Security Affairs

OCTOBER 13, 2023

The AvosLocker ransomware-as-a-service emerged in the threat landscape in September 2021, since January the group expanded its targets by implementing support for encrypting Linux systems, specifically VMware ESXi servers. This joint CSA updates the advisory published by the US Government on March 17, 2022.

Ransomware 129

Ransomware System Administration Antivirus Malware 129

Malwarebytes

OCTOBER 22, 2021

Unfortunately, in an echo of the Y2K bug, a flaw in some versions of GPSD could cause time to roll back after October 23, 2021. The buggy versions of the code reportedly subtract 1024 from the week number on October 24, 2021. It is also good for system administrators to make a mental note of the date October 24, 2021.

Authentication 145

Authentication System Administration Firmware Passwords 145

Security Affairs

FEBRUARY 5, 2021

4 XSS in FortiWeb (CVE-2021-22122), found by Andrey Medov, have been patched. cmdb_edit_path=");alert('xss');// Advisory: [link] pic.twitter.com/jCOILHKWc4 — PT SWARM (@ptswarm) February 4, 2021. Two example PoCs: 1⃣ /error3?msg=30&data=';alert('xss');//

Firewall 142

Firewall System Administration Technology Hacking 142

eSecurity Planet

MARCH 21, 2022

By using a misconfigured Cisco Duo MFA implementation to force enrollment of a new device, the hackers were then able to use the “PrintNightmare” Windows Print Spooler vulnerability ( CVE-2021-34527 and CVE-2021-36958 ) to obtain administrator privileges. Inactive Accounts and Default Configurations.

VPN 117

VPN Accountability Authentication Passwords 117

McAfee

OCTOBER 4, 2021

The 2021 Hispanic Heritage Month theme invites us to celebrate Hispanic Heritage and to reflect on how great our tomorrow can be if we hold onto our resilience and hope. And if you need more help or advice, don’t hesitate to contact me on my Twitter account: @aboutsecurity. The post 2021 Hispanic Heritage Month Pt.

InfoSec 83

InfoSec System Administration Cybersecurity Engineering 83

Malwarebytes

JULY 23, 2021

CNA’s network was compromised in March 2021. “With elevated privileges, the Threat Actor moved laterally within the environment to conduct reconnaissance and establish persistence onto certain systems within the environment. You can listen to it below, or on Apple Podcasts , Spotify , and Google Podcasts.

Ransomware 105

Ransomware Unstructured Data Accountability Consumer Protection 105

eSecurity Planet

SEPTEMBER 15, 2022

The malware seems to leverage the infamous Pwnkit vulnerability (CVE-2021-4034), one of the easiest exploits imaginable, and OverlayFS ( CVE-2021-3493 ), a kernel exploit that pentesters , capture-the-flag (CTF) players, and hackers know all too well. Two of them regard the current user and the rest are for the root account.

Malware 117

Malware Social Engineering System Administration Antivirus 117

Security Affairs

APRIL 30, 2023

CERT-UA observed the campaign in April 2023, the malicious e-mails with the subject “Windows Update” were crafted to appear as sent by system administrators of departments of multiple government bodies. Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks.

System Administration 98

System Administration Government Phishing Malware 98

Malwarebytes

JULY 1, 2021

In June, Microsoft patched a vulnerability in the Windows Print Spooler that was listed as CVE-2021-1675. Which means that someone with limited access to a system could raise their privilege level, giving them more power over the affected system. They called theirs PrintNightmare and believed it was the same as CVE-2021-1675.

System Administration 104

System Administration Backups Marketing Engineering 104

SecureList

JUNE 17, 2021

Black Kingdom ransomware appeared on the scene back in 2019, but we observed some activity again in 2021. The ransomware was used by an unknown adversary for exploiting a Microsoft Exchange vulnerability (CVE-2021-27065). March 2021. CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065.

Ransomware 144

Ransomware Encryption VPN System Administration 144

Security Affairs

JUNE 8, 2022

“Upon gaining an initial foothold into a telecommunications organization or network service provider, PRC state-sponsored cyber actors have identified critical users and infrastructure including systems critical to maintaining the security of authentication, authorization, and accounting.

Telecommunications 100

Telecommunications Authentication Passwords Accountability 100

eSecurity Planet

FEBRUARY 15, 2022

Update and patch operating systems, software, and firmware as soon as updates and patches are released. Review domain controllers, servers, workstations, and active directories for new or unrecognized user accounts. CISA strongly recommends updating all software as soon as possible. How to Use the CISA Catalog.

Ransomware 128

Ransomware Encryption Backups Accountability 128

Malwarebytes

APRIL 21, 2021

The new vulnerability (CVE-2021-22893) is a Remote Code Execution (RCE) vulnerability with a CVSS score of 10—the maximum—and a Critical rating. There is no patch for it yet (it is expected to be patched in early May), so system administrators will need to mitigate for the problem for now, rather than simply fixing it.

VPN 86

VPN Authentication Malware System Administration 86

eSecurity Planet

MARCH 25, 2022

As remote desktop solutions are prevalent among IT and managed service providers (MSP), downstream clients can be at risk, as Kaseya experienced in 2021. In November 2021, an unauthorized third party called a Robinhood customer support employee and, through social engineering , gained access to the company’s customer support systems.

VPN 120

VPN Software Authentication Encryption 120

IT Security Guru

SEPTEMBER 7, 2022

Per a recent report from Q4 2020 to Q4 2021 , the average number of APIs per company increased by 221% in 12 months and that API attack traffic grew by 681% while overall API traffic grew by 321%. Microservices Architecture has Created a Security Blind Spot. password guessing). API Security Tools.

DDOS 131

DDOS Authentication Architecture Social Engineering 131

eSecurity Planet

JULY 6, 2021

Kaseya’s flagship product is a remote monitoring and management (RMM) solution called the Virtual Systems Administrator (VSA) and is the product at the center of the current attack. When administrators noticed suspicious behavior on Friday, Kaseya shut down VSA. VSA server breached. Managing supply chain risk.

Ransomware 122

Ransomware Software B2B System Administration 122

Malwarebytes

MARCH 31, 2023

In September 2021, Malwarebytes spoke with Matt Crape from VMWare to find out why backups are so hard, why they fail, and what to do about it. And it's all-too-common for those that do take regular backups to discover too late that they aren't fit for purpose. Because backups are hard to get right. That part really, really hurt us.”

Backups 88

Backups Ransomware System Administration Media 88

eSecurity Planet

AUGUST 28, 2023

Some of these attacks are challenging to detect because they look like they could be the behavior of legitimate system administrators. To remedy this vulnerability, Adobe recommends installing Update 16 for ColdFusion 2018 and Update 6 for ColdFusion 2021. An attacker creates a new admin user and logs into an OpenFire account.

VPN 98

VPN Authentication Mobile Firewall 98

Malwarebytes

JANUARY 29, 2021

That updated bot contained a cleanup routine responsible for uninstalling Emotet after the April 25 2021 deadline. For this reason, the cleanup function has to take both scenarios into account. The original report mentioned March 25 but since the months are counted from 0 and not from 1, the third month is in reality April.

Malware 108

Malware System Administration Banking Ransomware 108

eSecurity Planet

AUGUST 28, 2023

Some of these attacks are challenging to detect because they look like they could be the behavior of legitimate system administrators. To remedy this vulnerability, Adobe recommends installing Update 16 for ColdFusion 2018 and Update 6 for ColdFusion 2021. An attacker creates a new admin user and logs into an OpenFire account.

VPN 95

VPN Authentication Mobile Firewall 95

Security Boulevard

SEPTEMBER 24, 2021

Later today (Friday, September 24, 2021), Republican auditors release their final report on the found with elections in Maricopa county. Dominion simply uses “role based security” instead of normal user accounts. The auditors claim account passwords must “be changed every 90 days”. Author: Robert Graham (@erratarob).

Software 110

Software Computers and Electronics Accountability Firewall 110

Errata Security

SEPTEMBER 24, 2021

Author: Robert Graham (@erratarob) Later today (Friday, September 24, 2021), Republican auditors release their final report on the found with elections in Maricopa county. Dominion simply uses “role based security” instead of normal user accounts. The auditors claim account passwords must “be changed every 90 days”.

Software 109

Software Computers and Electronics Accountability Firewall 109

Security Boulevard

FEBRUARY 10, 2022

This technique lets attackers deliver malicious code to thousands of systems through a vector that security measures routinely ignore?—?a Similarly, Kaseya suffered a supply chain attack from the REvil threat group in July 2021. In October 2021 the popular UA-parser.js a trusted vendor.

Malware 96

Malware Software Ransomware Adware 96

SecureList

OCTOBER 17, 2022

Malware distribution via an employee monitoring system and a security package deployment service. In November 2021, multiple PlugX loaders and payloads were detected in a network, which is often a wearisome topic to investigate. Retrieves various system information, namely: Local network IP addresses. 2021-11-10.

Malware 134

Malware Encryption Social Engineering System Administration 134

CyberSecurity Insiders

SEPTEMBER 21, 2021

If any potentially hazardous characters must be allowed as input, be sure that you implement additional controls like output encoding, secure task specific APIs, and accounting to use that data throughout the application. Implement password hashing on a trusted system. Hackers can use these credentials to get access to all accounts.

Authentication 79

Authentication Passwords Software Accountability 79

SC Magazine

JUNE 29, 2021

But the Government Accountability Office found areas where HHS could better coordinate its efforts to support department information sharing and overall health IT security. Emsisoft data shows that 32 health care providers have been disrupted by ransomware alone in 2021, so far.

Healthcare 68

Healthcare Cybersecurity CISO Cyber threats 68

IT Security Guru

JANUARY 12, 2021

System Administrator (or, sysadmin). million cybersecurity by 2021) , better job security, a wide variety of self-employment options, and so on. As a CBO at Ampcus Cyber, Viral overlooks the go-to-market Strategy, channel partner programs, strategic accounts, and customer relationship management. Secure DevOps.

Cybersecurity 88

Cybersecurity Government IoT Penetration Testing 88

Security Affairs

MARCH 27, 2023

The Originating Malvertising Campaign According to CTI investigation on the adversary infrastructure, we were able to identify an ongoing campaign luring system administrators to install the malicious code into their machines.

Malware 98

Malware Social Engineering Encryption Marketing 98

Digital Shadows

AUGUST 17, 2021

But, never mind the dozens of other reports and white papers about phishing that come out every year from security industry leaders, let’s take a look at the 2021 Verizon DBIR. While Verizon even admits in the 2021 DBIR that they’re not entirely sure why email is still such a big thing, but it does serve its purposes.

Phishing 52

Phishing Accountability Social Engineering Mobile 52

eSecurity Planet

DECEMBER 3, 2021

Here are the top Twitter accounts to follow for the latest commentary, research, and much-needed humor in the ever-evolving information security space. Kennedy founded cybersecurity-focused TrustedSec and Binary Defense Systems and co-authored Metasploit: The Penetration Tester’s Guide. — Eva (@evacide) October 4, 2021.

Accountability 139

Accountability Cybersecurity Penetration Testing InfoSec 139

SecureList

AUGUST 12, 2021

While analyzing the CVE-2021-1732 exploit, first discovered by DBAPPSecurity Threat Intelligence Center and used by the BITTER APT group, we found another zero-day exploit that we believe is linked to the same threat actor. The exploit-chain attempts to install malware in the system through a dropper.

Ransomware 145

Ransomware Malware Banking Encryption 145

eSecurity Planet

JULY 30, 2024

A few highlights include analysts, engineering roles in networking, IT system administration, pentesting, and leadership roles. Sysadmin roles can involve: Setting up networks and IT systems: These leaders manage setup processes for hardware, software, network connections, and user permissions.

Cybersecurity 123

Cybersecurity System Administration Engineering Firewall 123

Security Boulevard

FEBRUARY 21, 2024

Abusable Requirements The first issue that raises an eyebrow is the requirement that the machine account for the passive site server must be a member of the LOCAL ADMINISTRATORS group on the active site server. Figure 2: Site Installation Account Next, we’ll shift focus to the site database role. 10.10.100.121:445.

Authentication 64

Authentication Accountability System Administration Software 64