A wolf in sheep's clothing: Actors spread malware by leveraging trust in Amnesty International and fear of Pegasus

September 30, 2021, 5:01 am

≫ Next: Threat Source newsletter (Sept. 30, 2021)

≪ Previous: Threat Roundup for September 17 to September 24

$

0

0

By Vitor Ventura and Arnaud Zobec. Threat actors are impersonating the group Amnesty International and promising to protect against the Pegasus spyware as part of a scheme to deliver malware. Amnesty International recently made international headlines when it released a groundbreaking report on...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

---

Threat Source newsletter (Sept. 30, 2021)

September 30, 2021, 11:00 am

≫ Next: Talos Takes Ep. #70: Let's put a positive spin on this whole working from home thing for once

≪ Previous: A wolf in sheep's clothing: Actors spread malware by leveraging trust in Amnesty International and fear of Pegasus

$

0

0

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.   In the latest example of attackers trying to capitalize on current headlines, we've spotted a group using the recent fervor around the Pegasus spyware to spread malware.  We've detailed a campaign in which the...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Talos Takes Ep. #70: Let's put a positive spin on this whole working from home thing for once

October 1, 2021, 6:00 am

≫ Next: Threat Roundup for September 24 to October 1

≪ Previous: Threat Source newsletter (Sept. 30, 2021)

$

0

0

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. As part of National Cybersecurity Awareness Month, we're releasing a special series of Talos Takes episodes focused on...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Threat Roundup for September 24 to October 1

October 1, 2021, 2:07 pm

≫ Next: Threat hunting in large datasets by clustering security events

≪ Previous: Talos Takes Ep. #70: Let's put a positive spin on this whole working from home thing for once

$

0

0

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 24 and Oct. 1. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Threat hunting in large datasets by clustering security events

October 6, 2021, 5:04 am

≫ Next: Threat Source newsletter (Oct. 7, 2021)

≪ Previous: Threat Roundup for September 24 to October 1

$

0

0

By Tiago Pereira. Security tools can produce very large amounts of data that even the most sophisticated organizations may struggle to manage. Big data processing tools, such as spark, can be a powerful tool in the arsenal of security teams.This post walks through threat hunting on large datasets...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Threat Source newsletter (Oct. 7, 2021)

October 7, 2021, 11:00 am

≫ Next: Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers

≪ Previous: Threat hunting in large datasets by clustering security events

$

0

0

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.   Every day, we see mountains and mountains of data. So how do we comb through all of it to find out what's important to customers and users? Well, there are many ways, but we wanted to give readers and researchers a look...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers

October 7, 2021, 12:36 pm

≫ Next: Talos Takes Ep. #71 (NCSAM edition): Reflecting on ransomware in 2021

≪ Previous: Threat Source newsletter (Oct. 7, 2021)

$

0

0

A recently discovered vulnerability in Apache HTTP Server (CVE-2021-41733) is being actively exploited in the wild. This vulnerability is a path traversal and file disclosure vulnerability that could allow an attacker to map URLs outside of the document root. It could also result in exposure of...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Talos Takes Ep. #71 (NCSAM edition): Reflecting on ransomware in 2021

October 8, 2021, 5:45 am

≫ Next: Threat Roundup for October 1 to October 8

≪ Previous: Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers

$

0

0

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. We are from the first (or last) people to say this, but 2021 is the year of ransomware. It’s by far the biggest story...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

---

Threat Roundup for October 1 to October 8

October 8, 2021, 10:14 am

≫ Next: Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows

≪ Previous: Talos Takes Ep. #71 (NCSAM edition): Reflecting on ransomware in 2021

$

0

0

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 1 and Oct. 8. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows

October 12, 2021, 7:49 am

≫ Next: Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities

≪ Previous: Threat Roundup for October 1 to October 8

$

0

0

Lilith >_> of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.  Cisco Talos recently discovered two vulnerabilities in the Anker Eufy Homebase.  The Eufy Homebase 2 is the video storage and networking gateway that works with Anker’s Eufy Smarthome ecosystem. All Eufy...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities

October 12, 2021, 10:35 am

≫ Next: Vulnerability Spotlight: Use-after-free vulnerability in Microsoft Excel could lead to code execution

≪ Previous: Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows

$

0

0

By Jon Munshaw, with contributions from Asheer Malhotra.  Microsoft released its monthly security update Tuesday, disclosing 78 vulnerabilities in the company’s various software, hardware and firmware offerings.   This month’s release is particularly notable because there are only...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Vulnerability Spotlight: Use-after-free vulnerability in Microsoft Excel could lead to code execution

October 12, 2021, 12:48 pm

≫ Next: Vulnerability Spotlight: Code execution vulnerabilities in Nitro Pro PDF

≪ Previous: Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities

$

0

0

Marcin “Icewall” Noga of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.  Cisco Talos recently discovered a use-after-free vulnerability in the ConditionalFormatting functionality of Microsoft Office Excel 2019 that could allow an attacker to execute arbitrary code on the...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Vulnerability Spotlight: Code execution vulnerabilities in Nitro Pro PDF

October 14, 2021, 10:17 am

≫ Next: Threat Source newsletter (Oct. 14, 2021)

≪ Previous: Vulnerability Spotlight: Use-after-free vulnerability in Microsoft Excel could lead to code execution

$

0

0

A Cisco Talos team member discovered these vulnerabilities. Blog by Jon Munshaw.  Cisco Talos recently discovered multiple vulnerabilities in the Nitro Pro PDF reader that could allow an attacker to execute code in the context of the application.  Nitro Pro PDF is part of Nitro Software’s...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Threat Source newsletter (Oct. 14, 2021)

October 14, 2021, 11:00 am

≫ Next: Talos Takes Ep. #73 (NCSAM edition): Fight the phish from land, sea and air

≪ Previous: Vulnerability Spotlight: Code execution vulnerabilities in Nitro Pro PDF

$

0

0

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.   It's still Cybersecurity Awareness Month, and what better way to celebrate by patching and then patching some more?  This week was Microsoft Patch Tuesday, which only included two critical vulnerabilities, but still...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Talos Takes Ep. #73 (NCSAM edition): Fight the phish from land, sea and air

October 15, 2021, 8:07 am

≫ Next: Threat Roundup for October 8 to October 15

≪ Previous: Threat Source newsletter (Oct. 14, 2021)

$

0

0

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. Most people may think of spam as being the classic email promising that you've won the lottery or some great prize,...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

---

Threat Roundup for October 8 to October 15

October 15, 2021, 2:08 pm

≫ Next: Vulnerability Spotlight: Multiple vulnerabilities in ZTE MF971R LTE router

≪ Previous: Talos Takes Ep. #73 (NCSAM edition): Fight the phish from land, sea and air

$

0

0

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 8 and Oct. 15. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Vulnerability Spotlight: Multiple vulnerabilities in ZTE MF971R LTE router

October 18, 2021, 12:04 pm

≫ Next: Beers with Talos, Ep. #110: The 10 most-exploited vulnerabilities this year (You won't believe No. 6!)

≪ Previous: Threat Roundup for October 8 to October 15

$

0

0

Marcin “Icewall” Noga of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.  Cisco Talos recently discovered multiple vulnerabilities in the ZTE MF971R LTE portable router.  The MF971R is a portable router with Wi-Fi support and works as an LTE/GSM modem. An attacker could...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Beers with Talos, Ep. #110: The 10 most-exploited vulnerabilities this year (You won't believe No. 6!)

October 19, 2021, 1:13 pm

≫ Next: Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India

≪ Previous: Vulnerability Spotlight: Multiple vulnerabilities in ZTE MF971R LTE router

$

0

0

Beers with Talos (BWT) Podcast episode No. 110 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify  StitcherIf iTunes and Google Play aren't your thing, click here. We mainly spend this episode doing some catching up...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India

October 19, 2021, 5:01 pm

≫ Next: Threat Source newsletter (Oct. 21, 2021)

≪ Previous: Beers with Talos, Ep. #110: The 10 most-exploited vulnerabilities this year (You won't believe No. 6!)

$

0

0

Cisco Talos recently discovered a threat actor using political and government-themed malicious domains to target entities in India and Afghanistan.These attacks use dcRAT and QuasarRAT for Windows delivered via malicious documents exploiting CVE-2017-11882 — a memory corruption vulnerability in...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Threat Source newsletter (Oct. 21, 2021)

October 21, 2021, 11:00 am

≫ Next: Threat Roundup for October 15 to October 22

≪ Previous: Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India

$

0

0

 Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.   We're writing this on Wednesday for PTO reasons, so apologies if we miss any major news that happens after Wednesday afternoon.  Above, you can watch our awesome live stream from Monday with Brad Garnett from...

[[ This is only the beginning! Please visit the blog for the complete entry ]]