Check Point Response to Apache Log4j Remote Code Execution

Solution On December 10, 2021, a proof of concept of a vulnerability in the Apache Log4j Java library CVE-2021-44228 was published. The vulnerability may allow unauthenticated threat actors to obtain remote code execution. The severity of the vulnerability was deemed critical. The Check Point...

Emotet’s Behavior & Spread Are Omens of Ransomware Attacks

The rapid spread of Emotet via TrickBot and its behavior since the malware resurfaced last month could signal that a spate of ransomware attacks are on the way, spurring researchers to warn organizations to buckle up and get ready. In mid-November, a team of researchers from Cryptolaemus, G DATA...

More Stealthier Version of BrazKing Android Malware Spotted in the Wild

Banking apps from Brazil are being targeted by a more elusive and stealthier version of an Android remote access trojan RAT that's capable of carrying out financial fraud attacks by stealing two-factor authentication 2FA codes and initiating rogue transactions from infected devices to transfer...

New 'Moses Staff' Hacker Group Targets Israeli Companies With Destructive Attacks

A new politically-motivated hacker group named "Moses Staff" has been linked to a wave of targeted attacks targeting Israeli organizations since September 2021 with the goal of plundering and leaking sensitive information prior to encrypting their networks, with no option to regain access or...

Mekotio Banking Trojan Resurges with Tweaked Code, Stealthy Campaign

The Mekotio Latin American banking trojan is bouncing back after several of the gang that operates it were arrested in Spain. More than 100 attacks in recent weeks have featured a new infection routine, indicating that the group continues to actively retool. “The new campaign started right after...

Check Point response to Apache CVEs - November 2021 for httpd versions between 2.4.41 and 2.4.51

Solution In November 2021, Apache open source published CVEs for httpd versions between 2.4.41 and 2.4.51 see the list of the CVEs in the "Cause" section. Check Point uses the Apache HTTP Server as the Web server for several of its user portals on both the Security Gateway Gaia Portal, Identity...

Cyber Attack in Iran Reportedly Cripples Gas Stations Across the Country

A cyber attack in Iran left petrol stations across the country crippled, disrupting fuel sales and defacing electronic billboards to display messages challenging the regime's ability to distribute gasoline. Posts and videos circulated on social media showed messages that said, "Khamenei! Where is...

PT-2021-18721

Name of the Vulnerable Software and Affected Versions Check Point Harmony Browse and SandBlast Agent for Browsers versions prior to 90.08.7405 Description The issue arises because the MS Installer allows regular users to repair their installation. An attacker can exploit this by running an...

Check Point Response to CVE-2021-30359 - Harmony Browse installer or SandBlast Agent for Browsers installer can be used for privileges escalation

Cause The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Installer let regular users to repair their installation, an attacker running the old version of the installer can start the installati...

Check Point Mobile Access operating system command injection vulnerability

Check Point Mobile Access is a secure and easy solution from Check Point, Inc. It is used for smartphones, tablets or personal computers to securely connect to corporate applications over the Internet. An operating system command injection vulnerability exists in Check Point Mobile Access Portal...

Mobile Access Portal Agent before Build 800007042 runs Arbitrary Applications

Cause Mobile Access Portal Agent runs predefined Native Applications. If administrator configured such application with environment variables in the path, Portal Agent may run an arbitrary application that was placed in a specially created location. Symptoms - When environment variables are used ...

OpenSea ‘Free Gift’ NFTs Drain Cryptowallet Balances

Users of OpenSea, the world’s largest digital-collectible marketplace, have found their cryptocurrency wallets ripped off thanks to cyberattackers weaponizing security bugs that allowed them to highjack user accounts. The attacks revolved around boobytrapped art files, which circulated in the for...

PT-2021-21208

Name of the Vulnerable Software and Affected Versions Dell iDRAC 9 versions prior to 4.40.40.00 Dell iDRAC 8 versions prior to 2.80.80.80 Check Point GAiA affected versions not specified Description The issue is a Stack Buffer Overflow in Racadm, which can be exploited by an authenticated remote...

WhatsApp Photo Filter Bug Allows Sensitive Info to Be Lifted

A security vulnerability in WhatsApp’s pic-retouching function could allow an attacker to read sensitive information from the WhatsApp memory, researchers said – so users should be careful whose pics they view and should, of course, update their apps. Disclosed by Check Point Research CPR, the...

WhatsApp Photo Filter Bug Could Have Exposed Your Data to Remote Attackers

A now-patched high-severity security vulnerability in WhatApp's image filter feature could have been abused to send a malicious image over the messaging app to read sensitive information from the app's memory. Tracked as CVE-2020-1910 CVSS score: 7.8, the flaw concerns an out-of-bounds read/write...

Amazon Kindle Vulnerable to Malicious EBooks

A security flaw in Amazon’s Kindle e-reader made it vulnerable to malicious eBooks, opening the door to turning the devices into bots, compromising personal information and more. That’s according to Check Point researcher Slava Makkaeveev, who released the findings Friday. Check Point disclosed t...

XLoader Windows InfoStealer Malware Now Upgraded to Attack macOS Systems

A popular malware known for stealing sensitive information from Windows machines has evolved into a new strain capable of also targeting Apple's macOS operating system. The upgraded malware, dubbed "XLoader," is a successor to another well-known Windows-based info stealer called Formbook that's...

MacOS Being Picked Apart by $49 XLoader Data Stealer

There’s a new version of the old FormBook form-stealer and keylogger that’s added Mac users to its hit list, and it’s selling like hotcakes on underground markets for as low as $49. It’s not only cheap; it’s easy. The data stealer is distributed in the form of malware-as-a-service MaaS and stands...

Experts Uncover Malware Attacks Targeting Corporate Networks in Latin America

Cybersecurity researchers on Thursday took the wraps off a new, ongoing espionage campaign targeting corporate networks in Spanish-speaking countries, specifically Venezuela, to spy on its victims. Dubbed "Bandidos" by ESET owing to the use of an upgraded variant of Bandook malware, the primary...

One-Click Exploit Could Have Let Attackers Hijack Any Atlassian Account

Cybersecurity researchers on Wednesday disclosed critical flaws in the Atlassian project and software development platform that could be exploited to take over an account and control some of the apps connected through its single sign-on SSO capability. "With just one click, an attacker could have...