Windows - Security Ticks

Chainsaw: Open-source tool for hunting through Windows forensic artefacts

Don't miss, GitHub, News, open source, software, Windows, WithSecure / SecurityTicks

Chainsaw: Open-source tool for hunting through Windows forensic artefacts 2025-01-13 at 06:34 By Help Net Security Chainsaw is an open-source first-response tool for quickly detecting threats in Windows forensic artefacts, including Event Logs and the MFT file. It enables fast keyword searches through event logs and identifies threats using built-in Sigma detection and custom detection […]

React to this headline:

Chainsaw: Open-source tool for hunting through Windows forensic artefacts Read More »

Job-seeking devs targeted with fake CrowdStrike offer via email

CrowdStrike, cryptojacking, cybersecurity jobs, Don't miss, Hot stuff, News, scams, Windows / SecurityTicks

Job-seeking devs targeted with fake CrowdStrike offer via email 2025-01-10 at 14:33 By Zeljka Zorz Cryptojackers are impersonating Crowdstrike via email to get developers to unwittingly install the XMRig cryptocurrency miner on their Windows PC, the company has warned. The email Crowdstrike has a web page where job hunters can see which positions are open

React to this headline:

Job-seeking devs targeted with fake CrowdStrike offer via email Read More »

January 2025 Patch Tuesday forecast: Changes coming in cybersecurity guidance

Adobe, Don't miss, Expert analysis, Hot stuff, Ivanti, Microsoft, Mozilla, News, Patch Tuesday, Windows / SecurityTicks

January 2025 Patch Tuesday forecast: Changes coming in cybersecurity guidance 2025-01-10 at 09:45 By Help Net Security Welcome to 2025 and a new year of patch excitement! In my December article, I talked about Microsoft’s Secure Future Initiative (SFI) and how it manifested in many of the Microsoft products released in 2024. While this security

React to this headline:

January 2025 Patch Tuesday forecast: Changes coming in cybersecurity guidance Read More »

IT Vulnerability Report: Cleo, Windows Flaws Under Attack

Cleo, IT Vulnerability, vulnerability, Windows / SecurityTicks

IT Vulnerability Report: Cleo, Windows Flaws Under Attack 2024-12-16 at 12:18 By daksh sharma Cyble Research and Intelligence Labs (CRIL) researchers investigated 16 IT vulnerabilities and 11 dark web exploits in the week ended Dec. 10, including actively exploited vulnerabilities in Cleo managed file transfer (MFT) software and Microsoft Windows. Other vulnerabilities analyzed by Cyble

React to this headline:

IT Vulnerability Report: Cleo, Windows Flaws Under Attack Read More »

Microsoft fixes exploited zero-day (CVE-2024-49138)

0-day, CVE, Don't miss, enterprise, Hot stuff, Immersive Labs, Microsoft, News, Patch Tuesday, Tenable, Windows, Windows Server / SecurityTicks

Microsoft fixes exploited zero-day (CVE-2024-49138) 2024-12-10 at 23:04 By Zeljka Zorz On December 2024 Patch Tuesday, Microsoft resolved 71 vulnerabilities in a variety of its products, including a zero-day (CVE-2024-49138) that’s been exploited by attackers in the wild to execute code with higher privileges. CVE-2024-49138 exploited by attackers CVE-2024-49138 stems from a heap-based buffer overflow

React to this headline:

Microsoft fixes exploited zero-day (CVE-2024-49138) Read More »

Windows, macOS users targeted with crypto-and-info-stealing malware

Artificial Intelligence, Cado Security, Cryptocurrency, Don't miss, Hot stuff, macOS, Malware, News, social engineering, video conferencing, Windows / SecurityTicks

Windows, macOS users targeted with crypto-and-info-stealing malware 2024-12-06 at 14:05 By Zeljka Zorz Downloading anything from the internet is a gamble these days: you might think that you are downloading an innocuous app from a legitimate firm but thanks to clever misuse of AI and some social engineering, you can end up with information and

React to this headline:

Windows, macOS users targeted with crypto-and-info-stealing malware Read More »

December 2024 Patch Tuesday forecast: The secure future initiative impact

Adobe, Don't miss, Expert analysis, Hot stuff, Microsoft, Mozilla, News, opinion, Patch Tuesday, predictions, Windows / SecurityTicks

December 2024 Patch Tuesday forecast: The secure future initiative impact 2024-12-06 at 08:04 By Help Net Security It seems like 2024 just started, but the final Patch Tuesday of the year is almost here! In retrospect, it has been a busy year with continued Windows 11 releases, the new Server 2025 release, and all the

React to this headline:

December 2024 Patch Tuesday forecast: The secure future initiative impact Read More »

Cybercriminals used a gaming engine to create undetectable malware loader

Check Point, Don't miss, GitHub, Hot stuff, Linux, macOS, Malware, malware detection, News, software development, Windows / SecurityTicks

Cybercriminals used a gaming engine to create undetectable malware loader 2024-11-27 at 20:33 By Zeljka Zorz Threat actors are using an ingenious new way for covertly delivering malware to a wide variety of operating systems and platforms: they have created a malware loader that uses Godot Engine, an open-source game engine. The loader – dubbed

React to this headline:

Cybercriminals used a gaming engine to create undetectable malware loader Read More »

Researchers reveal exploitable flaws in corporate VPN clients

AmberWolf, CVE, Don't miss, Hot stuff, macOS, News, Palo Alto Networks, SonicWall, VPN, vulnerability, Windows / SecurityTicks

Researchers reveal exploitable flaws in corporate VPN clients 2024-11-26 at 17:33 By Zeljka Zorz Researchers have discovered vulnerabilities in the update process of Palo Alto Networks (CVE-2024-5921) and SonicWall (CVE-2024-29014) corporate VPN clients that could be exploited to remotely execute code on users’ devices. CVE-2024-5921 CVE-2024-5921 affects various versions of Palo Alto’s GlobalProtect App on

React to this headline:

Researchers reveal exploitable flaws in corporate VPN clients Read More »

RomCom hackers chained Firefox and Windows zero-days to deliver backdoor

0-day, APT, backdoor, Don't miss, ESET, exploit, Firefox, Hot stuff, News, Russian Federation, Windows / SecurityTicks

RomCom hackers chained Firefox and Windows zero-days to deliver backdoor 2024-11-26 at 12:18 By Zeljka Zorz Russia-aligned APT group RomCom was behind attacks that leveraged CVE-2024-9680, a remote code execution flaw in Firefox, and CVE-2024-49039, an elevation of privilege vulnerability in Windows Task Scheduler, as zero-days earlier this year. “Chaining together two zero-day vulnerabilities armed

React to this headline:

RomCom hackers chained Firefox and Windows zero-days to deliver backdoor Read More »

Microsoft asks Windows Insiders to try out the controversial Recall feature

Artificial Intelligence, data security, Don't miss, endpoint management, enterprise, Hot stuff, Microsoft, News, Privacy, Windows / SecurityTicks

Microsoft asks Windows Insiders to try out the controversial Recall feature 2024-11-25 at 16:33 By Zeljka Zorz Participants of the Windows Insider Program that have a Qualcomm Snapdragon-powered Copilot+ PC can now try out Recall, the infamous snapshot-taking, AI-powered feature that was met with much criticism when it was unveiled earlier this year. “We heard

React to this headline:

Microsoft asks Windows Insiders to try out the controversial Recall feature Read More »

Microsoft announces new and improved Windows 11 security features

Application Security, Data Protection, Don't miss, Hot stuff, Microsoft, News, privileged accounts, Windows / SecurityTicks

Microsoft announces new and improved Windows 11 security features 2024-11-19 at 21:04 By Zeljka Zorz Microsoft has implemented some and is working on delivering several other security-related features and improvements for Windows 11. Administrator protection will allow users to make system changes on their PCs without having administrator rights (that can be abused by attackers

React to this headline:

Microsoft announces new and improved Windows 11 security features Read More »

Microsoft plans to boot security vendors out of the Windows kernel

antivirus, cyber resilience, Don't miss, Hot stuff, News, security testing, Windows / SecurityTicks

Microsoft plans to boot security vendors out of the Windows kernel 2024-11-19 at 20:48 By Zeljka Zorz Microsoft has announced the Windows Resiliency Initiative, aimed at avoiding a repeat of the prolonged worldwide IT outage caused by a buggy CrowdStrike update that took down millions of Windows machines and rendered them remotely unfixable. As part

React to this headline:

Microsoft plans to boot security vendors out of the Windows kernel Read More »

How a Windows zero-day was exploited in the wild for months (CVE-2024-43451)

ClearSky Cyber Security, CVE, Don't miss, Hot stuff, Malware, News, spear-phishing, Ukraine, vulnerability, Windows, Windows Server / SecurityTicks

How a Windows zero-day was exploited in the wild for months (CVE-2024-43451) 2024-11-14 at 12:02 By Zeljka Zorz CVE-2024-43451, a Windows zero-day vulnerability for which Microsoft released a fix on November 2024 Patch Tuesday, has been exploited since at least April 2024, ClearSky researchers have revealed. About the vulnerability CVE-2024-43451 affects all supported Windows versions

React to this headline:

How a Windows zero-day was exploited in the wild for months (CVE-2024-43451) Read More »

Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039)

0-day, Active Directory, CVE, Don't miss, Hot stuff, Immersive Labs, Ivanti, Microsoft, Microsoft Defender, News, OpenSSL, Patch Tuesday, security update, Tenable, Trend Micro, vulnerability, Windows, Windows Server / SecurityTicks

Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039) 2024-11-12 at 23:03 By Zeljka Zorz November 2024 Patch Tuesday is here, and Microsoft has dropped fixes for 89 new security issues in its various products, two of which – CVE-2024-43451 and CVE-2024-49039 – are actively exploited by attackers. The exploited vulnerabilities (CVE-2024-43451, CVE-2024-49039) CVE-2024-43451 is yet another

React to this headline:

Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039) Read More »

November 2024 Patch Tuesday forecast: New servers arrive early

apple, Don't miss, Expert analysis, Google, Hot stuff, Ivanti, Microsoft, Mozilla, News, opinion, Patch Tuesday, predictions, Windows / SecurityTicks

November 2024 Patch Tuesday forecast: New servers arrive early 2024-11-11 at 08:03 By Help Net Security Microsoft followed their October precedent set with Windows 11 24H2 and announced Microsoft Server 2025 on the first of November. We were expecting the official announcement at Microsoft Ignite near the end of the month, but with the early

React to this headline:

November 2024 Patch Tuesday forecast: New servers arrive early Read More »

GoZone ransomware accuses and threatens victims

Don't miss, Elastio, Hot stuff, News, Ransomware, SonicWall, Windows / SecurityTicks

GoZone ransomware accuses and threatens victims 2024-11-06 at 13:06 By Zeljka Zorz A new ransomware dubbed GoZone is being leveraged by attackers that don’t seem to be very greedy: they are asking the victims to pay just $1,000 in Bitcoin if they want their files decrypted. The GoZone HTML ransom note (Source: SonicWall) The ransom

React to this headline:

GoZone ransomware accuses and threatens victims Read More »

Patching problems: The “return” of a Windows Themes spoofing vulnerability

0-day, 0patch, ACROS Security, Data leak, Don't miss, Hot stuff, micropatch, News, Windows / SecurityTicks

Patching problems: The “return” of a Windows Themes spoofing vulnerability 2024-10-29 at 12:18 By Zeljka Zorz Despite two patching attempts, a security issue that may allow attackers to compromise Windows user’s NTLM (authentication) credentials via a malicious Windows themes file still affects Microsoft’s operating system, 0patch researchers have discovered. The path to discovery The story

React to this headline:

Patching problems: The “return” of a Windows Themes spoofing vulnerability Read More »

Fake Google Meet pages deliver infostealers

Don't miss, Hot stuff, macOS, Malware, News, Proofpoint, Sekoia.io, social engineering, video conferencing, Windows / SecurityTicks

Fake Google Meet pages deliver infostealers 2024-10-17 at 14:47 By Zeljka Zorz Users of the Google Meet video communication service have been targeted by cyber crooks using the ClickFix tactic to infect them with information-stealing malware. Fake Google Meet video conference page with malicious ClickFix pop-up (Source: Sekoia) “The ClickFix tactic deceives users into downloading

React to this headline:

Fake Google Meet pages deliver infostealers Read More »

Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572)

0-day, CVE, Don't miss, Hot stuff, Microsoft, NetSPI, News, Patch Tuesday, security update, Tenable, Trend Micro, vulnerability, Windows / SecurityTicks

Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572) 2024-10-08 at 22:49 By Zeljka Zorz For October 2024 Patch Tuesday, Microsoft has released fixes for 117 security vulnerabilities, including two under active exploitation: CVE-2024-43573, a spoofing bug affecting the Windows MSHTML Platform, and CVE-2024-43572, a remote code execution flaw in the Microsoft Management Console

React to this headline:

Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572) Read More »