Flubot Malware Targets Androids With Fake Security Updates
The banking trojan keeps switching up its lies, trying to fool Android users into clicking on a fake Flubot-deleting app or supposedly uploaded photos of recipients.
Read More
Author: Lisa Vaas
Google Emergency Update Fixes Two Chrome Zero Days
This is the second pair of zero days that Google’s fixed this month, all four of which have been actively exploited in the wild.
Read MoreBaby’s Death Alleged to Be Linked to Ransomware
Access to heart monitors disabled by the attack allegedly kept staff from spotting blood & oxygen deprivation that led to the baby’s death.
Read MoreKeep Attackers Out of VPNs: Feds Offer Guidance
The NSA and CISA issued recommendations on choosing and hardening VPNs to prevent nation-state APTs from weaponizing flaws & CVEs to break into protected networks.
Read MoreConti Ransomware Expands Ability to Blow Up Backups
The Conti ransomware gang has developed novel tactics to demolish backups, especially the Veeam recovery software.
Read MoreSAS 2021: ‘Tomiris’ Backdoor Linked to SolarWinds Malware
Newly discovered code resembles the Kazuar backdoor and the Sunshuttle second-stage malware distributed by Nobelium in the SolarWinds supply-chain attacks.
Read MoreWorking Exploit Is Out for VMware vCenter CVE-2021-22005 Flaw
The unredacted RCE exploit allows unauthenticated, remote attackers to upload files to the vCenter Server analytics service.
Read MoreCredential Spear-Phishing Uses Spoofed Zix Encrypted Email
The spoofed email has targeted close to 75K inboxes, slipping past spam and security controls across Office 365, Google Workspace, Exchange, Cisco ESA and more.
Read MoreEU: Russia Behind ‘Ghostwriter’ Campaign Targeting Germany
It’s not the first time that the disinformation/spearphishing campaign, which originally smeared NATO, has been linked to Russia.
Read MoreExchange/Outlook Autodiscover Bug Spills $100K+ Email Passwords
Hundreds of thousands of email credentials, many of which double as Active Directory domain credentials, came through to credential-trapping domains in clear text.
Read More