Attacks

28 Oct

CraneFly Hacking Group using Microsoft IIS Web Server Logs to Control Malware

Attacks, Malware

As time progresses, threat actors continue to discover novel ways to evade detection. Now that this technique has been discovered, it seems to be quite simple to detect; modify any preexisting IIS monitoring detections to search for keywords such as “wrde”, “exo”, and “cllo”. In this case, it may be better to search IIS log files being written to temp folders, since it would be relatively easy for malware operators to change these keywords. This…

Read More
28 Oct

Hacker steals US$1mn worth of crypto and NFTs 24 hours

Attacks, Data Breaches

A hacker known as Monkey Drainer has stolen US$1mn worth of Ethereum and NFTs in a hacking spree across just 24 hours. The hack was reported by Twitter user ZackXBT who describes themselves as a “crypto sleuth” and a “rug pull survivor turned 2D detective”. A rug pull is a scam which sees malicious actors pose as a legitimate cryptocurrency project to attract investors, only to ‘pull out’ of the project before it is completed,…

Read More
28 Oct

Joint CISA FBI MS-ISAC Guide on Responding to DDoS Attacks and DDoS Guidance for Federal Agencies

Attacks, Insights, Malware

Original release date: October 28, 2022 CISA, the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have released Understanding and Responding to Distributed Denial-of-Service Attacks to provide organizations proactive steps to reduce the likelihood and impact of distributed denial-of-service (DDoS) attacks. The guidance is for both network defenders and leaders to help them understand and respond to DDoS attacks, which can cost an organization time, money, and reputational damage.…

Read More
28 Oct

VMware Releases Security Updates

Attacks, Insights, Malware

Original release date: October 28, 2022 VMware has released security updates to address multiple vulnerabilities in VMware Cloud Foundation. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review VMware Security Advisory VMSA-2022-002 and apply the necessary updates and workarounds. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
27 Oct

CISA Releases Four Industrial Control Systems Advisories

Attacks, Insights, Malware

Original release date: October 27, 2022 CISA has released four (4) Industrial Control Systems (ICS) advisories on October 27, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisory for technical details and mitigations: •    ICSA-22-300-01 Rockwell Automation FactoryTalk Alarm and Events Server •    ICSA-22-300-02 SAUTER Controls moduWeb •    ICSA-22-300-03 Rockwell Automation Stratix Devices Containing Cisco IOS •  …

Read More
27 Oct

Vice Society Hackers Are Behind Several Ransomware Attacks Against Education Sector

Attacks, Malware

It is highly recommended to implement and maintain a regular patching cycle for all devices in an organization and particularly devices that are Internet-facing. Vice Society exploits vulnerabilities to both gain an initial foothold into an environment as well as escalating privileges on infected systems. By making sure all devices are up-to-date on patches consistently, an organization can help prevent threat actors like Vice Society from being able to gain a foothold into an environment.…

Read More
27 Oct

Medibank Provides An Update

Attacks, Malware

Medibank plans to aid their customers moving forward by providing some resources free of charge, those include: • Financial support for customers who are in a uniquely vulnerable position because of this crime.• Free identity monitoring services for customers who have had their primary ID compromised• Reimbursement of fees for re-issue of identity documents that have been fully compromised in this crime.• Specialist identity protection advice and resources from IDCARE.• Medibank’s mental health and wellbeing…

Read More
27 Oct

LinkedIn’s New Security Features Combat Fake Profiles, Threat Actors

Attacks, Malware

Fake accounts, fake job offers, and phishing attacks are all common tactics of threat actors using LinkedIn to target individuals. Threat actors may message individuals asking them to visit a company site which is reality, a fake site designed to steal credentials. Users should always be cautious if sent an external link on LinkedIn. Additionally, users should be wary of any files sent on LinkedIn from unknown users — threat actors will often use this…

Read More
26 Oct

VMware Releases Patch for Remote Code Execution Bug In Cloud Foundation

Attacks, Malware

As always, it is highly recommended to patch any appliances using vulnerable versions of software and to implement a plan for regular updates.In the event that applying the official patch is not immediately feasible, VMware has also released a temporary workaround: https://kb.vmware.com/s/article/89809 https://www.bleepingcomputer.com/news/security/vmware-fixes-critical-cloud-foundation-remote-code-execution-bug/

Read More
26 Oct

Cisco Warns Admins to Patch AnyConnect Flaw Exploited in Attacks

Attacks, Malware

The U.S. cybersecurity agency also strongly urged all organizations worldwide to prioritize patching these security bugs, even though BOD 22-01 only applies to U.S. FCEB agencies. Organizations are recommended to create a patch management policy to verify that all current systems are kept up to date. https://www.bleepingcomputer.com/news/security/cisco-warns-admins-to-patch-anyconnect-flaw-exploited-in-attacks/

Read More