Tag: microsoft
-
Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks
A new phishing campaign has been observed employing tax-themed lures to deliver a stealthy backdoor payload as part of attacks targeting Pakistan.Cybersecurity company Securonix, which is tracking the activity under the name FLUX#CONSOLE, said it likely starts with a phishing email link or attachment, although it said it couldn’t obtain the original email used to…
-
Does Desktop AI Come With a Side of Risk?
Artificial intelligence capabilities are coming to a desktop near you, with Microsoft 365 Copilot, Google Gemini with Project Jarvis, and Apple Intelligence all arriving (or having arrived). But what are the risks? First seen on darkreading.com Jump to article: www.darkreading.com/application-security/does-desktop-ai-risk
-
Cyber Criminals Exploit Windows Management Console to Deliver Backdoor Payloads
A recent campaign dubbed FLUX#CONSOLE has come to light, leveraging Microsoft Common Console Document (.MSC) files to infiltrate systems with backdoor malware. The campaign showcases the growing sophistication of phishing techniques and the exploitation of lesser-known Windows features. The FLUX#CONSOLE Campaign The FLUX#CONSOLE campaign has been identified as a multi-stage attack with sinister objectives. By using MSC files, threat actors…
-
U.S. CISA adds Microsoft Windows Kernel-Mode Driver and Adobe ColdFusion flaws to its Known Exploited Vulnerabilities catalog
Tags: access, adobe, cisa, control, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Kernel-Mode Driver and Adobe ColdFusion flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference (CVE-2024-35250) and Adobe ColdFusion Improper Access Control (CVE-2024-20767) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The…
-
Detection Engineer’s Guide to Powershell Remoting
Tags: access, attack, automation, computer, control, credentials, crowdstrike, cyberattack, data, detection, edr, endpoint, exploit, firewall, guide, hacker, malicious, microsoft, mitre, monitoring, network, penetration-testing, powershell, risk, service, siem, threat, tool, update, windowsPowershell Remoting is a powerful feature in Windows that enables IT administrators to remotely execute commands, manage configurations, and automate tasks across multiple systems in a network. Utilizing Windows Remote Management (WinRM), it facilitates efficient management by allowing centralized control over endpoints, making it an essential tool for system administrators to streamline operations and maintain…
-
Voice Phishing on Microsoft Teams Facilitates DarkGate Malware Attack
Trend Micro has revealed a new vector for cyberattacks: voice phishing (vishing) conducted via Microsoft Teams. This tactic was recently employed to distribute DarkGate malware, a sophisticated threat capable of... First seen on securityonline.info Jump to article: securityonline.info/voice-phishing-on-microsoft-teams-facilitates-darkgate-malware-attack/
-
Misconfiguration Manager: Detection Updates
TL;DR: The Misconfiguration Manager DETECT section has been updated with relevant guidance to help defensive operators identify the most prolific attack techniques from the Misconfiguration Manager project. Background If you have been following SpecterOps’s offensive security research over the last few years, you may have noticed our interest in targeting attack paths leveraging Microsoft’s Configuration Manager…
-
Microsoft Teams Vishing Spreads DarkGate RAT
A thwarted attack demonstrates that threat actors using yet another delivery method for the malware, which already has been spread using phishing emails, malvertising, hijacking of instant messages, and SEO poisoning. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/vishing-via-microsoft-teams-spreads-darkgate-rat
-
Microsoft Update-Katalog: Kritische Lücke in Microsofts Webserver entdeckt
Angreifer konnten sich auf einem Webserver von Microsoft erweiterte Rechte verschaffen. Trotz versprochener Transparenz nennt der Konzern keine Details. First seen on golem.de Jump to article: www.golem.de/news/microsoft-update-katalog-kritische-luecke-in-microsofts-webserver-entdeckt-2412-191742.html
-
Cloud Access Security Broker ein Kaufratgeber
Tags: access, ai, api, authentication, cisco, cloud, compliance, control, cyberattack, data, detection, endpoint, exploit, gartner, governance, intelligence, mail, malware, microsoft, monitoring, network, phishing, ransomware, risk, saas, service, software, startup, threat, tool, zero-day, zero-trust -
Russian APT >>Secret Blizzard<< Leverages Cybercriminal Tools in Ukraine Attacks
A new report from Microsoft Threat Intelligence reveals that the Russian state-sponsored threat actor known as Secret Blizzard (also tracked as Turla, Waterbug, Venomous Bear, Snake, Turla Team, and Turla... First seen on securityonline.info Jump to article: securityonline.info/russian-apt-secret-blizzard-leverages-cybercriminal-tools-in-ukraine-attacks/
-
Week in review: Microsoft fixes exploited 0-day, top cybersecurity books for your holiday gift list
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft fixes exploited zero-day (CVE-2024-49138) On December 2024 Patch … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/12/15/week-in-review-microsoft-fixes-exploited-0-day-top-cybersecurity-books-for-your-holiday-gift-list/
-
>>Password Era is Ending,<< Microsoft to Delete 1 Billion Passwords
Microsoft has announced that it is currently blocking an astounding 7,000 password attacks every second, nearly double the rate from just a year ago. This surge in cyber threats underscores the urgent need for more robust authentication methods, with passkeys emerging as a promising solution. The tech giant has also reported a 146% year-over-year increase…
-
Password Era is Ending Microsoft to Delete 1 Billion Passwords
Microsoft has announced that it is currently blocking an astounding 7,000 password attacks every second, nearly double the rate from just a year ago. This surge in cyber threats underscores the urgent need for more robust authentication methods, with passkeys emerging as a promising solution. The tech giant has also reported a 146% year-over-year increase…
-
Microsoft’s AI Recall Tool Is Still Sucking Up Credit Card and Social Security Numbers
Plus: The US indicts North Koreans in fake IT worker scheme, file-sharing firm Cleo warns customers to patch a vulnerability amid live attacks, and more. First seen on wired.com Jump to article: www.wired.com/story/microsoft-recall-credit-card-social-security-numbers/
-
MFA-Schutz von Microsofts Azure war aushebelbar
Angreifer konnten die Multi-Faktor-Authentifizierung in Microsofts Azure umgehen und unberechtigten Zugriff erlangen. First seen on heise.de Jump to article: www.heise.de/news/Microsoft-Azure-MFA-Schutz-war-aushebelbar-10198961.html
-
2024 Sees Sharp Increase in Microsoft Tool Exploits
Sophos found observed a significant rise in Microsoft LOLbins abused by attackers in H1 2024 compared to 2023 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/increase-microsoft-tool-exploits/
-
Microsoft Azure MFA-Schutz war aushebelbar
Angreifer konnten die Multi-Faktor-Authentifizierung in Microsofts Azure umgehen und unberechtigten Zugriff erlangen. First seen on heise.de Jump to article: www.heise.de/news/Microsoft-Azure-MFA-Schutz-war-aushebelbar-10198961.html
-
In Other News: Gen Digital Makes $1B Buy, Recall Captures Sensitive Data, MITRE ATTCK Evaluations
Noteworthy stories that might have slipped under the radar: AV brand owner Gen Digital makes a $1 billion acquisition, Microsoft Recall captures sensitive data, MITRE releases ATTCK evaluations. The post In Other News: Gen Digital Makes $1B Buy, Recall Captures Sensitive Data, MITRE ATTCK Evaluations appeared first on SecurityWeek. First seen on securityweek.com Jump to…
-
Microsoft Patches Vulnerabilities in Windows Defender, Update Catalog
Microsoft has patched potentially critical vulnerabilities in Update Catalog and Windows Defender on the server side. The post Microsoft Patches Vulnerabilities in Windows Defender, Update Catalog appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/microsoft-patches-vulnerabilities-in-windows-defender-update-catalog/
-
Thales and Imperva Win Big in 2024
Tags: access, api, application-security, attack, authentication, banking, business, ciso, cloud, communications, compliance, conference, control, cyber, cybersecurity, data, ddos, defense, encryption, firewall, gartner, group, guide, iam, identity, infosec, insurance, intelligence, malicious, mfa, microsoft, monitoring, privacy, risk, saas, service, software, strategy, threat, usaThales and Imperva Win Big in 2024 madhav Fri, 12/13/2024 – 09:36 At Thales and Imperva, we are driven by our commitment to make the world safer, and nothing brings us more satisfaction than protecting our customers from daily cybersecurity threats. But that doesn’t mean we don’t appreciate winning the occasional award. In the year…
-
Amazon pausiert Microsoft 365-Rollout wegen Sicherheitsbedenken nach Hack
Tags: microsoftIm Jahr 2023 musste Microsoft ja Hacks seiner Exchange Online- und Azure-Dienste eingestehen. Bloomberg berichtet nun, dass Amazon seine Pläne zum Rollout von Microsoft 365 im Unternehmen pausiert habe. Grund seien Sicherheitsbedenken nach dem Hack der mutmaßlich russischen Gruppe Midnight … First seen on borncity.com Jump to article: www.borncity.com/blog/2024/12/13/amazon-pausiert-microsoft-365-rollout-wegen-sicherheitsbedenken-nach-hack/
-
Microsofts verbessertes Recall zeichnet weiterhin sensitive Infos auf
Wegen gravierender Mängel bezüglich der Sicherheit wurde Recall im Sommer 2024 durch Microsoft zurückgezogen. Nun ist Microsoft gerade dabei, seine über Monate überarbeitete “und wirklich abgesicherte” Version von Recall erneut an Windows Insider auszurollen. Was kann schon schief gehen? Tester … First seen on borncity.com Jump to article: www.borncity.com/blog/2024/12/13/windows-microsofts-verbessertes-recall-zeichnet-weiterhin-sensitive-infos-auf/
-
Russia Used Borrowed Spyware to Target Ukrainian Troops
Secret Blizzard Used Third-party Amadey Bots to Hack Ukrainian Military Devices. A Russian state-backed hacker group used third-party data-stealing bots and possibly a backdoor used by another Russia-based threat group to infiltrate and spy on devices used by frontline Ukrainian military units, according to a report from the Microsoft threat intelligence team. First seen on…
-
Default NTLM relay attack protections introduced by Microsoft
First seen on scworld.com Jump to article: www.scworld.com/brief/default-ntlm-relay-attack-protections-introduced-by-microsoft
-
Critical ‘AuthQuake’ bug let attackers bypass Microsoft MFA
First seen on scworld.com Jump to article: www.scworld.com/news/critical-authquake-bug-lets-attackers-bypass-microsoft-mfa
-
Microsoft Windows ‘Best Fit’ character conversion ‘ripe for exploitation’
Tags: api, application-security, attack, cve, exploit, flaw, injection, malicious, microsoft, mitigation, office, programming, software, switch, technology, tool, vulnerability, windowsSecurity researchers have outlined a novel attack vector that exploits the “Best Fit” character conversion technology built into Windows.The technology comes into play in string conversions, particularly when characters cannot be directly represented in a target character set.However, application security experts Orange Tsai and Splitline Huang from Taiwanese firm DEVCORE used a presentation at Black…