Threat Round up for December 2 to December 9

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between Dec. 2 and Dec. 9. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Zebra2104 Initial Access Broker Supports Rival Malware Gangs, APTs

Three separate threat groups are all using a common initial access broker IAB to enable their cyberattacks, according to researchers – a finding that has revealed a tangled web of related attack infrastructure underpinning disparate and in some cases rival malware campaigns. The BlackBerry Resear...

Moodle SpellChecker Path Authenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Moodle SpellChecker Path Authenticated Remote Command Execution', 'Description' = %q Moodle allows an authenticated administrator to define...

Downtime on Talos Intelligence

TalosIntelligence.com will be down for a short time on Sept. 17 around 10 a.m. ET while we perform some routine maintenance on the site. We apologize for any inconvenience this may cause. We expect the interruption will only last for about 30 minutes. This is only the beginning! Please visit the...

Novel Email-Based Campaign Targets Bloomberg Clients with RATs

A new email-based campaign by an emerging threat actor aims to spread various remote access trojans RATs to a very specific group of targets who use Bloomberg’s industry-based services. Cisco Talos Intelligence researchers discovered the campaign, dubbing it and its perpetrator “Fajan,” and...

Better email classification, courtesy of you

Cisco customers with Email Security Appliances ESA or Cloud Email Security CES accounts already know the benefits of Cisco’s email filtering. Every day, millions of malicious emails are automatically sent to the trash bin. Cisco encourages customers to participate in honing those filters by...

coturn <= 4.5.1.1 Multiple Vulnerabilities

coturn is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Introducing Cisco Talos Incident Response: Stories from the Field

By Jon Munshaw. As another way of bringing our boots-on-the-ground intelligence to defenders, customers and users, we are introducing a new video series called "Cisco Talos Incident Response: Stories from the Field." In each entry, a CTIR team member will cover one specific incident or lesson tha...

Threat Source newsletter (Feb. 6, 2020)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. There’s never been a better time to be into cyber security podcasts. Our Podcasts page on TalosIntelligence.com got a facelift this week...

MongoDB 3.4 < 3.4.22, 3.6 < 3.6.13, 4.0 < 4.0.9, 4.1 < 4.1.9 User Session Vulnerability - Windows

MongoDB is prone to a vulnerability where after user deletion the improper invalidation of authorization sessions allows an authenticated user SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Beers with Talos EP40: BWT XL feat. SuperMicro, Giant Patches, and More Mobile Malware

Beers with Talos BWT Podcast Ep. 40 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 40 show notes: Recorded Oct. 19, 2018 — In celebration of episode No. 40 and hitting over 1 million downloads!!!, we go XL...

Vulnerability Spotlight: Multiple Vulnerabilities in Sony IPELA E Series Camera

Vulnerabilities discovered by Cory Duplantis and Claudio Bozzato of Cisco Talos. Overview Today, Cisco Talos is disclosing several vulnerabilities discovered with the Sony IPELA E Series Network Camera. Sony IPELA Cameras are network-facing cameras used for monitoring and surveillance...

SourceTree 7za Vulnerability.

SourceTree Version 1.8.3 installs a 7za.exe C:\Program Files x86\Atlassian\SourceTree\tools\7za.exe in Version 9.20, which has known vulnerabilities: CVE-2016-2334 CVE-2016-2335 More information about the vulnerabilities: http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html...