Vulnerability Management Tips for the Shadow Brokers Leaked Exploits

Rebekah Brown and the Rapid7 team have delivered a spot-on breakdown of the recent Shadow Brokers exploit and tool release. Before you read any further, if you havent done so already, please read her post. Its probably not the only post youve read on this topic, but it is cogent, well-constructed...

Digging Into WannaCry Details: Answers to Your Burning Questions

Jimmy Graham, Director of Product Management, Qualys Threat Protection & AssetView The WannaCry ransomware attack spread so quickly and has been so disruptive that IT departments can’t get enough information about what caused it, how it can be remediated and what can be done to protect their...

CVE-2017-7494

creationtimestamp| type| source ---|---|--- 2017-05-24 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42060 2017-05-25 09:39:43+00:00| exploited| https://t.me/informationsecuritychannel/5393 2017-05-25 19:39:00+00:00| exploited| https://t.me/informationsecuritychannel/5415...

Cisco Coverage for Adylkuzz, Uiwix, and EternalRocks

When the WannaCry attack was launched a little over a week ago, it was one of the first large scale attacks leveraging the data that was leaked by the Shadow Brokers. At the time the real concern was how quickly we would begin to see other threats leverage the same vulnerabilities. Over the past...

EternalRocks Worm Spreads Seven NSA SMB Exploits

Someone has stitched together seven of the Windows SMB exploits leaked by the ShadowBrokers, creating a worm that has been spreading through networks since at least the first week of May. Researcher Miroslav Stampar, a member of the Croatian government’s CERT, captured a sample of the worm last...

Newly Found Malware Uses 7 NSA Hacking Tools, Where WannaCry Uses 2

A security researcher has identified a new strain of malware that also spreads itself by exploiting flaws in Windows SMB file sharing protocol, but unlike the WannaCry Ransomware that uses only two leaked NSA hacking tools, it exploits all the seven. Last week, we warned you about multiple hackin...

CVE-2017-9101

creationtimestamp| type| source ---|---|--- 2017-05-21 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42044 2018-05-08 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44598 2018-05-29 15:50:33+00:00| seen|...

Terror Exploit Kit Evolves Into Larger Threat

The relatively new Terror exploit kit is bucking the downward trend in the EK market, and is steadily evolving into more of a threat. Researchers at Cisco Talos said Terror has abandoned an early strategy that included “carpet-bombing” a target’s browser to one that now uses exploits that precise...

Terror Evolved: Exploit Kit Matures

This post is authored by Holger Unterbrink and Emmanuel Tacheau Executive SummaryTalos is monitoring the major Exploit KitsEK on an ongoing basis. While investigating the changes we recently observed in the RIG EK campaigns, we identified another well known candidate: Terror Exploit Kit.Terror EK...

Next Payload Could be Much Worse Than WannaCry

No one should be letting their guard down now that the WannaCry ransomware attacks have been relatively contained. Experts intimately involved with analyzing the malware and worldwide attacks urge quite the opposite, warning today that there’s nothing stopping attackers from using the available N...

For the APT organization to use the EPS vulnerabilities in and mention the right vulnerability analysis-vulnerability warning-the black bar safety net

In 2015, FireEye released a Microsoft Office EPS（Encapsulated PostScript in the two vulnerability details. Wherein, a is 0day vulnerabilities, one in the attack a few weeks before playing the patch. Recently, FireEye and Microsoft Office products in the discovery of three new 0day vulnerabilities...

ShadowBrokers Planning Monthly Exploit, Data Dump Service

Popcorn in hand, the ShadowBrokers say they’re taking in the WannaCry outbreak from the sidelines before starting in June a subscription service for new exploits and stolen data akin to a wine of the month club. In what’s become a signature periodic rant from the unknowns behind the leak of...

Shadow Brokers, Who Leaked WannaCry SMB Exploit, Are Back With More 0-Days

The infamous hacking collective Shadow Brokers – the one who leaked the Windows SMB exploit in public that led to last weekend's WannaCrypt menace – are back, this time, to cause more damage. In typically broken English, the Shadow Brokers published a fresh statement with full of frustration a fe...

shadowbroker

This repository, kaleozhou/shadowbroker, is an offensive tool repository containing exploits for various vulnerabilities in different software and systems. The exploits are categorized into several types, including SMB Server Message Block exploits, email server exploits, and others. The reposito...

WannaCry Variants Pick Up Where Original Left Off

The inevitable wave of WannaCry ransomware variants began in earnest over the weekend after bit of sleuthing from a U.K. researcher slowed down the initial global outbreak. At least five new takes on the first attack, all still leveraging the NSA’s EternalBlue exploit and DoublePulsar rootkit, ar...

Oracle Linux 6 / 7 : ghostscript (ELSA-2017-1230)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1230 advisory. - Security fix for CVE-2017-8291 updated to address SIGSEGV Tenable has extracted the preceding description block directly from the Oracle Linux security...

How to Rapidly Identify Assets at Risk to WannaCry Ransomware and ETERNALBLUE Exploit

In what may be the first public weaponizing of April's Shadow Brokers dump of NSA exploits, a ransomware attack has crippled IT systems globally and disrupted operations at major organizations, including patient services at UK hospitals. About 80,000 infections have been detected in about 100...

CVE-2017-7308

creationtimestamp| type| source ---|---|--- 2017-05-11 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41994 2017-07-13 23:11:09+00:00| seen| https://t.me/canyoupwnme/1759 2018-05-18 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44654 2018-05-29 15:50:33+00:00| see...

PHOENIX CONTACT mGuard

CVSS v3 8.6 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: mGuard Vulnerabilities: Resource Exhaustion, Improper Authentication AFFECTED PRODUCTS The following versions of mGuard, a network device, are affected: mGuard firmware versions 8.3.0 to 8.4....

KLA11029 Multiple vulnerabilities in the Microsoft Malware Protection Engine

Multiple serious vulnerabilities have been found in Microsoft Malware Protection Engine. Malicious users can exploit these vulnerabilities to cause a denial of service and execute arbitrary code. Below is a complete list of vulnerabilities: 1. Multiple vulnerabilities related to an improper...