Threats & Vulnerabilities: Page

Microsoft Exchange Server targeted with zero-day vulnerabilities

Microsoft warned that two unpatched zero-day vulnerabilities are being exploited against Exchange Server, a problem that's causing déjà vu for some researchers.

By Arielle Waldman • Sept. 30, 2022

Cobalt Strike malware campaign targets job seekers

Cisco Talos researchers spotted a new wave of phishing attacks that target job seekers in the U.S. and New Zealand, infecting them with Cobalt Strike beacons.

By Shaun Nichols • Sept. 29, 2022

Unit 42 finds polyglot files delivering IcedID malware

Palo Alto Networks' Unit 42 says attackers are using decoy Microsoft Compiled HTML Help files containing multiple file formats to infect systems with information-stealing malware.

By Arielle Waldman • Sept. 29, 2022

Mandiant spots new malware targeting VMware ESXi hypervisors

Mandiant researchers said the backdoors were installed with a novel technique that used malicious vSphere Installation Bundles, though it's unclear how initial access was achieved.

By Rob Wright • Sept. 29, 2022

NCC Group: IceFire ransomware gang ramping up attacks

While the ransomware group was first observed in March, IceFire emerged on NCC Group's radar last month when attacks against English-speaking organizations soared.

By Arielle Waldman • Sept. 28, 2022

Malicious NPM package discovered in supply chain attack

Threat actors are circulating a look-alike version of the Material Tailwind NPM package to infect developers for supply chain malware attacks, according to ReversingLabs.

By Shaun Nichols • Sept. 23, 2022

15-year-old Python vulnerability poses supply chain threat

Trellix researchers issued a call for help to patch a vulnerable software module, which was found in more than 300,000 open source GitHub repositories.

By Arielle Waldman • Sept. 22, 2022

Cobalt Strike gets emergency patch

The developer of Cobalt Strike issued an out-of-band security update to address a cross-site scripting vulnerability in the popular penetration testing suite.

By Shaun Nichols • Sept. 21, 2022

Uber says Lapsus$ hackers behind network breach

Uber said a hacker from the Lapsus$ group used stolen credentials from a contractor to gain access to several important silos within its internal network.

By Shaun Nichols • Sept. 19, 2022

Rockstar Games confirms hack after ‘Grand Theft Auto’ leak

A threat actor this weekend published in-development footage from a forthcoming 'Grand Theft Auto' video game and claimed to have breached its publisher, Rockstar Games.

By Alexander Culafi • Sept. 19, 2022

cryptojacking

Cryptojacking is a cybercrime in which another party's computing resources are hijacked to mine cryptocurrency.

By Nick Barney • Sept. 19, 2022

DOJ drops report on cryptocurrency crime efforts

The U.S. Department of Justice issued a report to President Biden on its various enforcement efforts around cybercrime and digital currency, as well as looming challenges.

By Shaun Nichols • Sept. 16, 2022

Uber responds to possible breach following hacker taunts

Security researchers spotted suspicious activity on Uber's HackerOne page when the alleged hacker posted messages claiming they had compromised the ride-share company's network.

By Alexander Culafi • Sept. 16, 2022

U.S. drops the hammer on Iranian ransomware outfit

The departments of Justice and the Treasury announced criminal charges and sanctions against a group of Iranian nationals accused of running an international ransomware operation.

By Shaun Nichols • Sept. 14, 2022

Secureworks reveals Azure Active Directory flaws

Secureworks published details of what it claims are significant security flaws in Azure's authentication system, but Microsoft has dismissed them as non-issues.

By Shaun Nichols • Sept. 13, 2022

computer worm

A computer worm is a type of malware whose primary function is to self-replicate and infect other computers while remaining active on infected systems.

By Peter Loshin, Katie Terrell Hanna, Crystal Bedell • Sept. 13, 2022

CrowdStrike threat report: Intrusions up, breakout time down

According to a new report by CrowdStrike's threat hunting team, Falcon OverWatch, attempted intrusions against the healthcare sector doubled year over year.

By Alexander Culafi • Sept. 13, 2022

LockBit gang leads the way for ransomware

New research from Malwarebytes shows LockBit is far and away the most prolific ransomware gang, with hundreds of confirmed attacks across the globe in recent months.

By Shaun Nichols • Sept. 8, 2022

Cisco Talos traps new Lazarus Group RAT

The North Korean-backed Lazarus Group has deployed a new type of remote access Trojan that has already been turned against foreign government networks and private energy companies.

By Shaun Nichols • Sept. 8, 2022

Google: Former Conti ransomware members attacking Ukraine

Google said former members of the Conti ransomware gang are operating as part of threat group UAC-0098, which is conducting attacks of both political and financial nature.

By Alexander Culafi • Sept. 7, 2022

Healthcare and education remain common ransomware targets

August disclosures showed ransomware attacks against education and healthcare entities resulted in slow recovery times and the potential loss of highly sensitive information.

By Arielle Waldman • Sept. 6, 2022

Ransomware hits Los Angeles Unified School District

The second-largest public school system in the U.S. confirmed a ransomware attack caused districtwide disruption to various services over the holiday weekend.

By Arielle Waldman • Sept. 6, 2022

Microsoft discloses ‘high-severity’ TikTok vulnerability

The flaw in TikTok's Android app is the latest security concern for the social media company, which was criticized last month for having keylogging functionality in its iOS app.

By Arielle Waldman • Sept. 1, 2022

Microsoft Excel attacks fall out of fashion with hackers

Hornetsecurity researchers say newly introduced safety measures from Microsoft have driven cybercriminals away from using Excel as a malware infection tool.

By Shaun Nichols • Aug. 30, 2022

FBI warns attacks on DeFi platforms are increasing

As cryptocurrency interest soars, cybercriminals are cashing in on the immaturity of some DeFi platforms and stealing hundreds of millions of dollars from investors.

By Arielle Waldman • Aug. 30, 2022