Tag: microsoft
-
US Cybercom, CISA retreat in fight against Russian cyber threats: reports
Tags: apt, blizzard, china, cisa, cyber, cybersecurity, data, government, group, hacker, infrastructure, international, iran, lockbit, microsoft, ransomware, risk, risk-management, russia, threatPurported shift at CISA away from reporting on Russian threats: Shortly after The Record issued its report, The Guardian reported that the US Cybersecurity and Infrastructure Security Agency (CISA) sent an internal memo setting out new priorities for the agency, including China but excluding Russia. One source said analysts at the agency were verbally informed…
-
New ClickFix attack deploys Havoc C2 via Microsoft Sharepoint
A newly uncovered ClickFix phishing campaign is tricking victims into executing malicious PowerShell commands that deploy the Havok post-exploitation framework for remote access to compromised devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-clickfix-attack-deploys-havoc-c2-via-microsoft-sharepoint/
-
Microsoft-signed driver used in ransomware attacks
Threat actors are exploiting a privilege escalation flaw in Paragon Partition Manager for “bring your own vulnerable driver” (BYOVD) attacks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/microsoft-signed-driver-used-in-ransomware-attacks/741372/
-
Microsoft links recent Microsoft 365 outage to buggy update
Microsoft says a coding issue is behind a now-resolved Microsoft 365 outage over the weekend that affected Outlook and Exchange Online authentication. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-links-recent-microsoft-365-outage-to-buggy-update/
-
Hackers Use ClickFix Trick to Deploy PowerShell-Based Havoc C2 via SharePoint Sites
Tags: api, communications, control, cybersecurity, framework, hacker, malware, microsoft, open-source, phishing, powershell, threatCybersecurity researchers are calling attention to a new phishing campaign that employs the ClickFix technique to deliver an open-source command-and-control (C2) framework called Havoc.”The threat actor hides each malware stage behind a SharePoint site and uses a modified version of Havoc Demon in conjunction with the Microsoft Graph API to obscure C2 communications within trusted,…
-
Hackers Exploit Paragon Partition Manager Driver Vulnerability in Ransomware Attacks
Threat actors have been exploiting a security vulnerability in Paragon Partition Manager’s BioNTdrv.sys driver in ransomware attacks to escalate privileges and execute arbitrary code.The zero-day flaw (CVE-2025-0289) is part of a set of five vulnerabilities that was discovered by Microsoft, according to the CERT Coordination Center (CERT/CC).”These include arbitrary kernel memory mapping and First seen…
-
Phishing Campaign Uses Havoc Framework to Control Infected Systems
A new phishing campaign has been identified using Havoc to control infected systems, leveraging SharePoint and Microsoft Graph API First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/phishing-campaign-havoc-framework/
-
New Malware Campaign Exploits Microsoft Graph API to Infect Windows
FortiGuard Labs discovers an advanced attack using modified Havoc Demon and SharePoint. Explore the attack’s evasion techniques and security measures. First seen on hackread.com Jump to article: hackread.com/malware-exploits-microsoft-graph-api-infect-windows/
-
Quantum Wars: Google, Microsoft, and Amazon’s Competing Paths to Fault-Tolerant Qubits
Amazon claims its researchers have combined cat qubit technology and additional quantum error correction components onto a microchip that can be manufactured in a scalable fashion. The post Quantum Wars: Google, Microsoft, and Amazon’s Competing Paths to Fault-Tolerant Qubits appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/quantum-wars-google-microsoft-and-amazons-competing-paths-to-fault-tolerant-qubits/
-
Microsoft Busts Hackers Selling Illegal Azure AI Access
LLMjacking operation leveraged illicit access GenAI services to produce explicit celebrity images and other harmful content, Microsoft’s digital crimes unit says. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/microsoft-openai-hackers-selling-illicit-access-azure-llm-services
-
Microsoft unveils finalized EU Data Boundary as European doubt over US grows
Some may have second thoughts about going all-in with an American vendor, no matter where their data is stored First seen on theregister.com Jump to article: www.theregister.com/2025/03/03/microsoft_unveils_a_finalized_eu/
-
âš¡ THN Weekly Recap: Alerts on Zero-Day Exploits, AI Breaches, and Crypto Heists
This week, a 23-year-old Serbian activist found themselves at the crossroads of digital danger when a sneaky zero-day exploit turned their Android device into a target. Meanwhile, Microsoft pulled back the curtain on a scheme where cybercriminals used AI tools for harmful pranks, and a massive trove of live secrets was discovered, reminding us that…
-
Hackers Using PowerShell and Microsoft Legitimate Apps to Deploy Malware
Tags: antivirus, attack, cyber, cybersecurity, hacker, incident response, malware, microsoft, powershellCybersecurity experts are warning of an increasing trend in fileless attacks, where hackers leverage PowerShell and legitimate Microsoft applications to deploy malware without leaving significant traces on compromised systems. These sophisticated attacks, which have been around for over two decades, are proving particularly effective in bypassing traditional antivirus solutions and complicating incident response efforts. PowerShell…
-
Njrat Exploits Microsoft Dev Tunnels for C2 Communication
A new campaign involving the notorious remote access trojan (RAT) Njrat has been uncovered, leveraging Microsoft’s Dev Tunnels service for command-and-control (C2) communication. This service, intended to help developers securely expose local services to the internet for testing and debugging, is being exploited by attackers to establish covert connections with their C2 servers. The abuse…
-
PoC Released for Windows Hyper-V SYSTEM Privilege Exploit
Security researchers have publicly disclosed a proof-of-concept (PoC) exploit for CVE-2025-21333, a critical elevation-of-privilege vulnerability in Microsoft’s Hyper-V virtualization framework. The vulnerability resides in thevkrnlintvsp.sysdriver and enables local attackers to gainSYSTEM privilegesthrough a sophisticated heap manipulation technique. Microsoft rated this flaw asImportant (7.8 CVSSv3)in its January 2025 advisory. Vulnerability Overview According to a GitHub report, the…
-
Die besten XDR-Tools
Tags: attack, business, cloud, computing, container, crowdstrike, cyberattack, detection, edr, endpoint, firewall, google, Hardware, ibm, identity, incident response, infrastructure, mail, malware, marketplace, microsoft, ml, network, office, okta, risk, security-incident, service, siem, soar, software, tool, vulnerabilityLesen Sie, worauf Sie in Sachen XDR achten sollten und welche Lösungen sich in diesem Bereich empfehlen.Manuelles, siloartiges Management ist in der modernen IT-Welt unangebracht. Erst recht im Bereich der IT-Sicherheit: Der Umfang von modernem Enterprise Computing und State-of-the-Art-Application-Stack-Architekturen erfordern Sicherheits-Tools, die:Einblicke in den Sicherheitsstatus von IT-Komponenten ermöglichen,Bedrohungen in Echtzeit erkennen, undAspekte der Bedrohungsabwehr automatisieren.Diese…
-
Security Affairs newsletter Round 513 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Ransomware gangs exploit a Paragon Partition Manager BioNTdrv.sys driver zero-day Microsoft disrupted a global cybercrime ring abusing Azure…
-
Week in review: Botnet hits M365 accounts, PoC for Ivanti Endpoint Manager vulnerabilities released
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Massive botnet hits Microsoft 365 accounts A recently discovered botnet of … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/02/week-in-review-botnet-hits-m365-accounts-poc-for-ivanti-endpoint-manager-vulnerabilities-released/
-
Microsoft Office 365 MFA-Schlenker …
Nette Geschichte, die ein Administrator die Tage auf Facebook aufgespießt hat. Es geht um die Multifaktor-Authentifizierung in Microsoft 365, die unter anderem mittels der Microsoft Authenticator App erfolgen kann. Da bauen sich aber Hürden auf, wenn man möglichst wenig Abhängigkeiten … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/03/02/microsoft-office-365-mfa-schlenker/
-
Ransomware gangs exploit a Paragon Partition Manager BioNTdrv.sys driver zero-day
Microsoft warns of a Paragon Partition Manager BioNTdrv.sys driver zero-day flaw actively exploited by ransomware gangs in attacks. Microsoft discovered five vulnerabilities in the Paragon Partition Manager BioNTdrv.sys driver. The IT giant reported that one of these flaws is exploited by ransomware groups in zero-day attacks. Paragon Partition Manager, available in Community and Commercial versions, manages hard drive…
-
Ransomware gangs exploit Paragon Partition Manager bug in BYOVD attacks
Microsoft had discovered five Paragon Partition Manager BioNTdrv.sys driver flaws, with one used by ransomware gangs in zero-day attacks to gain SYSTEM privileges in Windows. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/
-
Claroty, Nozomi, Armis Top Cyber-Physical Security Rankings
Gartner MQ for Cyber-Physical Security Details Pros, Cons of Pure-Play Approach. Pure-play OT specialists Claroty, Nozomi and Dragos were joined by asset management expert Armis and behemoth Microsoft atop Gartner’s first-ever ranking of cyber-physical systems vendors. Historically, a wide range of vendors were grouped together under the broad umbrella of OT security. First seen on…
-
Phishing-Alarm: ADAC, DocuSign, Angriffe auf Paypal und Microsoft 365-Konten
Die Tage sind mir wieder eine Reihe Phishing-Mails oder Meldungen zu Phishing untergekommen. So wird mein Postfach von DocuSign-Phishing-Mails von Amazons E-Mail-Dienst geflutet, weil 1&1 das im SPAM-Filter nicht erkennt. Auch eine ADAC-SPAM-Nachricht kam durch. Weiterhin sollten Paypal- und Microsoft … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/03/01/phishing-alarm-amazon-docusign-paypal-und-co/
-
Microsoft continues cracks down on global generative AI cybercrime network
First seen on scworld.com Jump to article: www.scworld.com/brief/microsoft-continues-cracks-down-on-global-generative-ai-cybercrime-network
-
Microsoft Continues Crackdown On Global GenAI Cybercrime Network
First seen on scworld.com Jump to article: www.scworld.com/brief/microsoft-continues-crackdown-on-global-genai-cybercrime-network
-
Microsoft Disrupts Storm-2139 for LLMjacking and Azure AI Exploitation
Microsoft exposes Storm-2139, a cybercrime network exploiting Azure AI via LLMjacking. Learn how stolen API keys enabled harmful… First seen on hackread.com Jump to article: hackread.com/microsoft-storm-2139-llmjacking-azure-ai-exploitation/
-
Microsoft targets AI deepfake cybercrime network in lawsuit
Microsoft alleges that defendants used stolen Azure OpenAI API keys and special software to bypass content guardrails and generate illicit AI deepfakes for payment. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366619781/Microsoft-targets-AI-deepfake-cybercrime-network-in-lawsuit
-
Microsoft files lawsuit against LLMjacking gang that bypassed AI safeguards
LLMjacking can cost organizations a lot of money: LLMjacking is a continuation of the cybercriminal practice of abusing stolen cloud account credentials for various illegal operations, such as cryptojacking, abusing hacked cloud computing resources to mine cryptocurrency. The difference is that large quantities of API calls to LLMs can quickly rack up huge costs, with…