6669 matches found
Threat Roundup for March 15 to March 22
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 15 and March 22. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...
AZORult++: Rewriting history
The AZORult Trojan is one of the most commonly bought and sold stealers in Russian forums. Despite the relatively high price tag $100, buyers like AZORult for its broad functionality for example, the use of .bit domains as C&C servers to ensure owner anonymity and to make it difficult to block th...
Buffer Overflow Vulnerability in Multiple IBM Products
The IBM Power System S922, among others, is a Power processor-based server device from IBM in the United States. A buffer overflow vulnerability exists in the boot loader in several IBM products. An attacker could exploit this vulnerability to overwrite the bootloader's instruction memory, bypass...
Mac-Focused Malvertising Campaign Abuses Google Firebase DBs
A malvertising group named VeryMal that targets Mac users has changed up its tactics, ditching steganography as its obfuscation technique. Instead, it’s using ad tags that fetch a payload from Google Firebase in order to redirect users to malicious pop-ups. Confiant estimates that close to 1...
Israeli fintech firms hit by Cardinal RAT malware
By Waqas The IT security researchers at Palo Alto Networks' Unit 42 have discovered a malware that has been targeting Israeli cyberspace especially those dealing with technology and financial sector. Dubbed Cardinal RAT remote access Trojan by researchers; the malware is currently targeting two...
SQL Injection Vulnerability in Website Building System of Guangzhou Ju Teng Information Technology Co.
Guangzhou Ju Teng Information Technology Co., Ltd. specializes in website planning, production, promotion and network system development. Guangzhou Ju Teng Information Technology Co., Ltd. station building system there are SQL injection vulnerabilities, the attacker to take advantage of the...
Counter-Strike 1.6 game client 0-day exploited to spread Belonard trojan
By Waqas Dr. Web’s cybersecurity researchers have identified an attacker is trying to exploit zero-day vulnerabilities in Counter-Strike 1.6 game specifically to distribute Belonard Trojan. Reportedly, about 39% of all the active servers of the game on Steam have been manipulated and compromised ...
Hackers are using 19-year-old WinRAR bug to install nasty malware
By Waqas By using the bug, hackers are desperately dropping persistent malware through generic trojan on systems using the old version of WinRar. McAfee security firm’s researcher Craig Schmugar has identified that the world famous and commonly used compression software WinRar is plagued with cod...
CVE-2018-18254
An issue was discovered in CapMon Access Manager 5.4.1.1005. An unprivileged user can read the calwhitelist table in the Custom App Launcher CAL database, and potentially gain privileges by placing a Trojan horse program at an app pathname...
Design/Logic Flaw
An issue was discovered in CapMon Access Manager 5.4.1.1005. An unprivileged user can read the calwhitelist table in the Custom App Launcher CAL database, and potentially gain privileges by placing a Trojan horse program at an app pathname...
CVE-2018-18254
An issue was discovered in CapMon Access Manager 5.4.1.1005. An unprivileged user can read the calwhitelist table in the Custom App Launcher CAL database, and potentially gain privileges by placing a Trojan horse program at an app pathname...
Zero-Days in Counter-Strike Client Used to Build Major Botnet
A proprietor of a Counter-Strike gaming server promotion service has used multiple zero-days in the Counter-Strike client to create a large botnet. The network is made up of fake game servers for the popular online multiplayer game. The attacker has had quite a bit of success. In a recent analysi...
Emotet revisited: pervasive threat still a danger to businesses
One of the most common and pervasive threats for businesses today is Emotet, a banking Trojan turned downloader that has been on our list of top 10 detections for many months in a row. Emotet, which Malwarebytes detects as Trojan.Emotet, has been leveled at consumers and organizations across the...
Zero-Day Flaws in Counter-Strike 1.6 Let Malicious Servers Hack Gamers' PCs
If you are a Counter-Strike gamer, then beware, because 39% of all existing Counter-Strike 1.6 game servers available online are malicious that have been set-up to remotely hack gamers' computers. A team of cybersecurity researchers at Dr. Web has disclosed that an attacker has been using malicio...
Zero-Day Flaws in Counter-Strike 1.6 Let Malicious Servers Hack Gamers' PCs
If you are a Counter-Strike gamer, then beware, because 39% of all existing Counter-Strike 1.6 game servers available online are malicious that have been set-up to remotely hack gamers' computers. A team of cybersecurity researchers at Dr. Web has disclosed that an attacker has been using malicio...
MS-ISAC Releases Security Primer on TrickBot Malware
The Multi-State Information Sharing and Analysis Center MS-ISAC has released a security primer on TrickBot malware. TrickBot is a modular banking Trojan that targets users’ financial information and acts as a dropper for other malware. An attacker can leverage TrickBot’s modules to steal banking...
CVE-2019-5921
Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...
Design/Logic Flaw
Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...
CVE-2019-5921
CVE-2019-5921 affects Windows 7 and describes an untrusted search path vulnerability where a Trojan horse DLL could be loaded from the application directory, enabling arbitrary code execution when a program loads a DLL from the same directory. Root cause: DLL planting in the application directory...
