Tag: windows
-
New Windows zero-day feared abused in widespread espionage for years
.The zero-day vulnerability, tracked as ZDI-CAN-25373, has yet to be publicly acknowledged and assigned a CVE-ID by Microsoft. ZDI-CAN-25373 has to do with the way Windows displays the contents of .lnk files, a type of binary file used by Windows to act as a shortcut to a file, folder, or application, through the Windows UI.A…
-
China, Russia, North Korea Hackers Exploit Windows Security Flaw
Tags: attack, china, exploit, flaw, government, group, hacker, infrastructure, korea, microsoft, north-korea, russia, threat, update, windowsAmost a dozen state-sponsored threat groups from Russia, China, and North Korea have been exploiting a security flaw in WIndows in attacks on governments and critical infrastructure that date back to 2017. According to Trend Micro’s VDI unit, Microsoft has no plans to patch the vulnerability. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/china-russia-north-korea-hackers-exploit-windows-security-flaw/
-
Hacker nutzen alte Windows-Sicherheitslücke aus Microsoft tut nichts
Tags: bug, bug-bounty, china, cyberattack, exploit, germany, hacker, iran, microsoft, military, north-korea, update, vulnerability, windowsExperten des Sicherheits-Unternehmens Trend Micro haben eine als ZDI-CAN-25373 bezeichnete Sicherheitslücke in Windows entdeckt, die Angreifer seit mindestens 2017 ausnutzen. Über die Lücke können die Angreifer Schadcode auf den betroffenen Windows-Rechnern ausführen, sofern der Benutzer eine verseuchte Webseite besucht oder eine infizierte Datei öffnet.Die Lücke steckt in der Vorgehensweise, wie Windows .lnk-Dateien (Verknüpfungsdateien) verarbeitet. Angreifer können Kommandozeilen-Befehle, die…
-
Nation-State Groups Abuse Microsoft Windows Shortcut Exploit
Trend Micro uncovered a method that nation-state threat actors are using to target victims via the Windows .Ink shortcut file extension. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/nation-state-groups-abuse-microsoft-windows-shortcut-exploit
-
11 Nation-State Hackers Exploit Unpatched Windows Flaw Since 2017
Microsoft refuses to patch serious Windows shortcut vulnerability abused in global espionage campaigns! First seen on hackread.com Jump to article: hackread.com/nation-state-hackers-exploit-windows-unpatched-flaw-2017/
-
Windows File Explorer Vulnerability Enables Network Spoofing Attacks: PoC Released
A critical vulnerability in Windows File Explorer has been discovered, allowing attackers to capture NTLM hashes and potentially exploit them for network spoofing attacks. The vulnerability, identified as CVE-2025-24071, involves the automatic processing of specially crafted .library-ms files within compressed archives like RAR or ZIP. When these files, containing paths to attacker-controlled SMB servers, are extracted, Windows…
-
Poisoned Windows shortcuts found to be a favorite of Chinese, Russian, N. Korean state hackers
The Zero Day Initiative measured the prevalence of manipulated Windows shortcut files in campaigns attributed to nation-state hacking groups, finding at least 11 exploited a bug that allows malicious use of the files. First seen on therecord.media Jump to article: therecord.media/windows-lnk-files-nation-state-hacking-campaigns
-
Nation-state actors and cybercrime gangs abuse malicious .lnk files for espionage and data theft
11 state-sponsored APTs exploit malicious .lnk files for espionage and data theft, with ZDI uncovering 1,000 such files used in attacks. At least 11 state-sponsored threat groups have been abusing Windows shortcut files for espionage and data theft, according to an analysis by Trend Micro’s Zero Day Initiative (ZDI). Trend ZDI researchers discovered 1,000 malicious…
-
New Windows zero-day exploited by 11 state hacking groups since 2017
At least 11 state-backed hacking groups from North Korea, Iran, Russia, and China have been exploiting a new Windows vulnerability in data theft and cyber espionage zero-day attacks since 2017. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-windows-zero-day-exploited-by-11-state-hacking-groups-since-2017/
-
Unpatched Windows Zero-Day Flaw Exploited by 11 State-Sponsored Threat Groups Since 2017
An unpatched security flaw impacting Microsoft Windows has been exploited by 11 state-sponsored groups from China, Iran, North Korea, and Russia as part of data theft, espionage, and financially motivated campaigns that date back to 2017.The zero-day vulnerability, tracked by Trend Micro’s Zero Day Initiative (ZDI) as ZDI-CAN-25373, refers to an issue that allows bad…
-
Stealthy StilachiRAT steals data, may enable lateral movement
While still not widely distributed, a new Windows remote access trojan (RAT) dubbed StilachiRAT is a serious threat. >>[The malware] demonstrates sophisticated techniques … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/18/stealthy-stilachirat-steals-data-may-enable-lateral-movement/
-
WDAC und Driver Blocklist scheitern; MS will Video von Will Dormann
Brass zwischen Sicherheitsforscher Will Dormann und Microsoft? Dormann hatte die Tage einen Post auf Mastodon veröffentlicht, dass die Microsoft Vulnerable Driver Blocklist und WDAC auf drei unterschiedliche Arten scheitern, Windows zu schützen. Und als er ein Problem an Microsoft melden … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/03/17/windows-wdac-und-driver-blocklist-scheitern-ms-will-video-von-will-dormann/
-
March Windows updates mistakenly uninstall Copilot
Microsoft says the March 2025 Windows cumulative updates automatically and mistakenly remove the AI-powered Copilot digital assistant from some Windows 10 and Windows 11 systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-march-windows-updates-mistakenly-uninstall-copilot/
-
Windows 10 und 11: Microsoft löscht versehentlich Copilot-App per Update
Einige werden sie vermissen, anderen wird sie kaum fehlen: Die Copilot-App ist auf manchen Windows-Systemen verschwunden. Schuld sind die März-Updates. First seen on golem.de Jump to article: www.golem.de/news/windows-10-und-11-microsoft-loescht-versehentlich-copilot-app-per-update-2503-194356.html
-
Motherboard Mishaps Undermine Trust, Security
MSI and Microsoft warn about new Windows Preview blue screens on some motherboards, the latest mishap to raise questions over the reliability of hardware and firmware. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/motherboard-mishaps-undermine-trust-security
-
Report on ransomware attacks on Fortinet firewalls also reveals possible defenses
Tags: access, attack, authentication, automation, backdoor, backup, ciso, control, credentials, cve, cybercrime, data, data-breach, defense, exploit, firewall, fortinet, group, infrastructure, Internet, lockbit, malicious, monitoring, network, password, radius, ransom, ransomware, risk, router, tactics, threat, tool, update, vpn, vulnerability, windowsSigns of intrusion: “This actor exhibits a distinct operational signature that blends elements of opportunistic attacks with ties to the LockBit ecosystem,” Forescout said in its analysis.”Mora_001’s relationship to the broader Lockbit’s ransomware operations underscores the increased complexity of the modern ransomware landscape where specialized teams collaborate to leverage complementary capabilities.”CISOs should note these consistent…
-
Printers start speaking in tongues after Windows 11 update
Who still uses a printer anyway? Oh … quite a lot of you, it seems First seen on theregister.com Jump to article: www.theregister.com/2025/03/12/printer_bug_windows_11/
-
Hackers Exploiting Exposed Jupyter Notebooks to Deploy Cryptominers
Cado Security Labs has identified a sophisticated cryptomining campaign exploiting misconfigured Jupyter Notebooks, targeting both Windows and Linux systems. The attack utilizes multiple stages of obfuscation, including encrypted payloads and COM object manipulation, to ultimately deploy miners for various cryptocurrencies including Monero, Ravencoin, and several others. This previously unreported exploitation method demonstrates how threat actors…
-
Microsoft Windows: Kritische Sicherheitslücke entdeckt
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/microsoft-windows-kritische-sicherheitsluecke-2025
-
Winring0: Windows stuft beliebte Tools plötzlich als Bedrohung ein
Betroffen sind Steuerungs- und Monitoring-Tools wie Fan Control, MSI Afterburner und Open Hardware Monitor. Die Entwickler stehen vor einem Problem. First seen on golem.de Jump to article: www.golem.de/news/winring0-windows-stuft-beliebte-tools-ploetzlich-als-bedrohung-ein-2503-194314.html
-
The most notorious and damaging ransomware of all time
Tags: access, android, attack, backdoor, backup, banking, botnet, breach, communications, computer, control, credentials, cryptography, cyber, cybercrime, dark-web, data, defense, detection, email, encryption, endpoint, exploit, extortion, finance, flaw, framework, germany, google, government, group, hacker, hacking, healthcare, infection, infrastructure, international, jobs, korea, law, lazarus, leak, linux, malicious, malware, microsoft, mobile, msp, network, north-korea, office, open-source, oracle, password, phishing, phone, powershell, ransom, ransomware, russia, service, software, spam, switch, technology, threat, tool, ukraine, update, usa, virus, vulnerability, windowsConti: History: First appearing in May 2020, the Conti RaaS platform is considered the successor to the Ryuk ransomware. As of January 2021, Conti is believed to have infected over 150 organizations and earned millions of dollars for its criminal developers and their affiliates. At least three new versions have been found since its inception.How it works: Conti uses the…
-
Free95 claims to be a GPL 3 Windows clone, but it’s giving vaporware vibes
Tags: windowsDon’t, don’t, DON’T believe the hype First seen on theregister.com Jump to article: www.theregister.com/2025/03/12/is_free95_real/
-
KB5053598: Windows-11-Update verärgert wieder einmal Nutzer
Das jüngste Update für Windows 11 24H2 macht erneut Probleme. Nutzer beklagen Installationsfehler, Bluescreens und RDP-Verbindungsabbrüche. First seen on golem.de Jump to article: www.golem.de/news/kb5053598-windows-11-update-veraergert-wieder-einmal-nutzer-2503-194293.html
-
Lazarus Breaches IIS: Web Shells Evolving C2 Tactics Unveiled
The notorious North Korean threat actor Lazarus Group has been identified breaching Windows web servers to establish command-and-control First seen on securityonline.info Jump to article: securityonline.info/lazarus-breaches-iis-web-shells-evolving-c2-tactics-unveiled/
-
Windows Notepad to get AI text summarization in Windows 11
Microsoft is now testing an AI-powered text summarization feature in Notepad and a Snipping Tool “Draw & Hold” feature that helps draw perfect shapes. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-notepad-to-get-ai-text-summarization-in-windows-11/
-
Breaking the Barriers to a Password-Free Life in Enterprise: Meet SafeNet eToken Fusion NFC PIV security key
Tags: access, authentication, cloud, compliance, control, credentials, data, defense, encryption, fido, framework, government, healthcare, identity, infrastructure, mobile, nfc, password, phishing, regulation, service, software, strategy, technology, windowsBreaking the Barriers to a Password-Free Life in Enterprise: Meet SafeNet eToken Fusion NFC PIV security key madhav Thu, 03/13/2025 – 06:46 As large organizations increasingly shift towards passwordless solutions, the benefits are clear: enhanced user experience, improved security, and significant cost savings. The FIDO (Fast Identity Online) standard has emerged as the gold standard…