Threats & Vulnerabilities: Page

Citrix ADC and Gateway zero day under active exploitation

The NSA said that APT5, a suspected Chinese nation-state threat group, is actively exploiting the Citrix zero-day flaw, which affects the vendor's ADC and Gateway products.

By Alexander Culafi • Dec. 13, 2022

Vice Society ransomware ‘persistent threat’ to education sector

New research from Palo Alto Networks supports recent government warnings that Vice Society poses an increased risk to K-12 schools and higher education.

By Arielle Waldman • Dec. 7, 2022

MegaRAC flaws, IP leak impact multiple server brands

MegaRAC BMC software from American Megatrends, Inc. have a trio of serious security vulnerabilities that were discovered following an intellectual property leak.

By Shaun Nichols • Dec. 6, 2022

Rackspace confirms ransomware attack after Exchange outages

The cloud service provider said that because the investigation of the ransomware attack is in the early stages, it is unknown what, if any, customer data was stolen.

By Alexander Culafi • Dec. 6, 2022

Education sector hit by Hive ransomware in November

The education sector remained a popular target last month, particularly from Hive, a ransomware-a-as-a-service group, that even warranted a government alert in late November.

By Arielle Waldman • Dec. 5, 2022

Rackspace ‘security incident’ causes Exchange Server outages

Rackspace has not said what caused the security incident, but the cloud provider said it proactively disconnected its Hosted Exchange offering as it investigates the matter.

By Alexander Culafi • Dec. 5, 2022

Evil Corp

Evil Corp is an international cybercrime network that uses malicious software to steal money from victims' bank accounts and to mount ransomware attacks.

By Ben Lutkevich • Dec. 5, 2022

Trojan horse

In computing, a Trojan horse is a program downloaded and installed on a computer that appears harmless, but is, in fact, malicious.

By Michael Cobb, Casey Clark • Dec. 2, 2022

Experts argue ‘sludge’ could muck up cyber attacks

Network defenders can supplement their security postures with additional settings and policies that frustrate and discourage attackers, according to a new research paper.

By Shaun Nichols • Dec. 2, 2022

Archive files become preferred format for malware delivery

The team at HP Wolf Security found that cybercriminals are using archive files as the preferred method for spreading malware, beating Microsoft Office for the first time.

By Shaun Nichols • Dec. 1, 2022

Lockbit 3.0 has BlackMatter ransomware code, wormable traits

LockBit 3.0 or 'LockBit Black' includes anti-debugging capabilities, the ability to delete Volume Shadow Copy files and the potential ability to self-spread via legitimate tools.

By Alexander Culafi • Nov. 30, 2022

Exchange Server bugs caused years of security turmoil

The four high-profile sets of security vulnerabilities in Microsoft Exchange Server, disclosed by researcher Orange Tsai, are set to remain a major concern for organizations.

By Shaun Nichols • Nov. 30, 2022

Tenable: 72% of organizations remain vulnerable to Log4Shell

New research shows the attack surface remains wide for the Log4j vulnerability, known as Log4Shell, which caused significant problems for organizations over the past year.

By Arielle Waldman • Nov. 30, 2022

Infosec researcher reports possible ‘massive’ Twitter breach

The alleged Twitter breach involves a data set from late 2021 and includes the phone numbers and personal information of millions of users in the U.S. and Europe.

By Alexander Culafi • Nov. 28, 2022

Cybereason warns of fast-moving Black Basta campaign

Threat actors with the Black Basta ransomware-as-a-service group are compromising networks in as little as one hour and stealing sensitive data before disabling DNS services.

By Arielle Waldman • Nov. 23, 2022

Google’s new YARA rules fight malicious Cobalt Strike use

Google's YARA rules detect cracked versions of Cobalt Strike's older releases so that legitimate instances of the red teaming tool, which use the latest version, aren't targeted.

By Alexander Culafi • Nov. 22, 2022

buffer underflow

A buffer underflow, also known as a buffer underrun or a buffer underwrite, is when the buffer -- the temporary holding space during data transfer -- is fed data at a lower rate than it is being read from.

By Sarah Lewis • Nov. 22, 2022

Magecart malware menaces Magento merchants

Sansec researchers say as many as 38% of commercial customers running the Adobe Commerce and Magento platforms could be infected with Magecart's TrojanOrders malware.

By Shaun Nichols • Nov. 17, 2022

CISA: Iranian APT actors compromised federal network

CISA said Iranian nation-state actors exploited Log4Shell flaws on an unpatched VMware Horizon server before deploying a cryptominer and attempting to gain persistent access.

By Alexander Culafi • Nov. 17, 2022

LockBit ransomware activity nose-dived in October

LockBit, the most prolific ransomware group in 2022, had itself a down month as GuidePoint Security researchers reported a 49% decrease in its infections for October.

By Shaun Nichols • Nov. 17, 2022

Rapid7 discloses more F5 BIG-IP vulnerabilities

While the severity of the issues is relatively low, F5 devices are commonly targeted by attackers to gain persistence inside a network.

By Arielle Waldman • Nov. 16, 2022

Moreno Valley school system shores up ransomware defenses

Moreno Valley Unified School District officials discuss the steps they've taken to better protect sensitive data and critical applications against the growing threat of ransomware.

By Arielle Waldman • Nov. 14, 2022

DOJ charges accused Lockbit ransomware actor

The U.S. Department of Justice filed criminal charges against a Canadian man with dual Russian citizenship who is accused of being part of the LockBit ransomware crew.

By Shaun Nichols • Nov. 10, 2022

Microsoft: Nation-state threats, zero-day attacks increasing

Microsoft's Digital Defense Report 2022 pointed the finger at China, which enacted a new vulnerability disclosure law last year, as the source of many zero-day attacks.

By Arielle Waldman • Nov. 7, 2022

Yanluowang ransomware gang goes dark after leaks

The Yanluowang ransomware operation appears to have shut down for the time being after an anonymous individual published a series of internal code and chat leaks.

By Shaun Nichols • Nov. 4, 2022