Tag: windows
-
Tax-Themed Campaign Exploits Windows MSC Files to Deliver Stealthy Backdoor
The Securonix Threat Research team has uncovered a sophisticated phishing campaign named FLUX#CONSOLE, leveraging tax-related lures and the use of Windows MSC (Microsoft Management Console) files to deploy a stealthy... First seen on securityonline.info Jump to article: securityonline.info/tax-themed-campaign-exploits-windows-msc-files-to-deliver-stealthy-backdoor/
-
Microsoft coughs up yet more Windows 11 24H2 headaches
by
in SecurityNewsUsers report the sound of silence from operating system update First seen on theregister.com Jump to article: www.theregister.com/2024/12/19/windows_11_24h2_issues/
-
Enhance Microsoft security by ditching your hybrid setup for Entra-only join
by
in SecurityNews
Tags: ai, authentication, business, cloud, compliance, conference, credentials, email, firewall, group, identity, infrastructure, intelligence, Internet, microsoft, network, ntlm, office, powershell, risk, service, switch, technology, tool, vpn, windowsArtificial intelligence is top of mind for nearly everything Microsoft is doing these days, but there’s another goal the company would like to see its users strive to attain, one that may not be easily obtained, and that’s to be Entra-joined only.That means no more Active Directory (AD) and no more traditional domain: instead, your…
-
Passkeys: Microsoft kämpft weiter gegen das traditionelle Passwort
by
in SecurityNewsOb Windows-User wollen oder nicht: Microsoft will das traditionelle Passwort weiterhin komplett abschaffen. Die Lösung: Passkeys. First seen on golem.de Jump to article: www.golem.de/news/passkeys-microsoft-kaempft-weiter-gegen-das-traditionelle-passwort-2412-191911.html
-
Raspberry-Robin Vielschichtige Verschlüsselung
by
in SecurityNewsDas Zscaler-ThreatLabz-Team entschlüsselte vor kurzem die umfangreichen Verschleierungstechniken von Raspberry-Robin (auch bekannt als Roshtyak). Die Malware befindet sich seit 2021 im Umlauf und verbreitet sich hauptsächlich über infizierte USB-Geräte, so dass nach wie vor eine Gefahr zur Infektion von Windows-Systemen davon ausgeht. Hauptaufgabe von Raspberry-Robin ist das Nachladen und Ausführen der Payload auf einem kompromittierten…
-
Auslaufmodell NTLM: Aus Windows 11 24H2 und Server 2025 teils entfernt
by
in SecurityNewsMicrosoft verbessert den Schutz vor NTLM-Relay-Angriffen. Weitgehend unbemerkt wurden in Windows 11 24H2 und Server 2025 zudem NTLMv1 entfernt. First seen on heise.de Jump to article: www.heise.de/news/Auslaufmodell-NTLM-Aus-Windows-11-24H2-und-Server-2025-teils-entfernt-10217239.html
-
Der Feind in meinem Netz – Schutz vor Sicherheitsrisiken jenseits von Windows
by
in SecurityNews
Tags: windowsFirst seen on security-insider.de Jump to article: www.security-insider.de/netzwerksicherheitsluecken-nicht-nur-windows-risiken-a-3542c2b38d69e000769683aeba86380d/
-
CISA-Warnungen: Schwachstellen in Windows Kernel, Cleo etc.
by
in SecurityNewsDie US-Cybersicherheitsbehörde CISA hat ihren Schwachstellenkatalog um weitere Einträge ergänzt. So wird vor der Adobe ColdFusion Schwachstelle CVE-2024-20767 , der Windows Kernel-Schwachstelle CVE-2024-35250, oder vor Schwachstellen in der Cleo-Software gewarnt. Die Schwachstellen werden bekanntermaßen ausgenutzt. Mir ist die Warnung kürzlich … First seen on borncity.com Jump to article: www.borncity.com/blog/2024/12/20/cisa-warn-vor-windows-kernel-schwachstellen-cve-2024-20767-cve-2024-35250/
-
Windows 11 Privilege Escalation Vulnerability Lets Attackers Execute Code to Gain Access
by
in SecurityNewsMicrosoft has swiftly addressed a critical security vulnerability affecting Windows 11 (version 23H2), which could allow local attackers to escalate privileges to the SYSTEM level. Security researcher Alex Birnberg showcased the exploit during the renowned TyphoonPWN 2024 cybersecurity competition, securing third place for his demonstration of the flaw. TyphoonPWN, one of the premier cybersecurity competitions,…
-
Raspberry Robin: Vielschichtige Verschlüsselung
by
in SecurityNewsDas Zscaler ThreatLabz-Team entschlüsselte vor kurzem die umfangreichen Verschleierungstechniken von Raspberry Robin (auch bekannt als Roshtyak). Die Malware befindet sich seit 2021 im Umlauf und verbreitet sich hauptsächlich über infizierte USB-Geräte, so dass nach wie vor eine Gefahr zur Infektion von Windows-Systemen davon ausgeht. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/raspberry-robin-vielschichtige-verschluesselung
-
NotLockBit Previously Unknown Ransomware Attack Windows macOS
by
in SecurityNewsA new and advanced ransomware family, dubbed NotLockBit, has emerged as a significant threat in the cybersecurity landscape, closely mimicking the behavior and tactics of the notorious LockBit ransomware. NotLockBit notably distinguishes itself by being one of the first ransomware strains designed to effectively attack both macOS and Windows operating systems, showcasing powerful cross-platform capabilities.…
-
Windows 11 24H2 upgrades blocked on some PCs due to audio issues
by
in SecurityNewsMicrosoft has added another Windows 11 24H2 upgrade block for systems with Dirac audio improvement software due to compatibility issues breaking sound output. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/windows-11-24h2-upgrades-blocked-on-some-pcs-due-to-audio-issues/
-
Microsoft says Auto HDR causes game freezes on Windows 11 24H2
by
in SecurityNewsMicrosoft is now blocking Windows 11 24H2 upgrades on systems with Auto HDR enabled due to a compatibility issue that causes game freezes. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-says-auto-hdr-causes-game-freezes-on-windows-11-24h2/
-
Exploring vulnerable Windows drivers
by
in SecurityNewsThis post is the result of research into the real-world application of the Bring Your Own Vulnerable Driver (BYOVD) technique along with Cisco Talos’ series of posts about malicious Windows drivers. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/exploring-vulnerable-windows-drivers/
-
Apache Tomcat Conditional Competition Code Execution Vulnerability (CVE-2024-50379)
by
in SecurityNewsOverview Recently, NSFOCUS CERT detected that Apache issued a security announcement, fixing the Apache Tomcat conditional competition code execution vulnerability (CVE-2024-50379). Due to the inconsistency between Windows file system and Tomcat in case-distinguishing processing of paths, when the write function of default servlet is enabled (set readonly=false and allow PUT method), unauthenticated attackers can construct…The…
-
Windows 11 nervt mit weiteren Werbebannern
by
in SecurityNewsDas Betriebssystem zeigt Werbung für Call of Duty, Windows Defender und andere Microsoft-Produkte an. Das kann abgestellt werden. First seen on golem.de Jump to article: www.golem.de/news/microsoft-windows-11-nervt-mit-weiteren-werbebannern-2412-191851.html
-
Critical Chrome Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely
by
in SecurityNewsGoogle has released a new security update on the Stable channel, bringing Chrome to version 131.0.6778.204/.205 for Windows and Mac and 131.0.6778.204 for Linux. This update addresses multiple high-severity vulnerabilities, ensuring enhanced safety for users. The rollout will occur gradually over the coming days and weeks. Highlighted Security Fixes The latest Chrome release includes fixes for five vulnerabilities, of…
-
Kritische LDAP-Schwachstelle in Windows (CVE-2024-49112)
by
in SecurityNewsNoch ein kleiner Nachtrag vom Dezember 2024-Patchday. Zum 10. Dezember 2024 hat Microsoft einen kritische Schwachstelle (CVE-2024-49112) im Lightweight Directory Access Protocol (LDAP) öffentlich gemacht. Diese ermöglicht Remote-Angriffe auf Windows-Clients und -Server, wurde aber gepatcht. Es gibt aber eine Reihe … First seen on borncity.com Jump to article: www.borncity.com/blog/2024/12/19/kritische-ldap-schwachstelle-in-windows-cve-2024-49112/
-
Chrome Security Update, Patch for Multiple Security Flaws
by
in SecurityNewsGoogle has released a new security update on the Stable channel, bringing Chrome to version 131.0.6778.204/.205 for Windows and Mac and 131.0.6778.204 for Linux. This update addresses multiple high-severity vulnerabilities, ensuring enhanced safety for users. The rollout will occur gradually over the coming days and weeks. Highlighted Security Fixes The latest Chrome release includes fixes for five vulnerabilities, of…
-
Thai Police Systems Under Fire From ‘Yokai’ Backdoor
Hackers are abusing legitimate Windows utilities to target Thai law enforcement with a novel malware that is a mix of sophistication and amateurishness. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/thai-police-systems-yokai-backdoor
-
RiseLoader Attack Windows By Employed A VMProtect To Drop Multiple Malware Families
RiseLoader, a new malware family discovered in October 2024, leverages a custom TCP-based binary protocol similar to RisePro for downloading and executing second-stage payloads. Despite RisePro’s development discontinuation in June 2024, RiseLoader’s emergence suggests a potential connection to the threat group behind RisePro and PrivateLoader. The malware often employs VMProtect for code obfuscation and has…
-
Windows-Sicherheitslösung Trend Micro Apex One als Einfallstor für Angreifer
by
in SecurityNews
Tags: windowsAngreifer können an mehreren Sicherheitslücken in Trend Micro Apex One ansetzen. Sicherheitsupdates sind verfügbar. First seen on heise.de Jump to article: www.heise.de/news/Windows-Sicherheitsloesung-Trend-Micro-Apex-One-als-Einfallstor-fuer-Angreifer-10213518.html
-
Cyberkriminelle setzten vermehrt auf vertrauenswürdige Anwendungen
by
in SecurityNewsSophos veröffentlicht seinen Active Adversary Report. Eine wichtige Erkenntnis: Angreifer nutzen für ihre Machenschaften zunehmend vertrauenswürdige Anwendungen und Tools auf Windows-Systemen (‘Living Off the Land”-Binärdateien / LOLbins). First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/cyberkriminelle-anwendungen
-
Careto A legendary Threat Group Targets Windows By Deploy Microphone Recorder And Steal Files
by
in SecurityNewsRecent research has linked a series of cyberattacks to The Mask group, as one notable attack targeted a Latin American organization in 2022, where attackers compromised the organization’s MDaemon email server and exploited the WorldClient webmail component to maintain persistent access. While the initial compromise vector remains unknown, the successful exploitation of the MDaemon server…
-
Foxit PDF Editor und Reader: Attacken über präparierte PDF-Dateien möglich
by
in SecurityNewsPDF-Anwendungen von Foxit sind unter macOS und Windows verwundbar. Sicherheitsupdates stehen bereit. First seen on heise.de Jump to article: www.heise.de/news/Foxit-PDF-Editor-und-Reader-Attacken-ueber-praeparierte-PDF-Dateien-moeglich-10211267.html
-
Key strategies to enhance cyber resilience
by
in SecurityNews
Tags: attack, awareness, backup, banking, breach, business, ceo, compliance, control, crowdstrike, cyber, cybersecurity, data, finance, government, group, healthcare, incident, incident response, infrastructure, insurance, metric, network, phishing, programming, ransom, ransomware, resilience, risk, security-incident, service, skills, software, strategy, supply-chain, technology, threat, training, update, vulnerability, windowsThe faulty CrowdStrike software update that triggered IT outages on a global scale in July was a sobering reminder of the importance of incident response and business continuity plans.The update caused more than eight million Windows devices to crash and take down with them airline reservation systems, hospital and government services, financial and banking applications…
-
Cyber Criminals Exploit Windows Management Console to Deliver Backdoor Payloads
A recent campaign dubbed FLUX#CONSOLE has come to light, leveraging Microsoft Common Console Document (.MSC) files to infiltrate systems with backdoor malware. The campaign showcases the growing sophistication of phishing techniques and the exploitation of lesser-known Windows features. The FLUX#CONSOLE Campaign The FLUX#CONSOLE campaign has been identified as a multi-stage attack with sinister objectives. By using MSC files, threat actors…
-
CISA Warns of Exploited Adobe ColdFusion, Windows Vulnerabilities
by
in SecurityNewsCISA has warned organizations that two vulnerabilities affecting Adobe ColdFusion and Windows have been exploited in the wild. The post CISA Warns of Exploited Adobe ColdFusion, Windows Vulnerabilities appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/cisa-warns-of-exploited-adobe-coldfusion-windows-vulnerabilities/
-
Sicherheitsbehörde warnt: Kernel-Schwachstelle in Windows wird aktiv ausgenutzt
by
in SecurityNewsAnfällig sind Windows 10 und 11 sowie mehrere Windows-Server-Versionen. Patches stehen bereit und sollten installiert werden, sofern noch nicht geschehen. First seen on golem.de Jump to article: www.golem.de/news/sicherheitsbehoerde-warnt-kernel-schwachstelle-in-windows-wird-aktiv-ausgenutzt-2412-191784.html
-
U.S. CISA adds Microsoft Windows Kernel-Mode Driver and Adobe ColdFusion flaws to its Known Exploited Vulnerabilities catalog
by
in SecurityNews
Tags: access, adobe, cisa, control, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Kernel-Mode Driver and Adobe ColdFusion flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference (CVE-2024-35250) and Adobe ColdFusion Improper Access Control (CVE-2024-20767) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The…