Attacks

19 Oct

Verizon Notifies Prepaid Customers of Data Breach

Attacks, Malware

SIM swapping attacks have gained popularity and are very useful to threat actors that already have breached credentials but get stopped from accessing accounts via Multi-Factor Authentication (MFA). MFA is always a recommended tool to add another layer of defense to credential theft, but it is typically recommended that MFA is provided through a trusted third-party application and never through a phone number. SIM swapping attacks are great example of why it is dangerous to…

Read More
19 Oct

Mark of the Web Windows Zero-Day Receives Unofficial Patch

Attacks, Malware

MotW is an essential security mechanism, especially when it comes to malicious Microsoft Office documents that contain macros. By default, Office will only block macros in files that contain the MotW, allowing threat actors to abuse this flaw to smuggle in malicious macros with no warning to users. It is recommended to disable macros via Group Policy until Microsoft releases an official patch for the MotW flaw. https://www.bleepingcomputer.com/news/microsoft/windows-mark-of-the-web-bypass-zero-day-gets-unofficial-patch/

Read More
19 Oct

CISA Updates Advisory on Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite

Attacks, Insights, Malware

Original release date: October 19, 2022 CISA and the Multi-State Information Sharing & Analysis Center (MS-ISAC) have updated joint Cybersecurity Advisory AA22-228A: Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite, originally released August 16, 2022. The advisory has been updated to reference the addition of a new Malware Analysis Report, MAR-10398871.r1.v2. CISA encourages organizations to review the latest update to AA22-228A and apply the recommended mitigations. This product is provided subject to this Notification…

Read More
19 Oct

Oracle Releases October 2022 Critical Patch Update

Attacks, Insights, Malware

Original release date: October 19, 2022 Oracle has released its Critical Patch Update for October 2022. This update addresses 366 vulnerabilities across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Oracle’s October 2022 Critical Patch Update and apply the necessary mitigations. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
18 Oct

Over 45,000 VMware ESXi Servers Reach End-Of-Life

Attacks, Malware

It is critical for organizations to keep their ESXi servers up to date. Vulnerabilities may accumulate, allowing an attacker a variety of opportunities for exploitation. In addition, because ESXi servers host virtual machines, they are a very desirable target for attackers. The compromise of a single ESXi server could lead to the compromise of dozens of production servers hosted within.System administrators can use this resource from VMware to plan a proactive update cycle and avoid…

Read More
18 Oct

CISA Releases Two Industrial Control Systems Advisories

Attacks, Insights, Malware

Original release date: October 18, 2022 CISA released two Industrial Control Systems (ICS) advisories on October 18, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations: ICSA-22-291-01 Advantech R-SeeNet ICSA-21-336-06 Hitachi Energy APM Edge (Update A) This product is provided subject to this Notification and this Privacy & Use policy.

Read More
14 Oct

CISA Releases RedEye: Red Team Campaign Visualization and Reporting Tool

Attacks, Insights, Malware

Original release date: October 14, 2022 CISA has released RedEye, an interactive open-source analytic tool to visualize and report Red Team command and control activities. RedEye allows an operator to quickly assess complex data, evaluate mitigation strategies, and enable effective decision making. For more information, CISA encourages users to review RedEye on GitHub and watch CISA’s RedEye tool overview video. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
13 Oct

IOTW: Hacker allegedly hits both Uber and Rockstar

Attacks, Data Breaches

It has been alleged that the hacker who gained unauthorized access to rideshare service Uber’s servers was also responsible for a similar hack into the systems of Rockstar Games, developer of the Grand Theft Auto (GTA) game series. The hack into Rockstar Games was discovered on September 19, 2022 after a user called teapotuberhacker posted on Grand Theft Auto game series fan site GTAForums: “Here are 90 footage/clips from GTA 6. It’s possible I could…

Read More