CVE-2023-28252

自2022年2月起，有报道称出现了一种新的勒索软件，该软件似乎利用了Windows 0-day漏洞，这是根据Trend Micro的研究得出的。 关于这种勒索软件的更多信息可以在这个链接中找到。 根据卡巴斯基的分析，Nokoyawa勒索软件组织自2022年6月以来，一直使用其他针对通用日志文件系统（CLFS）驱动程序的漏洞，这些漏洞具有相似但不同的特征，全部与同一个漏洞开发者有关。 2023年4月，当微软发布补丁时，分配了CVE-2023-28252。 此前，在2022年，我们研究了同一组件中的一个类似漏洞，并记录在这篇博客文章中。 通用日志文件系统（CLFS）文件格式：...

CLFS

CLFS攻击 - CVE-2023-28252 自2022年2月起，据报道出现了一种新的勒索软件，据趋势科技的研究，该勒索软件似乎正在利用Windows 0day漏洞。有关此勒索软件的更多信息，可在此链接中找到。根据卡巴斯基的分析，自2022年6月以来，Nokoyawa勒索软件组织一直使用其他针对通用日志文件系统（CLFS）驱动程序的漏洞利用，这些漏洞利用具有相似但不同的特征，且均与同一位漏洞利用开发者相关。 @fortra @mcafee...

Free Decryptor Released for Black Basta and Babuk's Tortilla Ransomware Victims

A decryptor for the Tortilla variant of the Babuk ransomware has been released by Cisco Talos, allowing victims targeted by the malware to regain access to their files. The cybersecurity firm said the threat intelligence it shared with Dutch law enforcement authorities made it possible to arrest...

Experts Expose Farnetwork's Ransomware-as-a-Service Business Model

Cybersecurity researchers have unmasked a prolific threat actor known as farnetwork, who has been linked to five different ransomware-as-a-service RaaS programs over the past four years in various capacities. Singapore-headquartered Group-IB, which attempted to infiltrate a private RaaS program...

New SystemBC Malware Variant Targets Southern African Power Company

An unknown threat actor has been linked to a cyber attack on a power generation company in southern Africa with a new variant of the SystemBC malware called DroxiDat as a precursor to a suspected ransomware attack. "The proxy-capable backdoor was deployed alongside Cobalt Strike Beacons in a sout...

Exploit for Out-of-bounds Write in Microsoft

Since February 2022 was reported a new ransomware that appears t...

Exploit for Out-of-bounds Write in Microsoft

Since February 2022 was reported a new ransomware that appears t...

Cybercrime group exploits zero-day on Windows servers to deploy Nokoyawa ransomware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Nokoyawa ransomware is a new threat that exploits the CVE-2023-28252 vulnerability to infiltrate and encrypt victims files, demanding a ransom for their release. To receive real-time threat advisories,...

Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit

It's the second Tuesday of the month, and Microsoft has released another set of security updates to fix a total of 97 flaws impacting its software, one of which has been actively exploited in ransomware attacks in the wild. Seven of the 97 bugs are rated Critical and 90 are rated Important in...

Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit

It's the second Tuesday of the month, and Microsoft has released another set of security updates to fix a total of 97 flaws impacting its software, one of which has been actively exploited in ransomware attacks in the wild. Seven of the 97 bugs are rated Critical and 90 are rated Important in...

Microsoft (& Apple) Patch Tuesday, April 2023 Edition

Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day...

Nokoyawa ransomware attacks with Windows zero-day

Updated April 20, 2023 In February 2023, Kaspersky technologies detected a number of attempts to execute similar elevation-of-privilege exploits on Microsoft Windows servers belonging to small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions. These...

PT-2023-2243

Name of the Vulnerable Software and Affected Versions Windows Common Log File System Driver affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in the Windows Common Log File System CLFS Driver. This vulnerability allows attackers to affect...

Nokoyawa 2.0 A Reworked Rust-Based Ransomware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Nokoyawa is a 64-bit Windows-based ransomware family that first appeared in early February 2022. The threat group behind Nokoyawa conducts double-extortion ransomware attacks, first stealing data from...

Ransomware Hackers Using New Way to Bypass MS Exchange ProxyNotShell Mitigations

Threat actors affiliated with a ransomware strain known as Play are leveraging a never-before-seen exploit chain that bypasses blocking rules for ProxyNotShell flaws in Microsoft Exchange Server to achieve remote code execution RCE through Outlook Web Access OWA. "The new exploit method bypasses...

Play Ransomware's Attack Playbook Similar to that of Hive, Nokoyawa

Play is a new ransomware that takes a page out of Hive and Nokoyawa's playbook. The many similarities among them indicate that Play, like Nokoyawa, are operated by the same people...

Nearly 34 Ransomware Variants Observed in Hundreds of Cyberattacks in Q4 2021

As many as 722 ransomware attacks were observed during the fourth quarter of 2021, with LockBit 2.0, Conti, PYSA, Hive, and Grief emerging as the most prevalent strains, according to new research published by Intel 471. The attacks mark an increase of 110 and 129 attacks from the third and second...

New Nokoyawa Ransomware Possibly Related to Hive

In March 2022, we came across evidence that another, relatively unknown, ransomware known as Nokoyawa is likely connected with Hive, as the two families share some striking similarities in their attack chain, from the tools used to the order in which they execute various steps...