BleepingComputer.com

"New Windows Driver Signatures Bypass allows kernel root kit installs."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 26 October 2024, 2140 UTC.

Content and Source:  Email subscription via https://feedly.com.

Please check link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

 

BleepingComputer

90K followers42 articles per week#security#tech

39

Most popular

New Windows Driver Signature bypass allows kernel rootkit installs

4 TTPs

•

100+by Bill Toulas / 9h

Attackers can downgrade Windows kernel components to bypass security features such as Driver Signature Enforcement and deploy rootkits on fully patched systems. [...]

New Cisco ASA and FTD features block VPN brute-force password attacks

5 TTPs

•

48by Lawrence Abrams / 3h

Cisco has added new security features that significantly mitigate brute-force and password spray attacks on Cisco ASA and Firepower Threat Defense (FTD), helping protect the network from breaches and reducing resource utilization on devices. [...]

Windows 11 24H2 KB5044384 update fixes sfc /scannow corrupt file errors

Windows 11 KB5044380 update features

•

100+by Lawrence Abrams / 2d

Microsoft has released the optional KB5044384 preview cumulative update for Windows 11 24H2, which includes twenty-four changes, including a bug that caused the sfc /scannow command to always display corrupt file errors. [...]

Yesterday

Over 70 zero-day flaws get hackers $1 million at Pwn2Own Ireland

30by Bill Toulas / 11h

The fourth day of Pwn2Own Ireland 2024 marked the end of the hacking competition with more than $1 million in prizes for over 70 unique zero-day vulnerabilities in fully patched devices. [...]

Black Basta ransomware poses as IT support on Microsoft Teams to breach networks

IoC > 5 domains

•

37by Lawrence Abrams / 1d

•

7 TTPs

•

Black Basta uses Teams for attacks

The BlackBasta ransomware operation has moved its social engineering attacks to Microsoft Teams, posing as corporate help desks contacting employees to assist them with an ongoing spam attack. [...]

Black Basta poses as IT support on Microsoft Teams to breach networks

IoC > 5 domains

•

37by Lawrence Abrams / 1d

•

7 TTPs

•

Black Basta uses Teams for attacks

The BlackBasta ransomware operation has moved its social engineering attacks to Microsoft Teams, posing as corporate help desks contacting employees to assist them with an ongoing spam attack. [...]

Russia sentences REvil ransomware members to over 4 years in prison

Russia seeks prison for REvil hackers

•

49by Lawrence Abrams / 1d

Russia has sentenced four members of the REvil ransomware operation to over 4 years in prison for distributing malware and illegal circulation of means of payment. [...]

Amazon seizes domains used in rogue Remote Desktop campaign to steal data

12 TTPs

•

by Bill Toulas / 1d

•

AWS seizes APT29 phishing domains

Amazon has seized domains used by the Russian APT29 hacking group in targeted attacks against government and military organizations to steal Windows credentials and data using malicious Remote Desktop Protocol connection files. [...]

Oct 24, 2024

QNAP, Synology, Lexmark devices hacked on Pwn2Own Day 3

Pwn2Own Ireland 2024 hackers earn $500K

•

by Bill Toulas / 1d

The third day of Pwn2Own Ireland 2024 continued to showcase the expertise of white hat hackers as they exposed 11 zero-day vulnerabilities, adding $124,750 to the total prize pool, which now stands at $874,875. [...]

UnitedHealth says data of 100 million stolen in Change Healthcare breach

Change Healthcare breach affects 100M

•

74by Lawrence Abrams / 1d

UnitedHealth has confirmed for the first time that over 100 million people had their personal information and healthcare data stolen in the Change Healthcare ransomware attack, marking this as the largest healthcare data breach in recent years. [...]

UnitedHealth says data of 100 million stolen in Change Healthcare hack

Change Healthcare breach affects 100M

•

70by Lawrence Abrams / 1d

UnitedHealth has confirmed for the first time that over 100 million people had their personal information and healthcare data stolen in the Change Healthcare ransomware attack, marking this as the largest healthcare data breach in recent years. [...]

Apple creates Private Cloud Compute VM to let researchers find bugs

2 TTPs

•

27by Ionut Ilascu / 1d

•

Apple opens Private Cloud Compute for research

Apple created a Virtual Research Environment to allow public access to testing the security of its Private Cloud Compute system, and released the source code for some "key components" to help researchers analyze the privacy and safety features on the architecture. [...]

Henry Schein discloses data breach a year after ransomware attack

by Lawrence Abrams / 1d

Henry Schein has finally disclosed a data breach following at least two back-to-back cyberattacks in 2023 by the BlackCat Ransomware gang, revealing that over 160,000 people had their personal information stolen. [...]

Insurance admin Landmark says data breach impacts 800,000 people

41by Lawrence Abrams / 2d

Insurance administrative services company Landmark Admin warns that a data breach impacts over 800,000 people from a May cyberattack. [...]

Ireland fines LinkedIn €310 million over targeted advertising

LinkedIn fined 310 million euros

•

by Bill Toulas / 2d

LinkedIn received a €310 million fine from the Irish Data Protection Commission for violating European Union's law related to the processing of personal data for behavioral analysis and targeted advertising. [...]

Cisco fixes VPN DoS flaw discovered in password spray attacks

7 TTPs

•

47by Bill Toulas / 2d

Cisco fixed a denial of service flaw in its Cisco ASA and Firepower Threat Defense (FTD) software, which was discovered during large-scale brute force attacks against Cisco VPN devices in April. [...]

New Qilin ransomware encryptor features stronger encryption, evasion

14 TTPs

•

48by Bill Toulas / 2d

A new Rust-based variant of the Qilin (Agenda) ransomware strain, dubbed 'Qilin.B,' has been spotted in the wild, featuring stronger encryption, better evasion from security tools, and the ability to disrupt data recovery mechanisms. [...]

Samsung Galaxy S24 and Sonos Era hacked on Pwn2Own Ireland Day 2

25by Bill Toulas / 2d

On the second day of Pwn2Own Ireland 2024, competing white hat hackers showcased an impressive 51 zero-day vulnerabilities, earning a total of $358,625 in cash prizes. [...]

Mandiant says new Fortinet flaw has been exploited since June

IoC > 1 IP

•

30by Lawrence Abrams / 2d

•

6 TTPs

•

CVE-2024-47575

A new Fortinet FortiManager flaw dubbed "FortiJump" and tracked as CVE-2024-47575 has been exploited since June 2024 in zero-day attacks on over 50 servers, according to a new report by Mandiant. [...]

Oct 23, 2024

Windows 11 KB5044380 preview update lets you remap the Copilot key

Windows 11 KB5044380 update features

•

48by Lawrence Abrams / 3d

Microsoft has released the optional KB5044380 Preview cumulative update for Windows 11 23H2 and 22H2, which brings seventeen changes, including a new Gamepad keyboard and the ability to remap the Copilot keyboard key. [...]

WhatsApp now encrypts contact databases for privacy-preserving synching

2 TTPs

•

47by Bill Toulas / 3d

•

WhatsApp adds contact storage feature

The WhatsApp messenger platform has introduced Identity Proof Linked Storage (IPLS), a new privacy-preserving encrypted storage system designed for contact management. [...]

Lazarus hackers used fake DeFi game to exploit Google Chrome zero-day

IoC > 1 domain

•

35by Bill Toulas / 3d

•

7 TTPs

•

CVE-2024-4947

The North Korean Lazarus hacking group exploited a Google Chrome zero-day tracked as CVE-2024-4947 through a fake decentralized finance (DeFi) game targeting individuals in the cryptocurrency space. [...]

Google to let businesses create curated Chrome Web Stores for extensions

44by Bill Toulas / 3d

Google has announced it will soon allow organizations to create their own curated "Enterprise Web Store" of company-sanctioned browser extensions for Chrome and ChromeOS, aimed at improving productivity, security, and management for businesses. [...]

Fortinet warns of new critical FortiManager flaw used in zero-day attacks

IoC > 4 IPs

•

68by Lawrence Abrams / 3d

•

9 TTPs

Fortinet publicly disclosed today a critical FortiManager API vulnerability, tracked as CVE-2024-47575, that was exploited in zero-day attacks to steal sensitive files containing configurations, IP addresses, and credentials for managed devices. [...]

Hackers exploit 52 zero-days on the first day of Pwn2Own Ireland

67by Bill Toulas / 3d

On the first day of Pwn2Own Ireland, participants demonstrated 52 zero-day vulnerabilities across a range of devices, earning a total of $486,250 in cash prizes. [...]

Oct 22, 2024

CISA proposes new security requirements to protect govt, personal data

US proposes rule to protect data

•

48by Bill Toulas / 3d

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is proposing security requirements to prevent adversary states from accessing American's personal data as well as government-related information. [...]

Windows 10 KB5045594 update fixes multi-function printer bugs

Windows 11 KB5044380 update features

•

100+by Lawrence Abrams / 4d

Microsoft has released the optional KB5045594 preview cumulative update for Windows 10 22H2 with fixes for problems printing to multi-function printers and other issues. [...]

AWS, Azure auth keys found in Android and iOS apps used by millions

200+by Bill Toulas / 4d

Multiple popular mobile applications for iOS and Android come with hardcoded, unencrypted credentials for cloud services like Amazon Web Services (AWS) and Microsoft Azure Blob Storage, exposing user data and source code to security breaches. [...]

SEC charges tech companies for downplaying SolarWinds breaches

SEC fines four companies $7M

•

30by Lawrence Abrams / 4d

The SEC has charged four companies—Unisys Corp, Avaya Holdings, Check Point Software, and Mimecast—for allegedly misleading investors about the impact of their breaches during the massive 2020 SolarWinds Orion hack. [...]

Exploit released for new Windows Server "WinReg" NTLM Relay attack

4 TTPs

•

200+by Bill Toulas / 4d

Proof-of-concept exploit code is now public for a vulnerability in Microsoft's Remote Registry client that could be used to take control of a Windows domain by downgrading the security of the authentication process. [...]

VMware fixes bad patch for critical vCenter Server RCE flaw

3 TTPs

•

85by Bill Toulas / 4d

VMware has released another security update for CVE-2024-38812, a critical VMware vCenter Server remote code execution vulnerability that was not correctly fixed in the first patch from September 2024. [...]

Oct 21, 2024

Hackers exploit Roundcube webmail flaw to steal email, credentials

IoC > 1 domain

•

44by Bill Toulas / 5d

•

9 TTPs

Threat actors have been exploiting a vulnerability in the Roundcube Webmail client to target government organizations in the Commonwealth of Independent States (CIS) region, the successor of the former Soviet Union. [...]

Over 6,000 WordPress hacked to install plugins pushing infostealers

100+by Lawrence Abrams / 5d

WordPress sites are being hacked to install malicious plugins that display fake software updates and errors to push information-stealing malware. [...]

Microsoft blocks Windows 11 24H2 on two ASUS models due to crashes

Windows 11 24H2 faces issues

•

20by Bill Toulas / 5d

Microsoft is warning of Windows crashing with the blue screen of death on some ASUS laptop models when trying to upgrade to the latest version of the operating system, Windows 11 version 24H2. [...]

Certain ASUS laptops get BSOD when upgrading to Windows 11 24H2

Windows 11 24H2 faces issues

•

26by Bill Toulas / 5d

Microsoft is warning of Windows crashing with the blue screen of death on some ASUS laptop models when trying to upgrade to the latest version of the operating system, Windows 11 version 24H2. [...]

Bumblebee malware returns after recent law enforcement disruption

14 TTPs

•

33by Bill Toulas / 5d

•

Bumblebee malware loader resurfaces threat

The Bumblebee malware loader has been spotted in new attacks recently, more than four months after Europol disrupted it during 'Operation Endgame' in May. [...]