Welcome to our weekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our weekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Hackers Using Secure USB Drives To Attack Government Entities

Source: GBHackers

An ongoing attack on government agencies in the APAC region has been claimed to have compromised a secure USB device with hardware encryption. Read more.

Number of Cisco Devices Hacked via Unpatched Vulnerability Increases to 40,000

Source: SECURITY WEEK

The exploited vulnerability is CVE-2023-20198, a critical flaw affecting the IOS XE web interface that can be exploited by remote, unauthenticated attackers for privilege escalation. Read more.

Google Play Protect Introduces Real-Time Code-Level Scanning for Android Malware

Source: The Hacker News

Google has announced an update to its Play Protect with support for real-time scanning at the code level to tackle novel malicious apps prior to downloading and installing them on Android devices. Read more.

A Threat Actor Is Selling Access To Facebook And Instagram’s Police Portal

Source: Security Affairs

The portal allows law enforcement agencies to request data relating to users (IP, phones, DMs, device info) or request the removal of posts and the ban of accounts. Read more.

DarkGate malware campaign

Source: W/ Labs

It rapidly became apparent that the lure documents and targeting were very similar to recent DuckTail infostealer campaigns, and it was possible to pivot through opensource data from the DarkGate campaign to multiple other infostealers which are very likely being used by the same actor/group. Read more.

Another InfoStealer Enters the Field, ExelaStealer

Source: FORTINET

FortiGuard Labs research reveals that ExelaStealer is a largely open-source InfoStealer with paid customizations available from the threat actor. Read more.

Ragnar Locker ransomware group taken down

Source: Malwarebytes LABS

Even though it had a long run for a ransomware group, it seems the bell might be tolling for Ragnar Locker. On October 19, 2023, the group’s leak site was seized by an international group of law enforcement agencies. Read more.

Attacks on 5G Infrastructure From User Devices: ASN.1 Vulnerabilities in 5G Cores

Source: TREND MICRO

In the second part of this series, we will examine how attackers can trigger vulnerabilities by sending control messages masquerading as user traffic to cross over from user plane to control plane. Read more.

Clever malvertising attack uses Punycode to look like KeePass’s official website

Source: CISA

In a recent malvertising campaign, we observed a malicious Google ad for KeePass, the open-source password manager which was extremely deceiving. Read more.

CISA, NSA, FBI, and MS-ISAC Release Update to #StopRansomware Guide

Source: CISA

The update includes new prevention tips such as hardening SMB protocols, revised response steps, and added threat hunting insights. Read more.

Walmart Jumps to Top Spot as the Most Impersonated Brand for Phishing Scams in Q3 2023

Source: CHECK POINT

Our latest Brand Phishing Report for Q3 2023 highlights the brands that were most frequently imitated by cybercriminals in their attempts to steal individuals’ personal information or payment credentials during July, August and September 2023. Read more.

Email Security Best Practices for Phishing Prevention

Source: TREND MICRO

Trend Micro Research reported a 29% growth in phishing attacks blocked and detected in 2022. Explore the latest phishing trends and email security best practices to enhance your email security and reduce cyber risk. Read more.

Threat Actors Breached Okta Support System And Stole Customers’ Data

Source: Security Affairs

Okta revealed that threat actors breached its support case management system and stole sensitive data that can be used in future attacks. Read more.

Admin behind E-Root stolen creds souk extradited to US

Source: The Register

A Moldovan who allegedly ran the compromised-credential marketplace E-Root has been extradited from the UK to America to stand trial. Read more.

Want more articles? Check out the previous edition of Security Signals. Want to learn more about AI-Enabled Phishing Tactics, check out the Malware Patrol blog post: Phishing’s Next Wave: AI-Enabled Tactics for Attackers and Cybersecurity Pros.

Welcome to our weekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our weekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Threat Actor Profile: Strox Phishing-as-a-Service

Source: PhishLABS

Strox has become one of the most complete phishing solutions for fraud actors available, offering advanced phishing kits, hosting services, mail spam scripts, and an automated market for selling stolen credentials. Read more.

The Art of Concealment: A New Magecart Campaign That’s Abusing 404 Pages

Source: Akamai

This campaign stands out because of its three advanced concealment techniques, one of which we had never seen before — specifically, manipulating the website’s default 404 error page to hide malicious code — that poses unique challenges for detection and mitigation. Read more.

Vulnerability Exposed in WordPress Plugin User Submitted Posts

Source: InfoSecurity Magazine

A new vulnerability in the User Submitted Posts WordPress plugin (versions 20230902 and below) has been discovered by the Patchstack team. With over 20,000 active installations, this popular plugin is used for user-generated content submissions and is developed by Plugin Planet. Read more.

ShellBot DDoS Malware Installed Through Hexadecimal Notation Addresses

Source: ASEC

ASEC has recently discovered a change in the distribution method of the ShellBot malware, which is being installed on poorly managed Linux SSH servers. The overall flow remains the same, but the download URL used by the threat actor to install ShellBot has changed from a regular IP address to a hexadecimal value. Read more.

Microsoft: State hackers exploiting Confluence zero-day since September

Source: BLEEPING COMPUTER

Microsoft says a Chinese-backed threat group tracked as ‘Storm-0062’ (aka DarkShadow or Oro0lxy) has been exploiting a critical privilege escalation zero-day in the Atlassian Confluence Data Center and Server since September 14, 2023. Read more.

Multiple Citrix NetScaler Flaw Leads to DoS Attack and Data Exposure

Source: GBHackers

Critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway have exposed sensitive information and a denial of service attack. A malicious cyber actor can exploit one of these vulnerabilities to gain control of an affected machine. Citrix has published security upgrades to address the vulnerabilities impacting several products. Read more.

Microsoft Fixes Exploited Zero-Days in WordPad, Skype for Business

Source: SECURITY WEEK

Microsoft’s security response team on Tuesday pushed out a massive batch of software and OS updates to cover more than 100 vulnerabilities across the Windows ecosystem and warned that three of the flaws are already being exploited in the wild. Read more.

Microsoft to Phase Out NTLM in Favor of Kerberos for Stronger Authentication

Source: The Hacker News

Microsoft has announced that it plans to eliminate NT LAN Manager (NTLM) in Windows 11 in the future, as it pivots to alternative methods for authentication and bolster security. Read more.

#StopRansomware: AvosLocker Ransomware (Update)

Source: CISA

AvosLocker affiliates compromise organizations’ networks by using legitimate software and open-source remote system administration tools. AvosLocker affiliates then use exfiltration-based data extortion tactics with threats of leaking and/or publishing stolen data. Read more.

Fortinet Releases Security Updates for Multiple Products

Source: CISA

Fortinet has released security advisories addressing vulnerabilities in multiple products. These vulnerabilities may allow cyber threat actors to take control of the affected systems. Read more.

Juniper Networks Patches Over 30 Vulnerabilities in Junos OS

Source: SECURITY WEEK

The most severe of these issues is an incorrect default permissions bug that allows an unauthenticated attacker with local access to a vulnerable device to create a backdoor with root privileges. Read more.

Biggest DDoSes of all time generated by protocol 0-day in HTTP/2

Source: ars TECHNICA

Unlike other high-severity zero-days in recent years—Heartbleed or log4j, for example—which caused chaos from a torrent of indiscriminate exploits, the more recent attacks, dubbed HTTP/2 Rapid Reset, were barely noticeable to all but a select few engineers. Read more.

Ransomlooker, A New Tool To Track And Analyze Ransomware Groups’ Activities

Source: Security Affairs

The researchers have created the tool to help cybersecurity experts in their daily jobs by providing real-time updates and actionable insights. It offers various statistical insights into data, the ability to determine attack perpetrators, and incorporates filtering by country, industries, time span, and other parameters for journalistic investigations. Read more.

Dozens of Squid Proxy Vulnerabilities Remain Unpatched 2 Years After Disclosure

Source: SECURITY WEEK

Dozens of vulnerabilities affecting the Squid caching and forwarding web proxy remain unpatched two years after a researcher responsibly disclosed them to developers. Read more.