Nastiest Malware 2023
News, Announcements, Tech Discussions
A breach at Rackspace exposes the fragility of the software supply chain, triggering a blame game among vendors over an exploited zero-day. October 2, 2024 By Ryan Naraine Enterprise cloud host Rackspace has been hacked via a zero-day flaw in ScienceLogic’s monitoring app, with ScienceLogic shifting the blame to an undocumented vulnerability in a different bundled third-party utility.The breach, flagged on September 24, was traced back to a zero-day in ScienceLogic’s flagship SL1 software but a company spokesperson tells SecurityWeek the remote code execution exploit actually hit a “non-ScienceLogic third-party utility that is delivered with the SL1 package.”“We identified a zero-day remote code execution vulnerability within a non-ScienceLogic third-party utility that is delivered with the SL1 package, for which no CVE has been issued. Upon identification, we rapidly developed a patch to remediate the incident and have made it available to all customers globally,” ScienceLogic explai
October 2, 2024 By Bill Toulas A new 'FakeUpdate' campaign targeting users in France leverages compromised websites to show fake browser and application updates that spread a new version of the WarmCookie backdoor.FakeUpdate is a cyberattack strategy used by a threat group known as 'SocGolish' who compromises or creates fake websites to show visitors fake update prompts for a variety of applications, such as web browsers, Java, VMware Workstation, WebEx, and Proton VPN.When users click on update prompts designed to appear legitimate, a fake update is downloaded that drops a malicious payload, like info-stealers, cryptocurrency drainers, RATs, and even ransomware.The latest campaign was discovered by researchers at Gen Threat Labs, who observed the WarmCookie backdoor being distributed as fake Google Chrome, Mozilla Firefox, Microsoft Edge, and Java updates. >>Full Article<<
The prolific Chinese APT Mustang Panda is the likely culprit behind a sophisticated cyber-espionage attack that sets up persistent remote access to victim machines. October 2, 2024 By Elizabeth Montalbano A known Chinese advanced persistent threat (APT) group known as Mustang Panda is the likely culprit behind a sophisticated, ongoing cyber-espionage campaign. It starts with a malicious email, and ultimately uses Visual Studio Code (VS Code) to distribute Python-based malware that gives attackers unauthorized and persistent remote access to infected machines.Researchers from Cyble Research and Intelligence Lab (CRIL) discovered the campaign, which spreads an .lnk file disguised as a legitimate setup file to download a Python distribution package. In reality, it's used to run a malicious Python script. The attack relies upon the use of VS Code, which, if not present on the machine, will be deployed via the installation of the VS Code command line interface (CLI) by the attacker, the re
October 2, 2024 By Amy Eastland Red Barrels has recently confirmed that they were the victim of a cybersecurity incident. Red Barrels are known for making the notorious Outlast games, with their most recent game being the multiplayer title, The Outlast Trials. Red Barrels has confirmed that no player data has been compromised in the cybersecurity incident, but there will be significant delays in production, as the incident targeted the development team. It appears that Nitrogen Ransomware committed the attack."The Red Barrels team regrets to announce that its internal IT systems were recently impacted by a cybersecurity event involving access to some of its data." While they weren't working on developing a new game publicly, they have stated that the development has affected their content plans for The Outlast Trials. >>Full Article<<
October 1, 2024 By Jérôme Segura A common way to activate digital subscriptions such as Netflix, Prime or Disney+ on a new TV is to visit a website and enter the code seen on your screen. It’s much easier than having to authenticate using a remote and typing a username and password.Scammers are creating fake activation pages that they get indexed in Google to lure in victims. Once someone goes to one of these pages, they are redirected to a fake Microsoft scanner that claims child abuse imagery was found on their computer.Getting from the family-friendly Disney activation page to a very graphic alert is sure to get many victims to panic, even if they have done absolutely nothing wrong. You can see what this scheme looks like in the animation below: >>Full Article<<
October 2, 2024 By Pierluigi Paganini Multiple flaws in DrayTek residential and enterprise routers can be exploited to fully compromise vulnerable devices.Forescout researchers discovered 14 new vulnerabilities in DrayTek routers, two of which have been rated as critical. Of the 14 security flaws nine are rated high, and three are rated medium in severity.The flaws impact residential and enterprise routers manufactured by DrayTek that could be exploited to take over susceptible devices.The experts reported that over 704,000 DrayTek routers are exposed online in 168 countries, posing a serious risk to customers.Vulnerabilities in these devices could be exploited for cyber espionage, data theft, ransomware and DoS attacks. On September 18, 2024, the FBI dismantled a botnet exploiting three DrayTek CVEs, and CISA recently added two more to its Known Exploited Vulnerabilities list. >>Full Article<<
October 2, 2024 By Sergiu Gatlan CISA warned today that a critical Ivanti vulnerability that can let threat actors gain remote code execution on vulnerable Endpoint Manager (EPM) appliances is now actively exploited in attacks.Ivanti EPM is an all-in-one endpoint management solution that helps admins manage client devices on various platforms, including Windows, macOS, Chrome OS, and IoT operating systems.Tracked as CVE-2024-29824, this SQL Injection vulnerability in Ivanti EPM's Core server that unauthenticated attackers within the same network can exploit to execute arbitrary code on unpatched systems. Ivanti released security updates to patch this security flaw in May, when it also addressed five other remote code execution bugs in EPM's Core server, all impacting Ivanti EPM 2022 SU5 and prior.Horizon3.ai security researchers published a CVE-2024-29824 deep dive in June and released a proof-of-concept exploit on GitHub that can be used to "blindly execute commands on vulnerable Ivan
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-29824Ivanti Endpoint Manager (EPM) SQL Injection VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely
Tuesday, October 1, 2024The Stable channel has been updated to 129.0.6668.89/.90 for Windows, Mac and 129.0.6668.89 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html Webroot users make sure to re-add back to Privacy Protection!
As we navigate through 2024, the cyber threat landscape continues to evolve, bringing new challenges for both businesses and individual consumers. The latest OpenText Threat Report provides insight into these changes, offering vital insights that help us prepare and protect ourselves against emerging threats. Here’s what you need to know: The Resilience of RansomwareRansomware remains a formidable adversary, with groups like LockBit demonstrating an uncanny ability to bounce back even after significant law enforcement actions. Despite a recent crackdown that saw authorities dismantle its infrastructure, LockBit swiftly resumed operations, even taunting law enforcement agencies in the process. This adaptability highlights how resourceful ransomware groups have become, enabling them to evade detection and persistently challenge defenders.For businesses, this means implementing a comprehensive incident response plan that includes secure, immutable backups and regular testing to ensure rap
October 1, 2024 By Pieter Arntz Ireland’s privacy watchdog Data Protection Commission (DPC) has fined Meta €91M ($101M) after the discovery in 2019 that Meta had stored 600 million Facebook and Instagram passwords in plaintext.The DPC ruled that Meta was in violation of GDPR on several occasions related to this breach. It determined that the company failed to “notify the DPC of a personal data breach concerning storage of user passwords in plaintext” without delay, and failed to “document personal data breaches concerning the storage of user passwords in plaintext.”The DPC also said that Meta violated GDPR by not using appropriate technical measures to ensure the security of users’ passwords against unauthorized processing.While the DPC does not disclose the number of passwords, several sources at the time quoted internal sources at Facebook who said 600 million password were freely accessible to employees. Most of these passwords belonged to Facebook Lite users, but it affected other
October 1, 2024 By Bill Toulas Cloud hosting provider Rackspace suffered a data breach exposing "limited" customer monitoring data after threat actors exploited a zero-day vulnerability in a third-party tool used by the ScienceLogic SL1 platform.ScienceLogic confirmed to BleepingComputer that they quickly developed a patch to address the risk and distributed it to all impacted customers while still providing assistance where needed."We identified a zero-day remote code execution vulnerability within a non-ScienceLogic third-party utility that is delivered with the SL1 package," explained a statement from Jessica Lindberg, Vice President at ScienceLogic."Upon identification, we rapidly developed a patch to remediate the incident and have made it available to all customers globally." >>Full Article<<
October 1, 2024 By Pierluigi Paganini US healthcare provider UMC Health System had to divert patients due to a network outage caused by a ransomware attack.On September 27, 2024, US healthcare provider UMC Health System announced an investigation into an IT outage across its network. UMC diverted patients for several days after taking IT systems offline following a ransomware attack.“However, out of an abundance of caution, we will continue to temporarily divert incoming emergency and non-emergency patients via ambulance to nearby health facilities until this issue is resolved. We are making accommodations wherever possible to minimize any disruption to our patients and our critical services.” reads a notice on the IT outage. “Our investigation into this incident remains ongoing and will take time to complete. In the meantime, we are standing up this dedicated webpage to provide the latest information. We will continue to provide updates via this site as services are restored and addit
