Windows

Researchers unearth MotW bypass technique used by threat actors for years

Don't miss, Elastic, Features, malware detection, Microsoft, News, security controls, vulnerability, Windows /

Researchers unearth MotW bypass technique used by threat actors for years 2024-08-06 at 14:31 By Zeljka Zorz Threat actors have been abusing a bug in how Windows handles LNK files with non-standard target paths and internal structures to prevent in-built protections from stopping malicious payloads and trick users into running them. “We identified multiple samples […]

Researchers unearth MotW bypass technique used by threat actors for years Read More »

Some good may come out of the CrowdStrike outage

Bitdefender, CrowdStrike, Don't miss, Endpoint Security, Fortinet, fraud, Hot stuff, Malware, Microsoft, News, SecureWorks, Trellix, UpGuard, Windows /

Some good may come out of the CrowdStrike outage 2024-07-29 at 19:31 By Zeljka Zorz Estimated financial losses due to the recent massive IT outage triggered by the faulty CrowdStrike update are counted in billions, but the unfortunate incident is having several positive effects, as well. Some silver linings As CrowdStrike was forced to explain,

Some good may come out of the CrowdStrike outage Read More »

Microsoft releases tool to speed up recovery of systems borked by CrowdStrike update

CrowdStrike, Don't miss, Hot stuff, Microsoft, News, Orca Security, phishing, tech support scam, Trend Micro, virtualization, Windows, Windows Server /

Microsoft releases tool to speed up recovery of systems borked by CrowdStrike update 2024-07-22 at 15:16 By Zeljka Zorz By now, most people are aware of – or have been personally affected by – the largest IT outage the world have ever witnessed, courtesy of a defective update for Crowdstrike Falcon Sensors that threw Windows

Microsoft releases tool to speed up recovery of systems borked by CrowdStrike update Read More »

Threat Actors Exploit Recent CrowdStrike Outage to Ramp Up Suspicious Domain Creation

CrowdStrike, Malware, Threat Actor, Windows /

Threat Actors Exploit Recent CrowdStrike Outage to Ramp Up Suspicious Domain Creation 2024-07-20 at 19:46 By dakshsharma16 On July 19th, 2024, CrowdStrike, a leading cybersecurity provider of advanced end-point security detection and protection solutions, released a sensor configuration update to Windows systems. This update contained a logic error that resulted in system crashes and Blue

Threat Actors Exploit Recent CrowdStrike Outage to Ramp Up Suspicious Domain Creation Read More »

CrowdStrike Provides Remediation Guidance After Software Update Causes Worldwide IT Chaos

CrowdStrike, Featured, Incident Response, outage, Windows /

CrowdStrike Provides Remediation Guidance After Software Update Causes Worldwide IT Chaos 2024-07-20 at 17:01 By Mike Lennon CrowdStrike on Saturday provided technical information and remediation guidance to help organizations impacted by the faulty software update that trigged massive IT outages across the globe on Friday.   The post CrowdStrike Provides Remediation Guidance After Software Update

CrowdStrike Provides Remediation Guidance After Software Update Causes Worldwide IT Chaos Read More »

CrowdStrike Says Logic Error Caused Windows BSOD Chaos

BSOD, CrowdStrike, disaster recovery, Falcon, Incident Response, Windows /

CrowdStrike Says Logic Error Caused Windows BSOD Chaos 2024-07-20 at 08:16 By Ryan Naraine CrowdStrike says a routine sensor configuration update pushed to Windows OS triggered a logic error that blue-screened computers worldwide. The post CrowdStrike Says Logic Error Caused Windows BSOD Chaos appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS

CrowdStrike Says Logic Error Caused Windows BSOD Chaos Read More »

Update: Worldwide IT outage due to buggy Crowdstrike update

BH Consulting, Brian Honan, CrowdStrike, cyber resilience, disruption, Don't miss, ESET, Hot stuff, Hunter Strategy, News, Performanta, SANS ISC, Windows /

Update: Worldwide IT outage due to buggy Crowdstrike update 2024-07-19 at 19:46 By Zeljka Zorz The world is 16+ hours into what looks like the biggest IT outage in history, triggered by a defective update for Crowdstrike endpoint security software for Windows machines. The price of both Crowdstrike’s and Microsoft’s shares tumbled down as a

Update: Worldwide IT outage due to buggy Crowdstrike update Read More »

Faulty CrowdStrike update takes out Windows machines worldwide

Australia, CrowdStrike, Don't miss, Endpoint Security, Europe, Hot stuff, News, UK, USA, Windows /

Faulty CrowdStrike update takes out Windows machines worldwide 2024-07-19 at 11:31 By Zeljka Zorz Thousands and possibly millions of Windows computers and servers worldwide have been made inoperable by a faulty update of Crowdstrike Falcon Sensors, and the outage affected transport, broadcast, financial, retail and other organizations have been affected in Europe, Australia, the US

Faulty CrowdStrike update takes out Windows machines worldwide Read More »

Void Banshee APT exploited “lingering Windows relic” in zero-day attacks

APT, Check Point, CVE, Don't miss, Hot stuff, Internet Explorer, News, spear-phishing, Trend Micro, Windows /

Void Banshee APT exploited “lingering Windows relic” in zero-day attacks 2024-07-16 at 16:46 By Zeljka Zorz The zero-day exploit used to leverage CVE-2024-38112, a recently patched Windows MSHTML vulnerability, was wielded by an APT group dubbed Void Banshee to deliver malware to targets in North America, Europe, and Southeast Asia, threat hunters with Trend Micro’s

Void Banshee APT exploited “lingering Windows relic” in zero-day attacks Read More »

Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)

0-day, Action1, Automox, CVE, Don't miss, Hot stuff, Microsoft, MS SQL Server, News, Patch Tuesday, security update, Trend Micro, virtualization, vulnerability, Windows /

Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112) 2024-07-09 at 22:31 By Zeljka Zorz For July 2024 Patch Tuesday, Microsoft has released security updates and patches that fix 142 CVEs, including two exploited zero-days (CVE-2024-38080, CVE-2024-38112) in Windows Hyper-V and Windows MSHTML Platform (respectively). Zero-days exploited in the wild (CVE-2024-38080, CVE-2024-38112) CVE-2024-38080 is a

Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112) Read More »

Clever macOS malware delivery campaign targets cryptocurrency users

Don't miss, Hot stuff, macOS, Malware, News, Recorded Future, Windows /

Clever macOS malware delivery campaign targets cryptocurrency users 2024-06-19 at 14:16 By Zeljka Zorz Cryptocurrency users are being targeted with legitimate-looking but fake apps that deliver information-stealing malware instead, Recorder Future’s researchers are warning. The threat actor behind this complex scheme is going after both Windows and Mac users, and leverages social media and messaging

Clever macOS malware delivery campaign targets cryptocurrency users Read More »

Microsoft delays Windows Recall rollout, more security testing needed

data security, Don't miss, Hot stuff, Microsoft, News, Privacy, Windows /

Microsoft delays Windows Recall rollout, more security testing needed 2024-06-14 at 15:46 By Zeljka Zorz Microsoft is delaying the release of Recall, a controversial Windows 11 feature that will allow users to search their computer for specific content that has previously been viewed by them. A preview of Recall should have been broadly available on

Microsoft delays Windows Recall rollout, more security testing needed Read More »

PHP command injection flaw exploited to deliver ransomware (CVE-2024-4577)

CVE, Devcore, Don't miss, exploit, Hot stuff, Imperva, News, PHP, Ransomware, vulnerability, WatchTowr, Windows /

PHP command injection flaw exploited to deliver ransomware (CVE-2024-4577) 2024-06-13 at 15:01 By Zeljka Zorz An OS command injection vulnerability in Windows-based PHP (CVE-2024-4577) in CGI mode is being exploited by the TellYouThePass ransomware gang. Imperva says the attacks started on June 8, two days after the PHP development team pushed out fixes, and one

PHP command injection flaw exploited to deliver ransomware (CVE-2024-4577) Read More »

Windows Recall will be opt-in and the data more secure, Microsoft says

data security, Don't miss, Encryption, Hot stuff, Microsoft, News, Privacy, Windows /

Windows Recall will be opt-in and the data more secure, Microsoft says 2024-06-07 at 22:02 By Zeljka Zorz The insistent public complaints and proof-of-concept tools have have borne fruit: Microsoft has realized that the security of its recently previewed Windows Recall feature leaves much to be desired, and has announced important changes. About Windows Recall

Windows Recall will be opt-in and the data more secure, Microsoft says Read More »

June 2024 Patch Tuesday forecast: Multiple announcements from Microsoft

Adobe, apple, cybersecurity, Don't miss, Hot stuff, Microsoft, Mozilla, News, opinion, Patch Tuesday, predictions, security update, Windows /

June 2024 Patch Tuesday forecast: Multiple announcements from Microsoft 2024-06-07 at 08:16 By Help Net Security May 2024 Patch Tuesday was unusual because we had security updates from Adobe, Apple, Google, Mozilla, and Microsoft on the same day. While individually from each vendor, the updates weren’t that large, managing them together was more challenging. On

June 2024 Patch Tuesday forecast: Multiple announcements from Microsoft Read More »

TotalRecall shows how easily data collected by Windows Recall can be stolen

Artificial Intelligence, data security, data theft, Don't miss, GitHub, Hot stuff, Microsoft, News, PoC, Privacy, software, Windows /

TotalRecall shows how easily data collected by Windows Recall can be stolen 2024-06-05 at 13:16 By Zeljka Zorz Ethical hacker Alexander Hagenah has created TotalRecall, a tool that demonstrates how malicious individuals could abuse Windows’ newly announced Recall feature to steal sensitive information. TotalRecall results (Source: Alexander Hagenah) Copilot+ Recall and its security pitfalls On

TotalRecall shows how easily data collected by Windows Recall can be stolen Read More »

Windows’ new Recall feature: A privacy and security nightmare?

data security, Don't miss, Hot stuff, Microsoft, News, Privacy, Windows /

Windows’ new Recall feature: A privacy and security nightmare? 2024-05-22 at 15:32 By Zeljka Zorz Microsoft has announced the Copilot+ line of Windows 11-powered PCs that, among other things, will have Recall, a feature that takes screenshots every few seconds, encrypts them, saves them, and leverages AI to allow users to search through them for

Windows’ new Recall feature: A privacy and security nightmare? Read More »

BLint: Open-source tool to check the security properties of your executables

Android, AppThreat, Don't miss, GitHub, Linux, mobile apps, News, open source, programming, software, Windows /

BLint: Open-source tool to check the security properties of your executables 2024-05-14 at 07:31 By Mirko Zorz BLint is a Binary Linter designed to evaluate your executables’ security properties and capabilities, utilizing LIEF for its operations. From version 2, BLint can also produce Software Bill-of-Materials (SBOM) for compatible binaries. BLint features “Several source code analysis

BLint: Open-source tool to check the security properties of your executables Read More »

CISA Warns of Windows Print Spooler Flaw After Microsoft Sees Russian Exploitation

CISA KEV, exploited, Russia, Vulnerabilities, Windows /

CISA Warns of Windows Print Spooler Flaw After Microsoft Sees Russian Exploitation 2024-04-24 at 16:16 By Ionut Arghire CISA warns organizations of a two-year-old Windows Print Spooler vulnerability being exploited in the wild. The post CISA Warns of Windows Print Spooler Flaw After Microsoft Sees Russian Exploitation appeared first on SecurityWeek. This article is an

CISA Warns of Windows Print Spooler Flaw After Microsoft Sees Russian Exploitation Read More »

Russian hackers’ custom tool exploits old Windows Print Spooler flaw (CVE-2022-38028)

0-day, APT, CVE, cyber espionage, Don't miss, exploit, Hot stuff, Microsoft, News, Windows /

Russian hackers’ custom tool exploits old Windows Print Spooler flaw (CVE-2022-38028) 2024-04-23 at 17:01 By Zeljka Zorz For nearly four years and perhaps even longer, Forest Blizzard (aka Fancy Bear, aka APT28) has been using a custom tool that exploits a specific vulnerability in Windows Print Spooler service (CVE-2022-38028). Dubbed GooseEgg, the tool is a

Russian hackers’ custom tool exploits old Windows Print Spooler flaw (CVE-2022-38028) Read More »

Scroll to Top