CyberSecurity updates
2025-01-19 14:25:56 Pacfic

FastHTTP Used in High-Speed Microsoft 365 Attacks - 2d
FastHTTP Used in High-Speed Microsoft 365 Attacks

Hackers are utilizing the FastHTTP library in Go to perform high-speed brute-force password attacks against Microsoft 365 accounts globally. The attacks are characterized by generating a large volume of HTTP requests, focusing on Azure Active Directory endpoints. This technique demonstrates how high-performance libraries can be exploited to conduct rapid credential-based attacks.

Russian Star Blizzard Targets WhatsApp Accounts - 2d
Russian Star Blizzard Targets WhatsApp Accounts

The Russian threat actor Star Blizzard has shifted its tactics, now targeting WhatsApp accounts via spear-phishing. The campaign involves messages that prompt victims to join a WhatsApp group, where their credentials can be harvested. This marks a departure from their previous methods, likely to evade detection. The primary targets are individuals involved in government, diplomacy, defense, and international relations, indicating an espionage-focused campaign. The use of social engineering via WhatsApp is a notable shift for this APT group.

MS365 Exploited in PayPal Phishing Scheme - 8d

A sophisticated phishing campaign is exploiting Microsoft 365 to target PayPal users. Attackers register free Microsoft 365 test domains to create distribution lists for sending authentic-looking PayPal money requests. This method bypasses traditional email protections, increasing the scam’s success rate. The technique leverages genuine PayPal features to deceive victims into revealing their credentials. This is not a new vulnerability, but it is a new use of the legitimate feature.

Windows LDAP RCE Vulnerability Exploit Released - 16d

A critical remote code execution (RCE) vulnerability, tracked as CVE-2024-49112, has been identified in Windows LDAP. A Proof of Concept (PoC) exploit has been released demonstrating how an attacker can send a malicious LDAP request to unpatched Domain Controllers, leading to memory corruption and remote code execution without any user interaction. This vulnerability poses a significant threat to Windows environments. This is a zero click RCE vulnerability.

Microsoft Urges .NET Devs to Update Installer Links - 19d
Microsoft Urges .NET Devs to Update Installer Links

Microsoft has issued an urgent warning to .NET developers, urging them to update their app and pipeline configurations to avoid using the ‘azureedge.net’ domain for installing .NET components. The domain will soon become unavailable due to the bankruptcy and imminent shutdown of CDN provider Edgio. This change will affect the delivery of .NET installers and archives and requires developers to update their dependencies promptly to prevent application failures. This issue highlights the fragility of relying on third-party services for critical application dependencies.

Windows 11 Security Update Bug Identified - 23d
Windows 11 Security Update Bug Identified

Microsoft has issued a warning about a bug affecting Windows 11, version 24H2, when installed via media containing the October or November 2024 security updates. This issue causes the operating system to become unable to receive further security updates. The bug does not impact devices updated through Windows Update or the Microsoft Update Catalog. Users are advised to avoid using affected installation media.

FlowerStorm platform targets Microsoft 365 accounts - 28d
FlowerStorm platform targets Microsoft 365 accounts

A new Microsoft 365 phishing-as-a-service platform called ‘FlowerStorm’ has emerged, filling the gap left by the shutdown of the Rockstar2FA cybercrime service. FlowerStorm is a sophisticated service which allows threat actors to create and deploy phishing campaigns specifically targeting Microsoft 365 accounts. This activity shows a clear increase in targeted phishing campaigns aimed at Microsoft users, which could lead to account compromise, data breaches and other associated risks. The sophisticated platform allows threat actors to automate much of the phishing process, increasing their efficiency and reach. This demonstrates the ease with which cybercriminals can set up and deploy complex phishing schemes.

Microsoft Recall Exposes Sensitive Data Screenshots - 6d
Microsoft Recall Exposes Sensitive Data Screenshots

Microsoft’s new AI feature ‘Recall’ for Copilot+ PCs stores screenshots of sensitive data, including credit cards and social security numbers, even when a ‘sensitive information’ filter is enabled. This has raised serious privacy and security concerns among users. This feature takes continuous screenshots of everything a user does. The data is stored locally but sent off to Microsoft’s LLM for analysis. This has prompted an investigation by the UK Information Commissioner’s Office. This incident highlights the potential risks of AI-powered surveillance features and the importance of user privacy.

Microsoft Azure MFA Bypass Vulnerability Discovered - 5d
Microsoft Azure MFA Bypass Vulnerability Discovered

Oasis Security researchers discovered a critical vulnerability in Microsoft’s Azure Multi-Factor Authentication (MFA) that allows attackers to bypass it, gaining unauthorized access to user accounts across various Microsoft services. This bypass affects Outlook emails, OneDrive files, Teams chats, and Azure Cloud resources. This vulnerability does not have a CVE ID, highlighting the need for immediate patching. The attack exploits a flaw in the authentication process, allowing for complete account takeover without needing valid MFA credentials.

Visual Studio Code Tunnels Abused in Cyber Espionage Campaign - 8d
Visual Studio Code Tunnels Abused in Cyber Espionage Campaign

A sophisticated cyber espionage campaign, dubbed ‘Operation Digital Eye,’ targeted business-to-business IT service providers in Southern Europe. Attackers leveraged Visual Studio Code Tunnels and Azure infrastructure for command and control, exploiting the tunnels for stealthy remote access. The campaign lasted approximately three weeks, from late June to mid-July 2024.

Secret Blizzard Espionage Campaign Targeting Storm-0156 - 13d
Secret Blizzard Espionage Campaign Targeting Storm-0156

The Russian state-sponsored group Secret Blizzard has been found to have hijacked the infrastructure of other hacking groups for its operations, with a recent campaign targeting the Pakistan-based espionage cluster Storm-0156 (also known as SideCopy, Transparent Tribe, or APT36). Secret Blizzard’s actions involved installing backdoors, collecting intelligence, and compromising target devices in regions like South Asia and Ukraine. This sophisticated espionage operation highlights the increasing complexity of cyber threats and the ability of nation-state actors to leverage the resources of other groups for their malicious activities.

Critical Windows Zero-Day Vulnerability: NTLM Hash Disclosure - 13d
Critical Windows Zero-Day Vulnerability: NTLM Hash Disclosure

A critical zero-day vulnerability impacting all supported Windows versions (7-11 and Server 2008 R2-2022) allows attackers to capture NTLM credentials by simply having a user view a malicious file in Windows Explorer. This vulnerability highlights the ongoing risk posed by zero-day exploits and the importance of robust security patches and awareness programs. The vulnerability’s simple exploit method underlines the necessity for strong security practices and endpoint protection.

Rockstar 2FA Phishing-as-a-Service Platform Targets Microsoft 365 - 19d
Rockstar 2FA Phishing-as-a-Service Platform Targets Microsoft 365

This cluster focuses on the emergence of a new phishing-as-a-service (PhaaS) platform called ‘Rockstar 2FA’. It facilitates large-scale adversary-in-the-middle (AiTM) attacks, primarily targeting Microsoft 365 credentials. This highlights the ongoing threat of credential theft and the increasing sophistication of phishing attacks, emphasizing the importance of robust multi-factor authentication (MFA) and security awareness training.

Microsoft 365 Link and Azure Cloud Security Concerns - 22d
Microsoft 365 Link and Azure Cloud Security Concerns

This news cluster focuses on the security implications of Microsoft’s shift towards a subscription-based operating model for PCs, exemplified by their Windows 365 Link. This thin client relies on Azure cloud services, raising concerns regarding data security and privacy. The reliance on cloud services centralizes access points which could create a single point of failure vulnerable to large-scale attacks.

Wazawaka's Arrest and Rockstar 2FA Phishing Platform - 19d
Wazawaka

This cluster discusses the arrest of Mikhail Pavlovich Matveev, aka Wazawaka, a notorious ransomware programmer, in Russia. He is known for developing malware and having ties to various hacking groups. This arrest is significant due to his involvement in ransomware attacks. The severity of his crimes and the potential impact of his arrest on the ransomware ecosystem are still emerging.

Mandatory MFA for Microsoft 365 Admin Center - 1d

Microsoft will enforce mandatory multi-factor authentication (MFA) for the Microsoft 365 admin center starting February 2025. All logins must pass an MFA challenge to enhance account security and prevent unauthorized access. This is a significant security enhancement aimed at mitigating the risk of account hijacking. The enforcement of MFA is a crucial step in bolstering the security posture of Microsoft 365 environments. It addresses the growing threat of credential theft and unauthorized access to sensitive administrative functions. By requiring MFA, Microsoft significantly raises the bar for attackers, making it harder for them to gain control of admin accounts.