Tag: windows
-
BSI empfiehlt Abschied von Windows 10
Windows 10 vor dem Aus: Microsoft beendet am 14. Oktober 2025 den Support für das beliebte Betriebssystem. Ab diesem Zeitpunkt gibt es keine kostenlosen Sicherheitsupdates mehr ein offenes Tor für Cyberangriffe. Das Bundesamt für Sicherheit in der Informationstechnik (BSI) warnt und rät dringend zum Umstieg. First seen on itsicherheit-online.com Jump to article: www.itsicherheit-online.com/news/security-management/bsi-empfiehlt-abschied-von-windows-10/
-
CVE-2025-24054 Under Active Attack”, Steals NTLM Credentials on File Download
Tags: credentials, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, ntlm, technology, vulnerability, windowsThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a medium-severity security flaw impacting Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.The vulnerability, assigned the CVE identifier CVE-2025-24054 (CVSS score: 6.5), is a Windows New Technology LAN Manager (NTLM) hash disclosure First seen on…
-
Windows NTLM hash leak flaw exploited in phishing attacks on governments
A Windows vulnerability that exposes NTLM hashes using .library-ms files is now actively exploited by hackers in phishing campaigns targeting government entities and private companies. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/windows-ntlm-hash-leak-flaw-exploited-in-phishing-attacks-on-governments/
-
AWS claims 50% of Azure workloads would jump ship if licensing costs allowed
Bezos’ biz and Google tell regulator higher cost of running Windows Server in their clouds isn’t fair First seen on theregister.com Jump to article: www.theregister.com/2025/04/16/aws_microsoft_license_harms/
-
LummaStealer Exploits Windows Utility to Run Remote Code Disguised as .mp4 File
The Cybereason Global Security Operations Center (GSOC) has shed light on the sophisticated tactics used by the LummaStealer malware to evade detection and execute malicious code. Originally spotted in 2022, this Russian-developed malware-as-a-service (MaaS) has continuously evolved its evasion techniques to target Windows systems. Advanced Evasion with mshta.exe LummaStealer’s operators have introduced a new technique…
-
Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054)
CVE-2025-24054, a Windows NTLM hash disclosure vulnerability that Microsoft has issued patches for last month, has been leveraged by threat actors in campaigns targeting … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/17/windows-ntlm-vulnerability-exploited-in-multiple-attack-campaigns-cve-2025-24054/
-
New Windows Server emergency updates fix container launch issue
Microsoft has released emergency Windows Server updates to address a known issue preventing Windows containers from launching. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/new-windows-server-emergency-updates-fix-container-launch-issue/
-
Code-Panne bei Microsoft: Windows-11-Upgrade trotz Blockade verteilt
Microsoft Intune hat aufgrund eines Fehlers einige Upgrade-Blockaden ignoriert, so dass Systeme unerwartet auf Windows 11 aktualisiert wurden. First seen on golem.de Jump to article: www.golem.de/news/code-panne-bei-microsoft-windows-11-upgrade-trotz-blockade-verteilt-2504-195445.html
-
Microsoft bestätigt: Neue Windows-11-Updates lösen Bluescreens aus
Wer unter Windows 11 nach den jüngsten Updates mit Bluescreens konfrontiert wird, ist damit nicht allein. Auch Microsoft hat das Problem nun erkannt. First seen on golem.de Jump to article: www.golem.de/news/microsoft-bestaetigt-neue-windows-11-updates-loesen-bluescreens-aus-2504-195440.html
-
New Windows Task Scheduler Bugs Let Attackers Bypass UAC and Tamper with Logs
Cybersecurity researchers have detailed four different vulnerabilities in a core component of the Windows task scheduling service that could be exploited by local attackers to achieve privilege escalation and erase logs to cover up evidence of malicious activities.The issues have been uncovered in a binary named “schtasks.exe,” which enables an administrator to create, delete, query,…
-
Multiple Groups Exploit NTLM Flaw in Microsoft Windows
The attacks have been going on since shortly after Microsoft patched the vulnerability in March. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/multiple-group-exploiting-ntlm-flaw
-
Free Blue Screens of Death for Windows 11 24H2 users
Microsoft rewards those who patch early with bricks hurled through its operating system First seen on theregister.com Jump to article: www.theregister.com/2025/04/16/microsofts_latest_windows_updates/
-
China-Linked Hackers Lay Brickstorm Backdoors on Euro Networks
Researchers discovered new variants of the malware, which is tied to a China-nexus threat group, targeting Windows environments of critical infrastructure networks in Europe. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/china-linked-hackers-brickstorm-backdoors-european-networks
-
Windows Task Scheduler Vulnerabilities Allow Attackers Gain Admin Account Control
New vulnerabilities in Windows Task Scheduler’s schtasks.exe let attackers bypass UAC, alter metadata, modify event logs, and evade detection. These actions map to MITRE ATT&CK tactics: Persistence, Privilege Escalation, Execution, Lateral Movement, and Defense Evasion. Abuse of schtasks.exe enables stealthy task creation and manipulation without alerting defenders, making it a reliable tool for maintaining access…
-
Windows NTLM Vulnerability (CVE-2025-24054) Actively Exploit in the Wild to Hack Systems
A critical vulnerability in Microsoft Windows, identified as CVE-2025-24054, has been actively exploited in the wild since March 19, 2025, targets organizations worldwide. The flaw, which enables NTLM hash disclosure through spoofing, allows attackers to harvest sensitive user credentials with minimal interaction, potentially leading to privilege escalation and full network compromise. Despite Microsoft releasing a…
-
Experts Uncover Four New Privilege Escalation Flaws in Windows Task Scheduler
Cybersecurity researchers have detailed four different vulnerabilities in a core component of the Windows task scheduling service that could be exploited by local attackers to achieve privilege escalation and erase logs to cover up evidence of malicious activities.The issues have been uncovered in a binary named “schtasks.exe,” which enables an administrator to create, delete, query,…
-
Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak – P2
This is Part 2 of our two-part technical analysis on Mustang Panda’s new tools. For details on ToneShell and StarProxy, go to Part 1.IntroductionIn addition to the new ToneShell variants and StarProxy, Zscaler ThreatLabz discovered two new keyloggers used by Mustang Panda that we have named PAKLOG and CorKLOG as well as an EDR evasion…
-
Latest Mustang Panda Arsenal: ToneShell and StarProxy – P1
IntroductionThe Zscaler ThreatLabz team discovered new activity associated with Mustang Panda, originating from two machines from a targeted organization in Myanmar. This research led to the discovery of new ToneShell variants and several previously undocumented tools. Mustang Panda, a China-sponsored espionage group, traditionally targets government-related entities, military entities, minority groups, and non-governmental organizations (NGOs) primarily…
-
China-Backed Hackers Exploit BRICKSTORM Backdoor to Spy on European Businesses
NVISO discovered new variants of the BRICKSTORM backdoor, initially designed for Linux, on Windows systems First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/china-hackers-brickstorm-backdoor/
-
Microsoft warns of blue screen crashes caused by April updates
Microsoft warned customers this week that their systems might crash with a blue screen error caused by a secure kernel fatal error after installing Windows updates released since March. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-blue-screen-crashes-caused-by-april-updates/
-
Some devices offered Windows 11 upgrades despite Intune blocks
Microsoft is working to fix an ongoing issue causing some users’ Windows devices to be offered Windows 11 upgrades despite Intune policies preventing them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-some-devices-offered-windows-11-upgrades-despite-intune-blocks/
-
Support-Aus von Windows-10: Darum empfiehlt das BSI schon jetzt den Umstieg auf ein anderes System
First seen on t3n.de Jump to article: t3n.de/news/bsi-warnt-windows-10-nutzer-darum-schon-jetzt-anderes-betriebssystem-umsteigen-1682949/
-
Chinese Hackers Unleash New BRICKSTORM Malware to Target Windows and Linux Systems
A sophisticated cyber espionage campaign leveraging the newly identified BRICKSTORM malware variants has targeted European strategic industries since at least 2022. According to NVISO’s technical analysis, these backdoors previously confined to Linux vCenter servers now infect Windows environments, employing multi-tiered encryption, DNS-over-HTTPS (DoH) obfuscation, and cloud-based Command & Control (C2) infrastructure to evade detection. The…
-
Mysteriöser Ordner C:Virus; Trend Micro beteiligt?
Tags: windowsIch stelle mal eine sehr ungewöhnliche Beobachtung eines Administratoren unter den Blog-Lesern hier im Blog ein. Dieser stellt auf seinen Clients fest, dass “plötzlich” ein ominöser Ordner c:\virus auf dem Systemlaufwerk erzeugt wird. Noch ist die Ursache nicht nachgewiesen, aber … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/04/16/windows-mysterioeser-ordner-cvirus-trend-micro-beteiligt/
-
European Companies Infected With New Chinese-Nexus Backdoor
Threat Actors Deploy Obfuscation Tactics to Targets Windows Machines. Likely Chinese nation-state hackers are targeting European companies using previously unseen malware backdoor variants with advanced network tunneling and evasion capabilities for data theft. Brussels-based security firm Nviso links the campaign to a threat actor tracked as UNC5221. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/european-companies-infected-new-chinese-nexus-backdoor-a-28009
-
Microsoft blocks ActiveX by default in Microsoft 365, Office 2024
Microsoft announced it will begin disabling all ActiveX controls in Windows versions of Microsoft 365 and Office 2024 applications later this month. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-blocks-activex-by-default-in-microsoft-365-office-2024/
-
Microsoft warns of CPU spikes when typing in classic Outlook
Microsoft warned Windows users of increased CPU usage when typing while using recent versions of the classic Outlook email client. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-cpu-spikes-when-typing-in-classic-outlook/
-
Windows Server 2025: Domain-Controller sind nach Neustart nicht mehr erreichbar
Windows Server 2025 leidet offenbar unter einem Konnektivitätsproblem. Laut Microsoft wird bei Domain-Controllern das falsche Firewall-Profil geladen. First seen on golem.de Jump to article: www.golem.de/news/windows-server-2025-domain-controller-sind-nach-neustart-nicht-mehr-erreichbar-2504-195369.html
-
Hackers Use Microsoft Teams Chats to Deliver Malware to Windows PCs
A sophisticated cyberattack campaign has emerged, leveraging Microsoft Teams chats to infiltrate Windows PCs with malware, according to a recent report by cybersecurity firm ReliaQuest. The attack, which began surfacing in March 2025 and primarily targets the finance and professional services sectors, signals a dramatic evolution in tactics used by threat actors linked to the…