Microsoft Internal Solorigate Investigation Update

As we said in our recent blog, we believe the Solorigate incident is an opportunity to work together in important ways, to share information, strengthen defenses and respond to attacks. Like other SolarWinds customers, we have been actively looking for indicators of the Solorigate actor and want ...

Emotet returns just in time for Christmas

Emotet is a threat we have been tracking very closely throughout the year thanks to its large email distribution campaigns. Once again, and for about two months, the botnet stopped its malspam activity only to return days before Christmas. In typical Emotet fashion, the threat actors continue to...

Simplifying Proactive Defense With Threat Playbooks

Security defense strategy can be extremely complex, with security teams grappling with tens of thousands of information points and evolving attacker techniques, said Derek Manky, Chief of Security Insights & Global Threat Alliances at Fortinet’s FortiGuard Labs. Derek Manky FortiGuard Labs has...

CISA Updates Alert and Releases Supplemental Guidance on Emergency Directive for SolarWinds Orion Compromise

CISA has updated AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations, originally released December 17. This update states that CISA has evidence of, and is currently investigating, initial access vectors in addition to...

Threat Roundup for December 11 to December 18

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 11 and Dec. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

Wormable Gitpaste-12 Botnet Returns to Target Linux Servers, IoT Devices

A new wormable botnet that spreads via GitHub and Pastebin to install cryptocurrency miners and backdoors on target systems has returned with expanded capabilities to compromise web applications, IP cameras, and routers. Early last month, researchers from Juniper Threat Labs documented a...

SolarWinds advanced cyberattack: What happened and what to do now

We learned more about the sophisticated attack first disclosed on December 8 when security firm FireEye reported it had been the victim of a state-sponsored adversary that stole Red Team assessment tools. On December 13 there was a new development when IT company SolarWinds announced it had been...

CVE-2020-17469

creationtimestamp| type| source ---|---|--- 2020-12-12 02:36:04+00:00| seen| https://t.me/cibsecurity/20658 2020-12-12 02:39:05+00:00| seen| https://t.me/cibsecurity/20678 2020-12-12 03:25:29+00:00| seen| https://t.me/cibsecurity/20698 2020-12-12 04:07:18+00:00| seen| https://t.me/cibsecurity/207...

CVE-2020-17467

creationtimestamp| type| source ---|---|--- 2020-12-12 02:35:48+00:00| seen| https://t.me/cibsecurity/20647 2020-12-12 02:38:49+00:00| seen| https://t.me/cibsecurity/20667 2020-12-12 03:25:15+00:00| seen| https://t.me/cibsecurity/20687...

Threat Roundup for December 4 to December 11

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 4 and Dec. 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

CVE-2020-4829

creationtimestamp| type| source ---|---|--- 2020-12-11 02:34:28+00:00| seen| https://t.me/cibsecurity/19634 2020-12-11 02:37:32+00:00| seen| https://t.me/cibsecurity/19654 2020-12-11 03:25:21+00:00| seen| https://t.me/cibsecurity/19674 2020-12-11 04:25:16+00:00| seen| https://t.me/cibsecurity/196...

CVE-2020-27351

creationtimestamp| type| source ---|---|--- 2020-12-10 07:33:36+00:00| seen| https://t.me/cibsecurity/18563 2020-12-10 07:36:36+00:00| seen| https://t.me/cibsecurity/18583 2020-12-10 08:25:35+00:00| seen| https://t.me/cibsecurity/18603 2020-12-10 09:25:23+00:00| seen| https://t.me/cibsecurity/186...

Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach

Update Jan 5, 2021: New patching section with two new dashboard widgets showing the number of missing FireEye-related patches in your environment and the number of assets in your environment missing one of those patches. Update Dec 23, 2020: Added a new section on compensating controls. Update De...

Threat Roundup for November 27 to December 4

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 27 and Dec. 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

Hackers Targeting Companies Involved in Covid-19 Vaccine Distribution

A global spear-phishing campaign has been targeting organizations associated with the distribution of COVID-19 vaccines since September 2020, according to new research. Attributing the operation to a nation-state actor, IBM Security X-Force researchers said the attacks took aim at the vaccine col...

IBM Releases Report on Cyber Actors Targeting the COVID-19 Vaccine Supply Chain

IBM X-Force has released a report on malicious cyber actors targeting the COVID-19 cold chain—an integral part of delivering and storing a vaccine at safe temperatures. Impersonating a biomedical company, cyber actors are sending phishing and spearphishing emails to executives and global...

Threat Roundup for November 13 to November 20

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 13 and Nov. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

3 Ways to Hunt for the ZeroLogon Vulnerability on Your Windows Servers

Vulnerability assessment and patch management can be painful time-consuming processes. From the Security team looking at vulnerability reports and prioritizing the riskiest ones for their environment to the IT or Infrastructure team determining exactly which machines need to be patched and...

Chinese APT Hackers Target Southeast Asian Government Institutions

Cybersecurity researchers today unveiled a complex and targeted espionage attack on potential government sector victims in South East Asia that they believe was carried out by a sophisticated Chinese APT group at least since 2018. "The attack has a complex and complete arsenal of droppers,...

Threat Roundup for October 30 to November 6

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 30 and Nov. 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...