Tag: detection
-
CVE-2023-23397 Microsoft Outlook Privilege Elevation Critical Vulnerability
Written by Lina Jiménez Becerra, Anton Jörgensson and Mark Stueck of the Kudelski Security Threat Detection & Research Team CVE-2023-23397: Abili… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/03/15/cve-2023-23397-microsoft-outlook-privilege-elevation-critical-vulnerability/
-
3CX Supply Chain Attack ‘SmoothOperator’
Written by Anton Jörgensson, Eric Dodge & Yann Lehmann of the Kudelski Security Threat Detection & Research Team Updated on April 5th. We may … First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/03/30/3cx-supply-chain-attack-smoothoperator/
-
CVE-2023-27997 Pre-Authentication RCE on FortiGate SSL-VPN
Written by Harish Segar and Scott Emerson of the Kudelski Security Threat Detection & Research Team June 13th, update 2: Technical details of bug … First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/06/12/cve-2023-27997-fortigate-ssl-vpn/
-
CVE-2023-33308 Critical Remote Code Execution (RCE) on FortiOS/FortiProxy
Written by Eric Dodge and Harish Segar of the Kudelski Security Threat Detection & Research Team Summary Fortinet recently disclosed a critical bu… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/07/13/cve-2023-33308-critical-remote-code-execution-rce-on-fortios-fortiproxy/
-
CVE-2023-36884 Office and Windows HTML Remote Code Execution Vulnerability
Written by Yann Lehmann and Harish Segar of the Kudelski Security Threat Detection & Research Team Summary On July 11th, Microsoft disclosed a rem… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/07/14/cve-2023-36884-office-and-windows-html-remote-code-execution-vulnerability/
-
Citrix ADC/Gateway Triple Threat
Written by Eric Dodge and Harish Segar of the Kudelski Security Threat Detection & Research Team Summary Citrix recently released a handful of vul… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/07/18/citrix-adc-gateway-triple-threat/
-
F5 BIG-IP Unauthenticated RCE via HTTP Request Smuggling
Written by Scott Emerson of the Kudelski Security Threat Detection & Research Team Summary Researchers at Praetorian have discovered a request smu… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/10/27/f5-big-ip-unauthenticated-rce-via-http-request-smuggling/
-
VMware vCenter Server OutBounds Write Vulnerability (CVE-2023-34048)
Written by Yann Lehmann with the support of Scott Emerson of the Kudelski Security Threat Detection & Research Team Summary VMware has released se… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/10/25/vmware-vcenter-server-out-of-bounds-write-vulnerability-cve-2023-34048/
-
Image I/O WebP/libwebp Zero-Day Vulnerabilities
Google/Heap Buffer Overflow Vulnerability in WebP (CVE-2023-4863) Written by Michal Nowakowski of the Kudelski Security Threat Detection & Researc… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/09/29/image-i-o-webp-libwebp-zero-day-vulnerabilities/
-
CVE-2023-46604 Apache ActiveMQ RCE vulnerability
Written by Joshua Cartlidge of the Kudelski Security Threat Detection & Research Team Summary On October 25, 2023, Apache disclosed an ActiveMQ Re… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/11/03/cve-2023-46604-apache-activemq-rce-vulnerability/
-
Ivanti Connect Secure/Policy Secure CVE-2023-46805, CVE-2024-21887 Combine for Unauthenticated RCE, and following CVEs discovered over time
Written by the Kudelski Security Threat Detection & Research Team (updated on 2024.02.12 by Yann Lehmann) Summary Ivanti Connect Secure (ICS) and … First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2024/01/11/ivanti-connect-secure-policy-secure-cve-2023-46805-cve-2024-21887-combine-for-unauthenticated-rce/
-
Hackers abuse popular Godot game engine to infect thousands of PCs
Hackers have used new GodLoader malware exploiting the capabilities of the widely used Godot game engine to evade detection and infect over 17,000 systems in just three months. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-godloader-malware-infects-thousands-of-gamers-using-godot-scripts/
-
Five ways to set up early detection systems
Tags: detectionFirst seen on scworld.com Jump to article: www.scworld.com/perspective/five-ways-to-set-up-early-detection-systems
-
Lazarus Hackers Exploits macOS Extended Attributes To Evade Detection
The xattr command in Unix-like systems allows for the embedding of hidden metadata within files, similar to Windows ADS, known as Rustyattr, which is being exploited by threat actors like Lazarus Group to stealthily conceal malicious payloads within seemingly benign files. The Lazarus Group is covertly embedding malicious data within system files using xattr, a…
-
Latest Multi-Stage Attack Scenarios with Real-World Examples
Multi-stage cyber attacks, characterized by their complex execution chains, are designed to avoid detection and trick victims into a false sense of security. Knowing how they operate is the first step to building a solid defense strategy against them. Let’s examine real-world examples of some of the most common multi-stage attack scenarios that are active…
-
Exabeam partners with Wiz for cloud security, threat detection
First seen on scworld.com Jump to article: www.scworld.com/brief/exabeam-partners-with-wiz-for-cloud-security-threat-detection
-
Phishing attacks via ‘URL rewriting’ to evade detection escalate
First seen on scworld.com Jump to article: www.scworld.com/news/phishing-attacks-via-url-rewriting-to-evade-detection-escalate
-
Bedrohungen mit neuen KI-Funktionen in Sophos XDR noch schneller erkennen und abwehren
Bei der Erkennung und Neutralisierung von Bedrohungen kann für Sicherheitsexperten, darunter auch Managed-Service-Provider (MSP), jede Minute entscheidend sein. Um die Reaktionsfähigkeit und forensische Untersuchungen weiter zu optimieren, hat Sophos jetzt seine Extended-Detection-and-Response (XDR) -Plattform mit einer neuen künstlichen Intelligenz (KI) erweitert. Die neuen generativen KI-Funktionen beschleunigen und vereinfachen die Untersuchungen, womit selbst weniger erfahrene Analysten…
-
Aggressive Chinese APT Group Targets Governments with New Backdoors
A Trend Micro analysis of Earth Estries found that the Chinese threat actor is using new backdoors to avoid detection during espionage operations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-apt-governments-backdoors/
-
8com erlangt Spezialisierung von Palo Alto Networks Cortex eXtended Managed Detection and Response (XMDR)
Durch die Kombination der führenden Cortex XDR-Lösung von Palo Alto Networks mit den Managed Services von 8com, werden die Sicherheitsabläufe der Kunden gestärkt. First seen on 8com.de# Jump to article: www.8com.de#
-
Ursnif Trojan Campaign Targets U.S. Professionals via Stealthy Spam Attacks
The Ursnif banking Trojan, one of the most notorious forms of malware targeting financial data, has been observed in a sophisticated campaign using advanced techniques to avoid detection and steal sensitive information. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/ursnif-banking-trojan/
-
9 VPN alternatives for securing remote network access
Tags: access, ai, api, attack, authentication, automation, best-practice, business, cloud, compliance, computer, computing, control, corporate, credentials, cve, cybercrime, cybersecurity, data, defense, detection, dns, encryption, endpoint, exploit, firewall, fortinet, group, guide, Hardware, iam, identity, infrastructure, Internet, iot, least-privilege, login, malicious, malware, mfa, microsoft, monitoring, network, office, password, ransomware, risk, router, saas, service, software, strategy, switch, threat, tool, update, vpn, vulnerability, vulnerability-management, waf, zero-trustOnce the staple for securing employees working remotely, VPNs were designed to provide secure access to corporate data and systems for a small percentage of a workforce while the majority worked within traditional office confines. The move to mass remote working brought about by COVID-19 in early 2020 changed things dramatically. Since then, large numbers…
-
8com GmbH & Co. KG erlangt die Spezialisierung von Palo Alto Networks Cortex eXtended Managed Detection and Response (XMDR)
Durch die Kombination der führenden Cortex XDR-Lösung von Palo Alto Networks mit den Managed Services von 8com, werden die Sicherheitsabläufe der Kunden gestärkt. First seen on 8com.de Jump to article: www.8com.de/cyber-security-blog/8com-gmbh-co-kg-erlangt-die-spezialisierung-von-palo-alto-networks-cortex-extended-managed-detection-and-response-xmdr
-
CISA Details Red Team Assessment Including TTPs Network Defense
Tags: cisa, cyber, cyberattack, cybersecurity, defense, detection, infrastructure, network, RedTeam, tacticsThe Cybersecurity and Infrastructure Security Agency (CISA) recently detailed findings from a Red Team Assessment (RTA) conducted on a critical infrastructure organization in the United States. The assessment, carried out over three months, simulated real-world cyberattacks to evaluate the organization’s cybersecurity defenses, detection capabilities, and response readiness. This comprehensive analysis sheds light on the tactics,…
-
17 hottest IT security certs for higher pay today
Tags: access, ai, attack, automation, blockchain, business, ceo, cisa, ciso, cloud, communications, conference, container, control, credentials, cryptography, cyber, cybersecurity, data, defense, detection, encryption, exploit, finance, fortinet, google, governance, group, guide, hacker, incident response, infosec, infrastructure, intelligence, Internet, jobs, monitoring, network, penetration-testing, privacy, reverse-engineering, risk, risk-management, skills, software, technology, threat, tool, training, windowsWith the New Year on the horizon, many IT professionals may be looking to improve their careers in 2025 but need direction on the best way. The latest data from Foote Partners may provide helpful signposts.Analyzing more than 638 certifications as part of its 3Q 2024 “IT Skills Demand and Pay Trends Report,” Foote Partners…
-
Malware campaign abused flawed Avast Anti-Rootkit driver
Threat actors exploit an outdated Avast Anti-Rootkit driver to evade detection, disable security tools, and compromise the target systems. Trellix researchers uncovered a malware campaign that abused a vulnerable Avast Anti-Rootkit driver (aswArPot.sys) to gain deeper access to the target system, disable security solutions, and gain system control. This alarming tactic corrupts trusted kernel-mode drivers,…