News


  • noPac Exploit: Latest Microsoft AD Flaw May Lead to Total Domain Compromise in Seconds

    January 11, 2022

    Microsoft recently published two critical CVEs related to Active Directory (CVE-2021-42278 and CVE-2021-42287), which when combined by a malicious actor could lead to privilege escalation with a direct path to a compromised domain. In mid-December 2021, a public exploit that combined these two Microsoft Active Directory design flaws (referred also as “noPac”) was released. The exploit ...

  • Millions of Routers Exposed to RCE by USB Kernel Bug

    January 11, 2022

    Millions of popular end-user routers are at risk of remote code execution (RCE) due to a high-severity flaw in the KCodes NetUSB kernel module. The module enables remote devices to connect to routers over IP and access any USB devices (such as printers, speakers, webcams, flash drives and other peripherals) that are plugged into them. This ...

  • Make sure you’re up-to-date with Sonicwall SMA 100 VPN box patches – security hole exploit info is now out

    January 11, 2022

    Technical details and exploitation notes have been published for a remote-code-execution vulnerability in Sonicwall SMA 100 series VPN appliances. The information was released today by infosec outfit Rapid7. This comes about a month after Sonicwall issued a patch for the security hole, which was discovered and privately disclosed by Rapid7’s Jake Baines to Sonicwall in October. If ...

  • LoRaWAN’s Protocol Stacks: The Forgotten Targets at Risk

    January 11, 2022

    Our LoRaWAN security series has so far outlined multiple security flaws, vulnerability issues, and entry vectors that attackers have been known to use. In this fourth part of the series, we talk about an attack vector that, so far, has not attracted much attention: the LoRaWAN stack. Although it is not a typical target, it ...

  • DDoS Attack Trends for Q4 2021

    January 11, 2022

    The first half of 2021 witnessed massive ransomware and ransom DDoS attack campaigns that interrupted aspects of critical infrastructure around the world (including one of the largest petroleum pipeline system operators in the US) and a vulnerability in IT management software that targeted schools, public sector, travel organizations, and credit unions, to name a few. The ...

  • What to Include in a Cybersecurity Disaster Recovery Plan

    January 11, 2022

    If the unthinkable were to happen to your business, what’s your disaster recovery plan? If bad actors were to inject ransomware into your system, what’s your process for a return to normal working? Google the words “What do I do if I have a cybersecurity breach” and the first twenty results will start with the ...

  • Danish intelligence chief held over suspected information leaks

    January 10, 2022

    The head of Denmark’s foreign intelligence unit, Lars Findsen, has been remanded in custody over his involvement in a case of “highly classified” information leaks, public broadcaster DR reported on Monday. Denmark’s two intelligence services have been thrown into disarray since four current and former employees were detained in December over allegations of leaking highly classified ...

  • Indian Patchwork hacking group infects itself with remote access Trojan

    January 10, 2022

    An Indian threat group’s inner workings have been exposed after it accidentally infected its own development environment with a remote access Trojan (RAT). Dubbed Patchwork by Malwarebytes and tracked under names including Hangover Group, Dropping Elephant, Chinastrats, and Monsoon, the Indian group has been on the scene since at least 2015 and is actively launching campaigns ...

  • California town announces data breach involving police department, loan provider

    January 10, 2022

    Grass Valley, California has announced an extensive data breach involving the Social Security numbers and more of all city employees and vendors — as well as anyone who had their information given to the local police department. The city said in a notice that Social Security numbers, driver’s license numbers, and health insurance information was leaked ...

  • Microsoft: powerdir bug gives access to protected macOS user data

    January 10, 2022

    Microsoft says threat actors could use a macOS vulnerability to bypass Transparency, Consent, and Control (TCC) technology to access users’ protected data. The Microsoft 365 Defender Research Team has reported the vulnerability dubbed powerdir (tracked as CVE-2021-30970) to Apple on July 15, 2021, via the Microsoft Security Vulnerability Research (MSVR). TCC is security tech designed to block ...

  • Uncovering and Defending Systems Against Attacks With Layers of Remote Control

    January 10, 2022

    As organizations brace themselves for the year ahead, now is an opportune time to take stock of how they can strengthen their security posture and shore up their defenses. While organizations may have the power of leading-edge cybersecurity solutions on their side, malicious actors continue to work diligently to refine their methods and take advantage ...

  • Vulnerability Spotlight: Buffer overflow vulnerability in AnyCubic Chitubox plugin

    January 10, 2022

    Cisco Talos recently discovered an exploitable heap-based buffer overflow vulnerability in the Chitubox AnyCubic plugin. Chitubox is 3-D printing software for users to download and process models and send them to a 3-D printer. The specific AnyCubic plugin allows the software to convert the output of the Chitubox slicer (general format files) into the format expected ...

  • FBI: Cyber criminals are mailing out USB drives that install ransomware

    January 10, 2022

    A cybercrime group has been mailing out USB thumb drives in the hope that recipients will plug them into their PCs and install ransomware on their networks, according to the FBI. The USB drives contain so-called ‘BadUSB’ attacks. They were sent in the mail through the United States Postal Service and United Parcel Service. One type ...

  • Abcbot botnet is linked to Xanthe cryptojacking group

    January 10, 2022

    Researchers have forged a “clear” link between the Abcbot botnet and a well-established cryptojacking cybercriminal group. First discovered In July 2021 by Netlab 360, the Abcbot botnet began as a simple scanner that used basic credential stuffing attacks and known vulnerability exploits to compromise vulnerable Linux systems. However, the developers quickly updated their creation to include self-update ...

  • FlexBooker apologizes for breach of 3.7 million user records, partial credit card information

    January 7, 2022

    Scheduling platform FlexBooker apologized this week for a data breach that involved the sensitive information of 3.7 million users. In a statement, the company told ZDNet a portion of its customer database had been breached after its AWS servers were compromised on December 23. FlexBooker said their “system data storage was also accessed and downloaded” as ...

  • TSA to impose cybersecurity mandates on railroad and aviation industries

    January 6, 2022

    The Transportation Security Administration will impose new cybersecurity mandates on the railroad and airline industries, including reporting requirements as part of a department effort to force compliance in the wake of high-profile cyberattacks on critical industries, Homeland Security Secretary Alejandro Mayorkas announced Wednesday. DHS is moving to require more companies in critical transportation industries to meet ...

  • Night Sky is the latest ransomware targeting corporate networks

    January 6, 2022

    It’s a new year, and with it comes a new ransomware to keep an eye on called ‘Night Sky’ that targets corporate networks and steals data in double-extortion attacks. According to MalwareHunterteam, who first spotted the new ransomware, the Night Sky operation started on December 27th and has since published the data of two victims. One of ...

  • Hackers are sending malicious links through Google Doc comment emails

    January 6, 2022

    Research from cybersecurity company Avanan has shown that hackers are increasingly using Google Docs’ productivity features to slip malicious content past spam filters and security tools. Avanan’s Jeremy Fuchs said that in December, the company saw cyberattackers using the comment feature in Google Docs and Google Slides to leverage attacks against Outlook users. “In this attack, hackers ...

  • JFrog researchers find JNDI vulnerability in H2 database consoles similar to log4shell

    January 6, 2022

    Security researchers from JFrog said on Thursday that they discovered a critical JNDI-based vulnerability in the H2 database console exploiting a root cause similar to Log4Shell. The CVE hasn’t been posted by NIST but will be assigned CVE-2021-42392. In a blog post, the company said that CVE-2021-42392 should not be as widespread as Log4Shell even though ...

  • Apple iPhone Malware Tactic Causes Fake Shutdowns to Enable Spying

    January 6, 2022

    In the world of mobile malware, simply shutting down a device can often wipe out any bad code, given that persistence after rebooting is a challenge for traditional malicious activity. But a new iPhone technique can hijack and prevent any shut-down process that a user initiates, simulating a real power-off while allowing malware to remain ...