ROS-2-1219

2.1219 Vulnerability in FreeRDP 1. Vulnerability description: Eight vulnerabilities have been addressed. Five issues can cause a crash or data leak due to reads from areas outside the allocated buffer. One issue results in an integer overflow. Three issues can lead to buffer overflows in the...

Behind the scenes of business email compromise: Using cross-domain threat data to disrupt a large BEC campaign

Microsoft 365 Defender researchers recently uncovered and disrupted a large-scale business email compromise BEC infrastructure hosted in multiple web services. Attackers used this cloud-based infrastructure to compromise mailboxes via phishing and add forwarding rules, enabling these attackers to...

Behind the scenes of business email compromise: Using cross-domain threat data to disrupt a large BEC campaign

Microsoft 365 Defender researchers recently uncovered and disrupted a large-scale business email compromise BEC infrastructure hosted in multiple web services. Attackers used this cloud-based infrastructure to compromise mailboxes via phishing and add forwarding rules, enabling these attackers to...

Behind the scenes of business email compromise: Using cross-domain threat data to disrupt a large BEC campaign

Microsoft 365 Defender researchers recently uncovered and disrupted a large-scale business email compromise BEC infrastructure hosted in multiple web services. Attackers used this cloud-based infrastructure to compromise mailboxes via phishing and add forwarding rules, enabling these attackers to...

Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop

More than a month into the discovery of Solorigate, investigations continue to unearth new details that prove it is one of the most sophisticated and protracted intrusion attacks of the decade. Our continued analysis of threat data shows that the attackers behind Solorigate are skilled campaign...

Trickbot disrupted

As announced today, Microsoft took action against the Trickbot botnet, disrupting one of the world’s most persistent malware operations. Microsoft worked with telecommunications providers around the world to disrupt key Trickbot infrastructure. As a result, operators will no longer be able to use...

The Anatomy of Threat Hunting: What You Need to Know and Why

No big surprise here: cybercrime will keep causing a major slowdown in the years to come as the business world proceed with digitalization. Despite implementing all traditional measures to stay protected, organizations keep falling prey to impersonation, phishing, and malware. Scary enough? What’...

Automated API Protection with WAP

For those who use Web Application Protector from Akamai: "Your APIs just got an extra layer of protection". For everyone else, learn how easy a WAF can be. You protect your web applications, that's awesome, but what about all your APIs? Do you know how many you have, who accesses them and what...

Linux Malware Detect: LMD

Linux Malware Detect LMD is a malware scanner for Linux released under the GNU GPLv2 license, that is designed around the threats faced in shared hosted environments. It uses threat data from network edge intrusion detection systems to extract malware that is actively being used in attacks and...

Facebook ThreatExchange Information Sharing

As Facebook’s ThreatExchange information-sharing platform hits its six-month milestone, the social network today announced that its closing in on 100 participants and has streamlined the application process. ThreatExchange was launched in February as a free vehicle for sharing threat and attack...

Cisco Acquires OpenDNS for $635 Million

Cisco continues to spend on security, today announcing its intent to acquire San Francisco-based OpenDNS for $635 million. OpenDNS’ domain name system and cloud-based security services bring threat data collected from those platforms to Cisco’s security offerings. “To build on Cisco’s advanced...

Facebook Opens ThreatExchange Information Sharing Platform

Facebook, with its giant infrastructure and its equally wide view into Internet attacks, has built an information-sharing platform that it hopes will entice other big technology companies to join and contribute threat data and indicators of compromise. The platform, called ThreatExchange, already...

Microsoft Interflow Information-Sharing Platform Preview Open

Much like the Year of PKI that has never come to be, information sharing has been one of security’s more infamous non-starters. While successful in heavily siloed environments such as financial services, enterprises industry-wide are hesitant to share threat and security data for fear of losing a...

NSA's Alexander Appeals For Threat Information Sharing

WASHINGTON– While Congress and the technology community are still debating and discussing the intelligence gathering capabilities of NSA revealed in recent months, the agency’s director, Gen. Keith Alexander, is not just defending the use of these existing tools, but is pitching the idea of shari...

Microsoft Expands MAPP Program to Incident Response Teams

Microsoft is expanding its MAPP program that shares attack and protection information with other security vendors and will now be sharing some data with incident responders, as well. The new system will enable organizations such as CERTs and internal IR teams to exchange information on specific...

Firm Scores $29M for Anti Botnet-As-A-Service

Endgame Systems is expanding from the government sector to commercial anti botnet services with a $29 million investment. The headlines in recent months have been filled with news about busts of major botnet operations – Bredolab, Pushdo, Waldec and Mariposa among them. But botnets are still a...