Threat Source Newsletter (Nov. 18, 2021)

November 18, 2021, 11:00 am

≫ Next: Talos Takes Ep. #77: How to connect to (and safely use) public WiFi

≪ Previous: Vulnerability Spotlight: Multiple code execution vulnerabilities in LibreCAD

$

0

0

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.   This is our last newsletter before Thanksgiving in the U.S. next week, so now's as good of a time as any to remind you: If a deal seems too good to be true, it probably is.  To prep online shoppers for the upcoming...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

---

Talos Takes Ep. #77: How to connect to (and safely use) public WiFi

November 19, 2021, 8:18 am

≫ Next: Beers with Talos, Ep. #111: We say goodbye to Craig and his killer robots

≪ Previous: Threat Source Newsletter (Nov. 18, 2021)

$

0

0

  By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. Whenever we walk into a bar or restaurant, it's almost a given that we're going to ask the bartender or server:...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Beers with Talos, Ep. #111: We say goodbye to Craig and his killer robots

November 19, 2021, 8:45 am

≫ Next: Threat Roundup for November 12 to November 19

≪ Previous: Talos Takes Ep. #77: How to connect to (and safely use) public WiFi

$

0

0

Beers with Talos (BWT) Podcast episode No. 111 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts  Google Podcasts  Spotify  StitcherIf iTunes and Google Play aren't your thing, click here. We apologize for holding onto this...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Threat Roundup for November 12 to November 19

November 19, 2021, 11:31 am

≫ Next: Vulnerability Spotlight: PHP deserialize vulnerability in CloudLinux Imunity360 could lead to arbitrary code execution

≪ Previous: Beers with Talos, Ep. #111: We say goodbye to Craig and his killer robots

$

0

0

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 12 and Nov. 19. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Vulnerability Spotlight: PHP deserialize vulnerability in CloudLinux Imunity360 could lead to arbitrary code execution

November 22, 2021, 9:16 am

≫ Next: Back from the dead: Emotet re-emerges, begins rebuilding to wrap up 2021

≪ Previous: Threat Roundup for November 12 to November 19

$

0

0

Marcin “Icewall” Noga of Cisco Talos. Blog by Jon Munshaw.  Cisco Talos recently discovered a vulnerability in the Ai-Bolit functionality of CloudLinux Inc Imunify360 that could lead to arbitrary code execution.  Imunify360 is a security platform for web-hosting servers that allows users...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Back from the dead: Emotet re-emerges, begins rebuilding to wrap up 2021

November 22, 2021, 5:01 am

≫ Next: Vulnerability Spotlight: Multiple vulnerabilities in Advantech R-SeeNet

≪ Previous: Vulnerability Spotlight: PHP deserialize vulnerability in CloudLinux Imunity360 could lead to arbitrary code execution

$

0

0

Executive summary Emotet has been one of the most widely distributed threats over the past several years. It has typically been observed being distributed via malicious spam email campaigns, and often leads to additional malware infections as it provides threat actors with an initial foothold in an...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Vulnerability Spotlight: Multiple vulnerabilities in Advantech R-SeeNet

November 22, 2021, 8:44 am

≫ Next: A review of Azure Sphere vulnerabilities: Unsigned code execs, kernel bugs, escalation chains and firmware downgrades

≪ Previous: Back from the dead: Emotet re-emerges, begins rebuilding to wrap up 2021

$

0

0

The Talos vulnerability research team discovered these vulnerabilities. Blog by Jon Munshaw.  Cisco Talos recently discovered multiple vulnerabilities in the Advantech R-SeeNet monitoring software.  R-SeeNet is the software system used for monitoring Advantech routers. It continuously...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

A review of Azure Sphere vulnerabilities: Unsigned code execs, kernel bugs, escalation chains and firmware downgrades

November 22, 2021, 11:05 am

≫ Next: Attackers exploiting zero-day vulnerability in Windows Installer — Here’s what you need to know and Talos’ coverage

≪ Previous: Vulnerability Spotlight: Multiple vulnerabilities in Advantech R-SeeNet

$

0

0

Summary of all the vulnerabilities reported by Cisco Talos in Microsoft Azure Sphere By Claudio Bozzato and Lilith [>_>]. In May 2020, Microsoft kicked off the Azure Sphere Security Research Challenge, a three-month initiative aimed at finding bugs in Azure Sphere. In the first three months,...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

---

Attackers exploiting zero-day vulnerability in Windows Installer — Here’s what you need to know and Talos’ coverage

November 23, 2021, 10:54 am

≫ Next: Talos Takes Ep. #78: Attackers would love to buy you a non-existent PS5 this holiday season

≪ Previous: A review of Azure Sphere vulnerabilities: Unsigned code execs, kernel bugs, escalation chains and firmware downgrades

$

0

0

Cisco Talos is releasing new SNORTⓇ rules to protect against the exploitation of a zero-day elevation of privilege vulnerability in Microsoft Windows Installer. This vulnerability allows an attacker with a limited user account to elevate their privileges to become an administrator. This...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Talos Takes Ep. #78: Attackers would love to buy you a non-existent PS5 this holiday season

November 24, 2021, 6:01 am

≫ Next: An Azure Sphere kernel exploit — or how I learned to stop worrying and love the IoT

≪ Previous: Attackers exploiting zero-day vulnerability in Windows Installer — Here’s what you need to know and Talos’ coverage

$

0

0

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. We know this episode comes around every year, but people keep falling for scams, so we have to remind people how to...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

An Azure Sphere kernel exploit — or how I learned to stop worrying and love the IoT

November 29, 2021, 7:00 am

≫ Next: Case Study: Catching threats ahead of time with a penetration test from the Cisco Talos Incident Response Red Team

≪ Previous: Talos Takes Ep. #78: Attackers would love to buy you a non-existent PS5 this holiday season

$

0

0

By Claudio Bozzato and Lilith [^.^];. As part of our continued research into Microsoft Azure Sphere, there are two vulnerabilities we discovered that we feel are particularly dangerous. For a full rundown of the 31 vulnerabilities we’ve discovered over the past year, check out our full recap...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Case Study: Catching threats ahead of time with a penetration test from the Cisco Talos Incident Response Red Team

November 30, 2021, 8:25 am

≫ Next: Cisco named leader in Incident Response Services

≪ Previous: An Azure Sphere kernel exploit — or how I learned to stop worrying and love the IoT

$

0

0

By Brad Garnett, Miguel Alvarez Esmoris, Terryn Valikodath and Bob Doyle.  As we mentioned in a previous case study, relationships are tried and tested during incident response. So, when a customer came to Cisco Talos Incident Response with concerns about their public-facing website, CTIR knew...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Cisco named leader in Incident Response Services

November 30, 2021, 8:58 am

≫ Next: Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution

≪ Previous: Case Study: Catching threats ahead of time with a penetration test from the Cisco Talos Incident Response Red Team

$

0

0

By Brad Garnett. It has been more than two years already since Cisco Incident Response became a part of the Talos family. Since then, my team has continued a journey to simplify our offering for consumption and make incident response the ultimate team sport.  That is why I could not be more...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution

December 1, 2021, 5:23 am

≫ Next: Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension

≪ Previous: Cisco named leader in Incident Response Services

$

0

0

Marcin Towalski of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.  Cisco Talos recently discovered an exploitable use-after-free vulnerability in Google Chrome.   Google Chrome is a cross-platform web browser — and Chromium is the open-source version of the browser...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension

December 2, 2021, 5:19 am

≫ Next: Threat Source Newsletter (Dec. 2, 2021)

≪ Previous: Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution

$

0

0

By Tiago Pereira. Talos recently observed a malicious campaign offering fake installers of popular software as bait to get users to execute malware on their systems. This campaign includes a set of malware distribution campaigns that started in late 2018 and have targeted mainly Canada, along...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

---

Threat Source Newsletter (Dec. 2, 2021)

December 2, 2021, 11:00 am

≫ Next: Talos Takes Ep. #79: Emotet's back with the worst type of holiday present

≪ Previous: Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension

$

0

0

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.   The Thanksgiving holiday in the U.S. didn't slow us down at all, even though we were all still trying to sleep off the food coma from the long weekend. But we came back this week with lots of fun content. Cisco received...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Talos Takes Ep. #79: Emotet's back with the worst type of holiday present

December 3, 2021, 7:46 am

≫ Next: Threat Roundup for November 26 to December 3

≪ Previous: Threat Source Newsletter (Dec. 2, 2021)

$

0

0

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. Emotet is back, and it brought the worst possible holiday present (just in time for peak spam season, too!). We...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Threat Roundup for November 26 to December 3

December 3, 2021, 12:03 pm

≫ Next: Cisco recognized by Forrester as cybersecurity incident response services provider

≪ Previous: Talos Takes Ep. #79: Emotet's back with the worst type of holiday present

$

0

0

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 26 and Dec. 3. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Cisco recognized by Forrester as cybersecurity incident response services provider

December 7, 2021, 6:00 am

≫ Next: Threat Source Newsletter (Dec. 9, 2021)

≪ Previous: Threat Roundup for November 26 to December 3

$

0

0

By Brad Garnett.  Cisco Talos Incident Response is proud to announce that Forrester has recognized us by including Cisco in the new Forrester report “Now Tech: Cybersecurity Incident Response Services, Q4 2021.” The Forrester report provides an overview of 36 Cybersecurity Incident Response...

[[ This is only the beginning! Please visit the blog for the complete entry ]]

Threat Source Newsletter (Dec. 9, 2021)

December 9, 2021, 11:00 am

≫ Next: Threat Roundup for December 3 to December 10

≪ Previous: Cisco recognized by Forrester as cybersecurity incident response services provider

$

0

0

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.   The good news keeps rolling in for our Incident Response team, who received another accolade by being featured in Forrester's recent quarterly report on the incident readiness industry. This comes on the heels of the team...

[[ This is only the beginning! Please visit the blog for the complete entry ]]