Parse notes
Cisco has released security updates to patch a ClamAV vulnerability that could lead to denial-of-service. The vulnerability is caused by a heap-based buffer overflow in the OLE2 decryption routine that could lead the program to crash when scanning maliciously crafted OLE2 content. Cisco has stated that PoC exploit code is publicly available but there is no evidence of active exploitation.
South Korean VPN provider IPany was breached in a supply-chain attack that deployed a custom SlowStepper malware. The attackers breached the IPany development environment and added their custom SlowStepper malware to the VPN installation. The SlowStepper C2 malware supports commands that gather system information, fetch and run files from the C2 server, enumerate and exfiltrate files, run Python-based spyware tools, run shell commands, execute syscalls, and delete files or directories.
A security vulnerability in Zendesk's subdomain registration feature allows cybercriminals to conduct phishing and investment scams. CloudSEK researchers discovered that attackers can create fake subdomains resembling legitimate brands to deceive victims. This poses a significant risk as attackers can send convincing phishing emails and manipulate users into sharing sensitive information or funds.
TAP is a Microsoft Entra ID solution that provides users with temporary passwordless access so one of the other permanent passwordless mechanisms can be configured. Previously, TAP would not work for guest users as they would generally need to authenticate with a remote provider. This blog post shows how to enable the newly released Entra ID TAP for internal guests feature.
Behavioral IOCs attempt to enrich a traditional IOC by correlating multiple events to add context for more robust detections. This post introduces the concept of behavioral IOCs in cloud environments and provides an example of how Wiz developed IOCs for a specific threat actor. It recommends beginning with a piece of identifying information about a threat actor or tactic and then iteratively mapping out unique parameters or other identifiers to detect that threat actor to the IOC.
Security professionals often get invited late to cloud projects, causing panic over potential vulnerabilities. To secure these environments, follow a playbook with steps like gaining access, implementing least privilege access, enabling MFA, and conducting a compromise assessment. By following the steps in this blog post, you can take control, address security concerns, and protect valuable data in cloud projects effectively.
garak (Generative AI Red-teaming & Assessment Kit) is a vulnerability scanner for LLMs from NVIDIA.
LitterBox is a sandbox tool for testing malware payloads. It helps red teamers validate evasion techniques and assess detection mechanisms. The tool provides detailed analysis reports and should only be used in secure testing environments.
FediSecFeeds searches CVE data in infosec.exchange and ioc.exchange instances. The output can be fetched via GitHub's API.
Terraform makes use of lock files to ensure that multiple users are not modifying a state file simultaneously. Prior to version 1.10, users who were using the S3 backend required a DynamoDB table to store the lock file. As of the newly released version 1.10, Terraform can make use of S3 conditional writes to utilize S3 for both state file and lock file storage.
Threat actors are tricking Telegram users into running malicious PowerShell scripts by pretending to be a captcha or verification system. This tactic exploits the news around Silk Road founder Ross Ulbricht to lure victims into downloading malware. Users should be cautious and avoid running any unfamiliar commands on their devices to avoid falling victim to such attacks.
MasterCard had a DNS error, unnoticed for five years, that allowed potential interception or redirection of internet traffic. A security researcher discovered the error and prevented cybercriminals from exploiting it by registering the mistyped domain. The issue has been resolved, but it highlights the importance of careful domain configuration for cybersecurity.
The Trump administration disbanded the Cyber Safety Review Board investigating the Salt Typhoon hacks, causing concern among cybersecurity experts about the impact on national security.
Windows 11 24H2 is now available to all eligible Windows 10 PCs via Windows Update.
The DOJ and FBI removed Chinese-linked PlugX malware from over 4,200 U.S. computers.