May 2022 – Page 8 – PossibleThreat Articles

Android apps with millions of downloads exposed to high-severity vulnerabilities

May 28, 2022 0 Comments Android, cybersecurity, Microsoft, Microsoft security intelligence, Mobile, Security, vulnerability

Credit to Author: Katie McCafferty| Date: Fri, 27 May 2022 16:00:00 +0000

Microsoft uncovered high-severity vulnerabilities in a mobile framework used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote or local attacks.

The post Android apps with millions of downloads exposed to high-severity vulnerabilities appeared first on Microsoft Security Blog.

Microsoft Security

Detecting and preventing privilege escalation attacks leveraging Kerberos relaying (KrbRelayUp)

May 28, 2022 0 Comments cybersecurity, krbrelayup, microsoft defender for endpoint, microsoft defender for identity, Microsoft security intelligence, resource-based constrained delegation (rbcd)

Credit to Author: Microsoft 365 Defender Threat Intelligence Team| Date: Wed, 25 May 2022 21:00:00 +0000

The privilege escalation hacking tool KrbRelayUp is a wrapper that can streamline the use of some features in Rubeus, KrbRelay, SCMUACBypass, PowerMad/ SharpMad, Whisker, and ADCSPwn tools in attacks. Although this attack won’t function for Azure Active Directory (Azure AD) joined devices, hybrid joined devices with on-premises domain controllers remain vulnerable.

The post Detecting and preventing privilege escalation attacks leveraging Kerberos relaying (KrbRelayUp) appeared first on Microsoft Security Blog.

Microsoft Security

Anatomy of a DDoS amplification attack

May 28, 2022 0 Comments cybersecurity, DDoS, ddos amplification, ddos protection, Microsoft security intelligence

Credit to Author: Microsoft 365 Defender Threat Intelligence Team| Date: Mon, 23 May 2022 18:00:00 +0000

Amplification attacks are one of the most common distributed denial of service (DDoS) attack vectors. These attacks are typically categorized as flooding or volumetric attacks, where the attacker succeeds in generating more traffic than the target can process, resulting in exhausting its resources due to the amount of traffic it receives.

The post Anatomy of a DDoS amplification attack appeared first on Microsoft Security Blog.

Microsoft Security

How to improve risk management using Zero Trust architecture

May 28, 2022 0 Comments Compliance, cybersecurity, Data governance, Zero Trust

Credit to Author: Christine Barrett| Date: Mon, 23 May 2022 17:00:00 +0000

Risk management plays a critical role in helping organizations with their security posture enhancement. Taking insider incidents as an example, they are not only costly to organizations but also time-consuming to be contained. As such, the ROI is maximized in effectively protecting the organizations’ assets as well as ensuring their business operations. Risk management is an ongoing activity. Are the long-established risk management programs in the enterprises staying on top of the evolving digital and threat landscapes?

The post How to improve risk management using Zero Trust architecture appeared first on Microsoft Security Blog.

Microsoft Security

Beneath the surface: Uncovering the shift in web skimming

May 28, 2022 0 Comments cybersecurity, Microsoft security intelligence

Credit to Author: Paul Oliveria| Date: Mon, 23 May 2022 16:00:00 +0000

Web skimming campaigns now employ various obfuscation techniques to deliver and hide the skimming scripts. It’s a shift from earlier tactics where attackers conspicuously injected the malicious scripts into e-commerce platforms and content management systems (CMSs) via vulnerability exploitation, making this threat highly evasive to traditional security solutions.

The post Beneath the surface: Uncovering the shift in web skimming appeared first on Microsoft Security Blog.

Fortinet Security

Phishing Campaign Delivering Three Fileless Malware: AveMariaRAT / BitRAT / PandoraHVNC – Part II

May 28, 2022 0 Comments

FortiGuard Labs discovered a phishing campaign delivering fileless malware AveMariaRAT, BitRAT, and PandoraHVNC to steal sensitive information from a victim’s device. Read part II of our analysis to find out more about the malware payload details and the control commands.

Fortinet Security

New Nokoyawa Variant Catching Up to Peers with Blatant Code Reuse

May 28, 2022 0 Comments

FortiGuard Labs discovered a new variant of the Nokoyawa ransomware and observed that it has been evolving by reusing code from publicly available sources. Read our blog to learn more about the behavior and new features which maximize the number of files that can be encrypted.

Fortinet Security

Spoofed Saudi Purchase Order Drops GuLoader: Part 1

May 28, 2022 0 Comments

FortiGuard Labs recently discovered a social engineering email lure with a message delivered to a company in Ukraine. In part I of our blog, we will analyze the phishing email and provide an analysis of the embedded malware which contains an executable for GuLoader.