address vulnerabilities in Citrix ADC and Citrix Gateway. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Citrix Security Updates CTX463706 and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
09 Nov

Hacker releases stolen Medibank data on the dark web

Attacks, Data Breaches

The hacker that stole 200GB worth of customer data from Australian health insurance provider Medibank has released files containing some of the data on the dark web. The data leak comes after Medibank publicly refused to pay the hacker a ransom on November 7. This prompted the malicious actor to post a threat on November 8 on a dark web site backed by Russian ransomware group REvil. It stated  they would release the data in…

Read More