Hacky Holidays: Celebrating the Best of Security Nation [Video]

!Hacky Holidays: Celebrating the Best of Security Nation \Video\https://blog.rapid7.com/content/images/2021/12/security-nation-recap-2.jpg Most of us allow ourselves a few extra indulgences around the holidays — so despite my best editorial sensibilities, I'm letting myself indulge here in a...

Karakurt: A New Emerging Data Theft and Cyber Extortion Hacking Group

A previously undocumented, financially motivated threat group has been connected to a string of data theft and extortion attacks on over 40 entities between September and November 2021. The hacker collective, which goes by the self-proclaimed name Karakurt and was first identified in June 2021, i...

Top 3 SaaS Security Threats for 2022

With 2021 drawing to a close and many closing their plans and budgets for 2022, the time has come to do a brief wrap-up of the SaaS Security challenges on the horizon. Here are the top 3 SaaS security posture challenges as we see them. 1 — The Mess of Misconfiguration Management The good news is...

Microsoft Details Building Blocks of Widely Active Qakbot Banking Trojan

Infection chains associated with the multi-purpose Qakbot malware have been broken down into "distinct building blocks," an effort that Microsoft said will help to proactively detect and block the threat in an effective manner. The Microsoft 365 Defender Threat Intelligence Team dubbed Qakbot a...

Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability

January 10, 2022 recap – The Log4j vulnerabilities represent a complex and high-risk situation for companies across the globe. This open-source component is widely used across many suppliers’ software and services. By nature of Log4j being a component, the vulnerabilities affect not only...

Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability

January 10, 2022 recap – The Log4j vulnerabilities represent a complex and high-risk situation for companies across the globe. This open-source component is widely used across many suppliers’ software and services. By nature of Log4j being a component, the vulnerabilities affect not only...

Canadian Citizen Charged for Ransomware Attacks in Alaska

By Deeba Ahmed The accused became a suspect when the FBI contacted Canadian intelligence after observing a surge in ransomware attacks in Alaska in 2018. This is a post from HackRead.com Read the original post: Canadian Citizen Charged for Ransomware Attacks in Alaska...

BlackCat: A New Rust-based Ransomware Malware Spotted in the Wild

Details have emerged about what's the first Rust-language-based ransomware strain spotted in the wild that has already amassed "some victims from different countries" since its launch last month. The ransomware, dubbed BlackCat, was disclosed by MalwareHunterTeam. "Victims can pay with Bitcoin or...

RANSOMWARE: Ranzy Locker

On 25 October 2021, the FBI released a report documenting their findings about a ransomware variant known as Ranzy Locker. While Ranzy Locker has not been used as prolifically as Conti or Darkside, it does leverage some of the same old ransomware tricks to attack its victims. In conjunction with...

New Yanluowang Ransomware Found to be Code-Signed, Terminates Database-Related Processes

We analyzed new samples of the Yanluowang ransomware. One interesting aspect of these samples is that the files are code-signed. They also terminate various processes which are related to database and backup management...

Canadian Ransomware Arrest Is a Meaningful Flex, Experts Say

Investigations that ran in parallel over nearly two years by Canadian and U.S. law enforcement have led to this week’s arrest of an Ottawa man, who is alleged to have an extensive track record of ransomware attacks on companies, governments and individuals. The highly-publicized arrest is a messa...

US Military’s Hacking Unit to take on ransomware gangs

By ghostadmin The Units boss Gen. Paul Nakasone said that the US military computer operatives are ready to target ransomware gangs and state actors, whoever poses a threat to critical US infrastructure. The US militarys hacking division called Cyber Command is taking aggressive steps to fight...

A closer look at Qakbot’s latest building blocks (and how to knock them down)

Multiple Qakbot campaigns that are active at any given time prove that the decade-old malware continues to be many attackers’ tool of choice, a customizable chameleon that adapts to suit the needs of the multiple threat actor groups that utilize it. Since emerging in 2007 as a banking Trojan,...

A closer look at Qakbot’s latest building blocks (and how to knock them down)

Multiple Qakbot campaigns that are active at any given time prove that the decade-old malware continues to be many attackers’ tool of choice, a customizable chameleon that adapts to suit the needs of the multiple threat actor groups that utilize it. Since emerging in 2007 as a banking Trojan,...

Why Holidays Put Your Company at Risk of Cyber Attack (And How to Take Precautions)

It is a time when many are thinking of their families and loved ones, time off work, and gift-giving – the holidays. However, while many have their minds outside the realm of work during the holiday season, often, this is when attackers plan their most sinister attacks. So how can you take...

Unitrends Backup DLL Injection Vulnerability

Unitrends Backup is eliminating data loss, ransomware and risk. versions prior to Unitrends Backup 10.5.5 have a DLL injection vulnerability that can be exploited by attackers to escalate privileges from unprivileged users to the system...

Unitrends Backup Arbitrary File Read Vulnerability

Unitrends Backup is designed to eliminate data loss, ransomware and risk. An arbitrary file read vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by an attacker to read arbitrary files on the system...

Unspecified Vulnerability in Unitrends Backup

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A security vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by an attacker to write malicious files with elevated privileges...

Unitrends Backup elevation of privilege vulnerability (CNVD-2021-95944)

Unitrends Backup is designed to eliminate data loss, ransomware and risk. An elevation of privilege vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which originates from the creation of arbitrary writable files on a privileged vault server, and can be exploited by an attacke...

Unitrends Backup Buffer Overflow Vulnerability

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A buffer overflow vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by an attacker to cause a denial of service or remote code execution...