Collaborate Disseminate
An ongoing campaign has been found to leverage a network of websites acting as a “dropper as a service” to deliver a bundle of malware payloads to victims looking for “cracked” versions of popular business and consumer applications.
“These malware incl… Continue reading Traffic Exchange Networks Distributing Malware Disguised as Cracked Software
Networking, storage and security solutions provider Netgear on Friday issued patches to address three security vulnerabilities affecting its smart switches that could be abused by an adversary to gain full control of a vulnerable device.
The flaws, whi… Continue reading Critical Auth Bypass Bug Affect NETGEAR Smart Switches — Patch and PoC Released
Apple is temporarily hitting the pause button on its controversial plans to screen users’ devices for child sexual abuse material (CSAM) after receiving sustained blowback over worries that the tool could be weaponized for mass surveillance and erode t… Continue reading Apple Delays Plans to Scan Devices for Child Abuse Images After Privacy Backlash
Microsoft has shared technical details about a now-fixed, actively exploited critical security vulnerability affecting SolarWinds Serv-U managed file transfer service that it has attributed with “high confidence” to a threat actor operating out of Chin… Continue reading Microsoft Says Chinese Hackers Were Behind SolarWinds Serv-U SSH 0-Day Attack
The U.S. Cyber Command on Friday warned of ongoing mass exploitation attempts in the wild targeting a now-patched critical security vulnerability affecting Atlassian Confluence deployments that could be abused by unauthenticated attackers to take contr… Continue reading U.S. Cyber Command Warns of Ongoing Attacks Exploiting Atlassian Confluence Flaw
Cybersecurity researchers have disclosed details about a new malware family that relies on the Common Log File System (CLFS) to hide a second-stage payload in registry transaction files in an attempt to evade detection mechanisms.
FireEye’s Mandiant Ad… Continue reading This New Malware Family Using CLFS Log Files to Avoid Detection
A recent wave of spear-phishing campaigns leveraged weaponized Windows 11 Alpha-themed Word documents with Visual Basic macros to drop malicious payloads, including a JavaScript implant, against a point-of-sale (PoS) service provider located in the U.S… Continue reading FIN7 Hackers Using Windows 11 Themed Documents to Drop Javascript Backdoor
Cisco has patched a critical security vulnerability impacting its Enterprise Network Function Virtualization Infrastructure Software (NFVIS) that could be exploited by an attacker to take control of an affected system.
Tracked as CVE-2021-34746, the we… Continue reading Cisco Issues Patch for Critical Enterprise NFVIS Flaw — PoC Exploit Available
A set of new security vulnerabilities has been disclosed in commercial Bluetooth stacks that could enable an adversary to execute arbitrary code and, worse, crash the devices via denial-of-service (DoS) attacks.
Collectively dubbed “BrakTooth” (referr… Continue reading New BrakTooth Flaws Leave Millions of Bluetooth-enabled Devices Vulnerable
The operators of the Mozi IoT botnet have been taken into custody by Chinese law enforcement authorities, nearly two years after the malware emerged on the threat landscape in September 2019.
News of the arrest, which originally happened in June, was d… Continue reading Chinese Authorities Arrest Hackers Behind Mozi IoT Botnet Attacks