Open-source technologies and communities are a big part of the Rapid7 ethos, and that’s not by chance – it’s by design. Rapid7 believe that their Metasploit, AttackerKB, and Velociraptor initiatives help create a strong threat intelligence foundation as well as a secure digital future for all. Unfortunately, the same open-source tools that help security teams prioritize risk and enhance security outcomes can be misused by threat actors for nefarious purposes.
For example, Rapid7 researchers are aware that the digital forensics and incident response (DFIR) tool Velociraptor has been observed being leveraged by threat actors to execute a ransomware campaign. Rapid7 has implemented detections for this and other Velociraptor-related misuse, and is not impacted by this incident.
Read more…
Source: Rapid7
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Canada: RCMP confirms ‘alarming’ cyber event targeting its networks
February 23, 2024
The Royal Canadian Mounted Police confirmed to CTV News on Friday that it was dealing with a cyber event that targeted its networks, forcing it to launch a criminal investigation into the breach. “At this time, there is no impact on RCMP operations and no known threat to the safety and security of Canadians,” RCMP media ...
- China’s top anti-espionage authority warns of secret leaks through smart wearable devices
February 23, 2024
China’s top anti-espionage authority warned on Friday that various smart wearable devices may become “cyber spies” used by foreign intelligence agencies to carry out espionage activities, posing a threat to national security. The Ministry of State Security (MSS) said on its official WeChat account on Friday that when smart wearable devices are connected to smartphones via ...
- “To live is to fight, to fight is to live! – IBM ODM Remote Code Execution
February 22, 2024
In previous blogs, watchTowr researchers discussed some of the big players in the enterprise software space, but there is one that they have not mentioned before, that is – quite frankly – the heavy-weight champion of the world in terms of applications for large enterprises. With over a hundred years of experience, a founder and leader ...
- ClamAV’s VirusEvent Command Injection Vulnerability
February 22, 2024
SonicWall Capture Labs Threat Research Team became aware of the ClamAV VirusEvent command injection vulnerability (CVE-2024-20328), assessed its impact, and developed mitigation measures for the vulnerability. ClamAV is a notable, open-source anti-virus engine, widely recognized for its comprehensive suite of security solutions. It offers an array of features, including web and email scanning capabilities, endpoint security, ...
- Malawi: Cyber-attack hits immigration service
February 22, 2024
Malawi’s government has suspended the issuing of passports following a cyber-attack on the immigration service’s computer network. President Lazarus Chakwera told MPs that the targeting of the department amounted to a “serious national security breach”. He revealed that the hackers were asking for a ransom. But the president said the government would not give in to ...
- FBI issues warning against using Chinese manufactured drones
February 21, 2024
Chinese-manufactured unmanned aircraft systems (UAS), more commonly known as drones, continue to pose a significant risk to critical infrastructure and U.S. national security, according to an FBI advisory. While any UAS could have vulnerabilities that enable data theft or facilitate network compromises, the People’s Republic of China (PRC) has enacted laws that provide the government with ...