Cybersecurity news

• A phishing kit has been released that allows red teamers and wannabe cybercriminals to create effective single sign-on phishing login forms using fake Chrome browser windows. When signing into websites, it is common to see the option to sign with Google, Microsoft, Apple, Twitter, or even Steam.
• A new Linux vulnerability known as ‘Dirty Pipe’ allows local users to gain root privileges through publicly available exploits. The vulnerability is tracked as CVE-2022-0847 and allows a non-privileged user to inject and overwrite data in read-only files, including SUID processes that run as root.
• HP has disclosed 16 high-impact UEFI firmware vulnerabilities that could allow threat actors to infect devices with malware that gain high privileges and remain undetectable by installed security software.

Cybersecurity news

• The Cube ransomware operation is exploiting Microsoft Exchange vulnerabilities to gain initial access to corporate networks and encrypt devices. Cybersecurity firm Mandiant tracks the ransomware gang as UNC2596 and the ransomware itself as COLD DRAWN. However, the ransomware is more commonly known as Cuba.
• A notification from the U.S. Cybersecurity Infrastructure and Security Agency warns that threat actors are exploiting vulnerabilities in the Zabbix open-source tool for monitoring networks, servers, virtual machines, and cloud services.

Defensys has released a new version of the Defensys Security Orchestration Automation and Response Platform (SOAR), a platform that is designed to automate monitoring and responding to cybersecurity incidents.

The Defensys SOAR 4.7 platform allows incidents to be combined into groups. You can work with a chain of related or the same types of incidents. One parent incident is selected for the group, the others are considered as child incidents. By grouping them, the user can examine and analyze cybersecurity events all together, if they have a common cause. Besides working with groups of incidents from the user interface, it is now available for the users to use in playbooks and through the public API of the system.

Playbooks were also updated. In version 4.7, the incident card has a playbook launch timeline with the ability to control its display: the user can navigate to the selected playbook, as well as collapse the playbook diagram into a compact block. The start button for a particular playbook can now be placed in the incident card itself.

Defensys customer support will notify current users when updates are available for migration. If you would like to receive an update for pre-testing and to familiarize yourself with the functionality, send us an email to support@defensys.com

Cybersecurity news

• Security researchers warn that some attackers are compromising Microsoft Teams accounts to slip into chats and spread malicious executables to participants in the conversation. More than 270 million users are relying on Microsoft Teams every month, many of them trusting the platform implicitly, despite the absence of protections against malicious files.
• Users of Monzo, one of the UK’s most popular digital-only banking platforms, are being targeted by phishing messages supported by a growing network of malicious websites. If these details are provided, the threat actors now have everything needed to begin taking over victims’ Monzo accounts.
• After enabling two-factor authentication (2 SV) by default for 150 million users, Google claims to have seen a 50% decrease in accounts being compromised.
• The master encryption keys for the Maze, Egregor, and Sekhmet ransomware operations were released on the BleepingComputer forums by

Cybersecurity news

• Symphony Technology Group (STG) announced the launch of Trellix, a new business delivering extended detection and response (XDR) to organizations with a focus on accelerating technology innovation through machine learning and automation.

Cybersecurity news

• EU to Stage Large-Scale Cyberattack Exercise on Supply Chains. The aim of the six-week exercise is to stress-test Europe’s resilience, strengthen preparedness and cooperation among member states, and improve the effectiveness of a joint response.
• The research arm of Palo Alto Networks, revealed how attackers are using the service to carry out a supply chain attack to inject card skimming malware onto victim sites. Web skimming attacks occur when malicious script is injected into sites to steal information entered into web forms.
• SentinelLabs has discovered a high severity flaw in the KCodes NetUSB kernel module used bya large number of network device vendors and affecting millions of end user router devices.
• A Safari bug has surfaced, that can leak browsing history and information related to Google account. Apple’s browser, which is the default on macOS, iOS, and iPad OS has a security issue related to IndexedDB.

Cybersecurity news

• Google has released Chrome 96.0.4664.110 for Windows, Mac, and Linux, to address a high-severity zero-day vulnerability exploited in the wild. Although the company says this update may take some time to reach all users, the update has already begun rolling out Chrome 96.0.4664.110 worldwide in the Stable Desktop channel.
• Apache has released version 2.17.0 of the patch for Log4j after discovering issues with their previous release, which came out on Tuesday. Apache said version 2.16 “does not always protect from infinite recursion in lookup evaluation” and explained that it is vulnerable to CVE-2021-45105, a denial of service vulnerability. They said the severity is “high” and gave it a CVSS score of 7.5.
• Industrial and government organizations, including enterprises in the military-industrial complex and research laboratories, are the targets of a new malware botnet dubbed PseudoManyscrypt that has infected roughly 35,000 Windows computers this year alone.

Cybersecurity news

• Security researchers from Google Project Zero discovered two vulnerabilities in the video conferencing software Zoom that expose users to attacks. The vulnerabilities impact Zoom Client for Meetings on Windows, macOS, Linux, iOS, and Android. The first flaw, tracked as CVE-2021-34423, is a high-severity buffer overflow vulnerability that received a CVSS base score of 7.3.
• Password-stealing and keylogging malware is being spread through fake downloads. Cisco Talos cybersecurity researchers disclose a newly discovered campaign that users custom malware to steal usernames, passwords and other sensitive information from victims.
• An independent security researcher discovered a way to brute force Verizon PINs online, meaning they could potentially break into Verizon customer accounts. In response, Verizon has taken the impacted web pages offline.
• Business software provider Zoho urged customers today to update their Desktop Central and Desktop Central MSP installations to the latest available version.

Cybersecurity news

• T&T Alien Labs™ has found new Golang malware BotenaGo written in the open source programming language Golang. Deployed with more than 30 exploits, it has the potential of targeting millions of routers and IoT devices.
• The TrickBot malware operators have been using a new method to check the screen resolution of a victim system to evade detection of security software and analysis by researchers. Last year, the TrickBot gang added a new feature to their malware that terminated the infection chain if a device was using non-standard screen resolutions of 800×600 and 1024×768.

Cybersecurity news

• The Federal Bureau of Investigation (FBI) warns that ransomware gangs are targeting companies involved in “time-sensitive financial events” such as corporate mergers and acquisitions to make it easier to extort their victims. In a private industry notification published on Monday, the FBI said ransomware operators would use the financial information collected before attacks as leverage to force victims to comply with ransom demands.
• The BlackMatter ransomware operation, which came to prominence earlier this year following the demise of the DarkSide ransomware gang, is allegedly shutting down due to “pressure from the authorities.” The group announced plans to shut down in a message posted on its ransomware-as-a-service (RaaS) portal, where other criminal groups typically register in order to get access to the BlackMatter ransomware strain.
• Academic researchers have released details about a new attack method they call “Trojan Source” that allows injecting vulnerabilities into the source code of a software project in a way that human reviewers can’t detect.