Microsoft patches 62 vulnerabilities, including Kerberos, and Mark of the Web, and Exchange…sort of
Credit to Author: Matt Wixey| Date: Tue, 08 Nov 2022 18:05:18 +0000
Still no fix for ProxyNotShell, but two MOTW bypasses get squashed
Read morethreat research
Family Tree: DLL-Sideloading Cases May Be Related
Credit to Author: Gabor Szappanos| Date: Thu, 03 Nov 2022 12:03:13 +0000
A threat actor’s repeated use of DLL-hijack execution flow makes for interesting attack results, including omnivorous file ingestion; we break down five cases and find commonalities
Read moreFamily Tree: Related DLL-Sideloading Cases Bear Strange Fruit
Credit to Author: Gabor Szappanos| Date: Thu, 03 Nov 2022 12:03:13 +0000
A threat actor’s repeated use of DLL-hijack execution flow makes for interesting attack results, including omnivorous file ingestion; we break down five cases and find commonalities
Read moreSophos X-Ops finds Attackers Using Covert Channels in Backdoor Against Devices
Credit to Author: gallagherseanm| Date: Wed, 19 Oct 2022 14:00:46 +0000
Newly discovered attack combines custom and commodity malware
Read moreAre threat actors turning to archives and disk images as macro usage dwindles?
Credit to Author: Matt Wixey| Date: Wed, 12 Oct 2022 11:00:28 +0000
Following Microsoft’s announcement that macros from the internet will be disabled by default, threat actors are using alternative file types for malware delivery. This shift brings both challenges and opportunities for organizations.
Read moreYou can’t always get what you want on Patch Tuesday
Credit to Author: Angela Gunn| Date: Tue, 11 Oct 2022 17:47:47 +0000
No joy for Exchange admins looking to seal off two widely reported Server vulns
Read moreRemove All The Callbacks – BlackByte Ransomware Disables EDR Via RTCore64.sys Abuse
Credit to Author: Angela Gunn| Date: Tue, 04 Oct 2022 11:00:33 +0000
A fresh exploration of the malware uncovers a new tactic for bypassing security products by abusing a known driver vulnerability
Read moreTwo Exchange Server vulns veer dangerously close to ProxyShell
Credit to Author: Angela Gunn| Date: Mon, 03 Oct 2022 22:03:02 +0000
A chained pair of vulnerabilities, plus PowerShell, affects the Microsoft messaging platform well in advance of Patch Tuesday; Sophos customers are protected
Read moreA lighter Patch Tuesday, but one heavy with remote code execution bugs
Credit to Author: Matt Wixey| Date: Tue, 13 Sep 2022 18:38:14 +0000
There are fewer bugs in September’s update than in previous months, with RCE vulns making up the bulk of the addressed CVEs
Read moreCookie stealing: the new perimeter bypass
Credit to Author: gallagherseanm| Date: Thu, 18 Aug 2022 11:00:50 +0000
As organizations move to cloud services and multifactor authentication, cookies tied to identity and authentication give attackers a new path to compromise.
Read more