3742 matches found
GandCrab ransomware and Ursnif virus spreading via MS Word macros
Security researchers have discovered two separate malware campaigns, one of which is distributing the Ursnif data-stealing trojan and the GandCrab ransomware in the wild, whereas the second one is only infecting victims with Ursnif malware. Though both malware campaigns appear to be a work of two...
RogueRobin Malware Uses Google Drive as C2 Channel
A custom malware used by the APT known as DarkHydrus uses a mix of novel techniques, including using Google Drive as an alternate command-and-control C2 channel. According to Palo Alto’s Unit 42 intelligence division, the targeted attack involved spear-phishing emails written in Arabic sent to...
The vulnerability of the PowerShell API software interface of the Microsoft Exchange Server mail server allows a hacker to gain access to protected information.
The vulnerability of the PowerShell API of the Microsoft Exchange Server mail server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to protected information within the Calendar application...
Fallout EK Retools for a Fresh New 2019 Look
A new version of the Fallout exploit kit EK has emerged, featuring new exploits and fresh payloads, including the GandCrab ransomware. The development shows that EKs have a lot of life yet left in them, researchers say. The Fallout EK generally finds its victims by way of malvertising campaigns,...
Threat Roundup for Jan. 11 to Jan. 18
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 11 and Jan. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...
Improved Fallout EK comes back after short hiatus
Edit 2019-01-24 Fallout EK introduces a new dropper to facilitate the final payload retrieval. This update replaces the plain MZ we saw for a little while. -- After a short hiatus in early January, the Fallout exploit kit is back in business again with some new features for the new year. During i...
BMC Patrol Agent Privilege Escalation Cmd Execution
This module leverages the remote command execution feature provided by the BMC Patrol Agent software. It can also be used to escalate privileges on Windows hosts as the software runs as SYSTEM but only verfies that the password of the provided user is correct. This also means if the software is...
The vulnerability of the Device Guard component of the Windows operating system allows a hacker to inject arbitrary code into a Windows PowerShell session.
The vulnerability of the Device Guard component in the Windows operating system is related to security configuration errors. Exploiting this vulnerability could allow a local attacker to inject arbitrary code into the Windows PowerShell session...
Vulnerability of the .NET Core runtime and PowerShell Core automation framework, related to authentication process errors, allowing attackers to disclose sensitive information
The vulnerability of the .NET Core runtime and the PowerShell Core automation framework is related to authentication process errors. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information remotely...
CVE-2019-0588
An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server...
Information disclosure
An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server...
CVE-2019-0588
CVE-2019-0588 affects Microsoft Exchange Server. The vulnerability is an information disclosure arising when the Exchange PowerShell API grants calendar contributors more view permissions than intended. Root cause: mis-scoped permissions in the PowerShell API lead to unauthorized calendar data ex...
CVE-2019-0588
An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server...
January 8, 2019—KB4480957 (Security-only update)
None None...
January 8, 2019—KB4480963 (Monthly Rollup)
None None...
January 8, 2019—KB4480966 (OS Build 17134.523)
None None...
January 8, 2019—KB4480116 (OS Build 17763.253)
None None...
January 8, 2019—KB4480962 (OS Build 10240.18094)
None None...