What is a Botnet ❓ Definition, Types, Example Attack

Professionals, who make system security arrangements, are well-aware of the term ‘botnet’. Often used for the chain of hijacked computers/systems, the term ‘botnet’ should be well understood if a restorative and robust system is instructed as their wrong usage can lead to tremendous chaos. Botnet...

Dridex affiliate dresses up as Scrooge

Threat actors are hoping to catch a few more victims before they leave work for the Christmas holidays. The recent malicious spam campaigns malspam we and others have observed appear to have been created by someone who wants to play Scrooge and add onto peoples already heightened state of anxiety...

Sql injection

The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection...

CVE-2021-24863

CVE-2021-24863 affects the WordPress plugin StopBadBots (StopBadBots WordPress plugin) prior to version 6.67. The vulnerability is a SQL injection caused by failure to sanitize and escape the User Agent before using it in a SQL statement to save it. Impact is unauthenticated access leading to dat...

Talos Takes Ep. #79: Emotet's back with the worst type of holiday present

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. Emotet is back, and it brought the worst possible holiday present just in time for peak spam season, too!. We... This is...

Trend Micro Worry-Free Business Security has an unspecified vulnerability (CNVD-2022-08933)

Trend Micro Worry-Free Business Security is an enterprise-class information security protection solution from Trend Micro, Inc. The product provides anti-spam, anti-virus, network security and email protection features.A security vulnerability exists in Trend Micro Worry-Free Business Security,...

Hackers Exploiting ProxyLogon and ProxyShell Flaws in Spam Campaigns

Threat actors are exploiting ProxyLogon and ProxyShell exploits in unpatched Microsoft Exchange Servers as part of an ongoing spam campaign that leverages stolen email chains to bypass security software and deploy malware on vulnerable systems. The findings come from Trend Micro following an...

SmarterMail Cross-Site Scripting Vulnerability

SmarterMail is a mail server software from Smartertools, Inc. The software supports spam filtering, statistics, and simple mail transfer protocol SMTP authentication.SmarterMail has a cross-site scripting vulnerability in 16.x through 100.x. The vulnerability stems from a lack of data validation...

Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys

Impact Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email. Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply...

Cross site request forgery (csrf)

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment...

Hacker accessed FBI server to send fake email threats

By Waqas The FBI has categorically denied sending spam emails from its server, which according to reports, hit 100,000 inboxes. This is a post from HackRead.com Read the original post: Hacker accessed FBI server to send fake email threats...

Hoax Email Blast Abused Poor Coding in FBI Website

The Federal Bureau of Investigation FBI confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sen...

QAKBOT Loader Returns With New Techniques and Tools

QAKBOT operators resumed email spam operations towards the end of September after an almost three-month hiatus. QAKBOT detection has become a precursor to many critical and widespread ransomware attacks. Our report shares some insight into the new techniques and tools this threat is using...

QAKBOT Loader Returns With New Techniques and Tools

QAKBOT operators resumed email spam operations towards the end of September after an almost three-month hiatus. QAKBOT detection has become a precursor to many critical and widespread ransomware attacks. Our report shares some insight into the new techniques and tools this threat is using...

The vulnerability of the Address Book component of the Microsoft Outlook client, which allows attackers to perform spoofing attacks

The vulnerability of the Address Book component in the Microsoft Outlook email client is related to insufficient validation of addresses in headers. Exploiting this vulnerability could allow attackers, operating remotely, to carry out spam attacks using externally similar IDN domains...

Spam and phishing in Q3 2021

Quarterly highlights Scamming championship: sports-related fraud This summer and early fall saw some major international sporting events. The delayed Euro 2020 soccer tournament was held in June and July, followed by the equally delayed Tokyo Olympics in August. Q3 2021 also featured several F1...

Threat Source newsletter (Oct. 28, 2021)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. Most people know about chicken and waffles. But what about squirrel and waffles? They may not be the most appetizing brunch, but they are teaming up for one heck of a spam campaign. We have new research out... This is only the...

FreeSWITCH 1.10.6 Missing SIP MESSAGE Authentication Exploit

FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing - Fixed versions: v1.10.7 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-07-freeswitch-SIP-MESSAGE-without-auth - Vendor Security Advisory:...

CVE-2021-37624

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message...

Authentication flaw

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message...