What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2021-05-27 11:00:06 | Threat Source newsletter (May 27, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
We're used to referring to attackers as either APTs or not APTs. And when something is an APT, it sounds a lot scarier and sexier. But it's our belief that that isn't going to cut it anymore.
Therefore, we propose in a...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-05-26 05:36:08 | Elizabethan England has nothing on modern-day Russia (lien direct) | This post was authored by Warren Mercer and Vitor Ventura
The threat landscape is changing. Organizations need to defend against an ever-evolving tranche of threat actors. For a long time, the lines that distinguish state-sponsored and crimeware groups were well-defined. We believe this is...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Threat | ||
|
2021-05-24 09:47:47 | Vulnerability Spotlight: Multiple vulnerabilities in Trend Micro Home Network Security Station (lien direct) | Carl Hurd and Kelly Leuschner of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple vulnerabilities in Trend Micro's Home Network Security Station.
The Home Network Security Station is a device that monitors and protects home...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-05-21 12:27:52 | (Déjà vu) Threat Roundup for May 14 to May 21 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 14 and May 21. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-05-21 07:03:14 | Talos Takes Ep. #54: Incident response is just as much about the relationships as anything else (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
Brad Garnett, Cisco Talos Incident Response's fearless leader, joins the show this week to expound more on his recent...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Guideline | ||
|
2021-05-20 11:00:00 | Threat Source newsletter (May 20, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
We know a lot of you may be tired of "content" after RSA week. But we have some more for you!
And specifically related to RSA, Cisco Talos Incident Response has new case studies out detailing a few recent engagements...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Studies | ★★★★ | |
|
2021-05-20 10:41:46 | Vulnerability Spotlight: Heap-based buffer overflow in Google Chrome could lead to code execution (lien direct) | Marcin “Icewall” Noga of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered an exploitable heap-based buffer overflow vulnerability in Google Chrome.
Google Chrome is a cross-platform web browser - and Chromium is the open-source...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-05-19 11:54:59 | Vulnerability Spotlight: Information disclosure vulnerability in macOS SMB server (lien direct) | Aleksandar Nikolic of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered an exploitable integer overflow vulnerability in Apple macOS' SMB server that could lead to information disclosure.
Server Message Block (SMB) is a network...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability Guideline | ||
|
2021-05-19 06:51:02 | Talos is hiring for several positions - Join our world-class security organization (lien direct) | Cisco Talos continues to build an elite threat intelligence and research group, and we are looking for driven, innovative and diverse security enthusiasts to join us.
We are currently hiring for several positions, including multiple security engineer roles and a senior vulnerability...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Threat | ||
|
2021-05-18 08:06:07 | (Déjà vu) Beers with Talos Ep. #104: Supply chain has Matt hopping mad like a kangaroo (lien direct) |
Beers with Talos (BWT) Podcast episode No. 104 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here.
By Mitch Neff.
Recorded March 30,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-05-17 05:00:02 | Case Study: Incident Response is a relationship-driven business (lien direct) | Proof that incident response is "the ultimate team sport"
By Brad Garnett. Introduction
As a seasoned incident responder, and now IR business leader here at Cisco Talos Incident Response (CTIR), I have always said that incident response is the ultimate team sport. People are...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Guideline | ||
|
2021-05-14 14:12:05 | (Déjà vu) Threat Roundup for May 7 to May 14 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 7 and May 14. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
★★★ | ||
|
2021-05-14 05:26:39 | Talos Takes Ep. #53: The broader lesson of those air fryer vulnerabilities (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
It seemed like everyone on security Twitter had a joke when we disclosed a vulnerability in a WiFi-connected air fryer....
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-05-13 11:00:00 | Threat Source Newsletter (May 13, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
In case you missed the Friday news drop last week, we have an update on the Lemon Duck cryptocurrency miner. It's not as eye-catching as the ransomware attacks that make the news, but Lemon Duck's...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Ransomware | ||
|
2021-05-13 05:09:57 | Transparent Tribe APT expands its Windows malware arsenal (lien direct) | By Asheer Malhotra, Justin Thattil and Kendall McKay.
Transparent Tribe, also known as APT36 and Mythic Leopard, continues to create fake domains mimicking legitimate military and defense organizations as a core component of their operations. Cisco Talos' previous research has mainly linked this...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Malware | APT 36 | |
|
2021-05-11 12:00:51 | (Déjà vu) Vulnerability Spotlight: Code execution vulnerability in Adobe Acrobat Reader (lien direct) | Aleksandar Nikolic of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered an arbitrary code execution vulnerability in Adobe Acrobat Reader.
Adobe Acrobat Reader is one of the most popular and feature-rich PDF readers on the market....
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-05-11 11:32:55 | (Déjà vu) Microsoft Patch Tuesday for May 2021 - Snort rules and prominent vulnerabilities (lien direct) | By Jon Munshaw, with contributions from Chris Neal.
Microsoft released its monthly security update Tuesday, disclosing 55 vulnerabilities across its suite of products, the fewest in any month since January 2020.
There are only three critical vulnerabilities patched in this month, while...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-05-07 12:54:16 | Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs (lien direct) | By Caitlin Huey and Andrew Windsor with contributions from Edmund Brumaghin.
Lemon Duck continues to refine and improve upon their tactics, techniques and procedures as they attempt to maximize the effectiveness of their campaigns.Lemon Duck remains relevant as the operators begin to target...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-05-07 10:50:24 | (Déjà vu) Threat Roundup for April 30 to May 7 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 30 and May 7. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-05-07 07:05:08 | Talos Takes Ep. #52: Celebrating World Password Day by talking about getting rid of passwords (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
The internet celebrated World Password Day on Thursday. To celebrate, we had Dave Lewis on the latest episode of Talos...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-05-06 11:00:00 | Threat Source Newsletter (May 6, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
COVID-19 has changed everything about our lives - no surprise there. So it also shouldn't be shocking that it's changing the way Americans view Tax Day this year.
The deadline to file taxes is about a month later...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-05-06 08:12:55 | Vulnerability Spotlight: Use-after-free vulnerability in Foxit PDF Reader (lien direct) | Aleksandar Nikolic of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered a use-after-free vulnerability in the Foxit PDF Reader.
Foxit PDF Reader is one of the most popular PDF document readers currently available. As a complete...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-04-30 12:10:32 | (Déjà vu) Threat Roundup for April 23 to April 30 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 23 and April 30. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-30 07:00:00 | Talos Takes Ep. #51: COVID and Tax Day have perfectly aligned for spammers (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
We see tax scams every year - people offering to do your taxes for you, finding a larger return, etc.
But this...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-29 11:00:00 | Threat Source Newsletter (April 29, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
Ransomware is not just financial extortion. It is crime that transcends business, academic and geographic boundaries. Talos was proud to assist with a newly released report from the international Ransomware Task...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Ransomware | ||
|
2021-04-27 07:17:28 | Vulnerability Spotlight: Information disclosure vulnerability in the Linux Kernel (lien direct) | Lilith >_> and Claudio Bozzato of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered an information disclosure vulnerability in the Linux Kernel.
The Linux Kernel is the free and open-source core of Unix-like operating systems....
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-04-23 11:51:46 | (Déjà vu) Threat Roundup for April 16 to April 23 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 16 and April 23. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-23 06:59:01 | Talos Takes Ep. #50: Just like us, attackers are using Slack and Discord now more than ever (lien direct) |
By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
With more workers than ever going remote due to the COVID-19 pandemic, the popularity of collaboration apps like...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-22 11:00:00 | Threat Source Newsletter (April 22, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
We went viral this week! Everyone seemed to love to joke about these vulnerabilities we discovered in a WiFi-connected air fryer. An attacker, if they had physical access to the device, could exploit these...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-22 07:01:05 | Threat Advisory: Pulse Secure Connect Coverage (lien direct) | Pulse Secure announced that a critical vulnerability (CVE-2021-22893) was discovered in their VPN service "Pulse Secure Connect" in a recent security advisory.
The advisory states that, "a vulnerability was discovered under Pulse Connect Secure (PCS). This includes an authentication by-pass...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-04-22 05:17:31 | (Déjà vu) Beers with Talos Ep. #103: ICS/SCADA Security - The permanence and people problems (lien direct) | Beers with Talos (BWT) Podcast episode No. 103 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here.
By Mitch Neff.
Recorded March 2021
ICS and SCADA...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-21 10:00:00 | (Déjà vu) Vulnerability Spotlight: Code execution vulnerabilities in PrusaSlicer (lien direct) | Lilith >_> of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered two out-of-bounds write vulnerabilities in Prusa Research's PrusaSlicer. Prusa Slicer is an open-source 3-D printer slicing program forked off Slic3r that can convert various 3-D...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
★★ | ||
|
2021-04-21 05:04:42 | A year of Fajan evolution and Bloomberg themed campaigns (lien direct) | By Vanja Svajcer.
News summarySome malware campaigns are designed to spread malware to as many people as possible - while some others carefully choose their targets. Cisco Talos recently discovered a malware campaign that does not fit in any of the two categories. This actor has a relatively low...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Malware | ||
|
2021-04-20 06:00:00 | Vulnerability Spotlight: Multiple vulnerabilities in Synology DiskStation Manager (lien direct) | Claudio Bozzato of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple vulnerabilities in Synology DiskStation Manager.
DSM is the Linux-based operating system for every Synology network-attached storage device (NAS). The...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
★★ | ||
|
2021-04-19 06:56:14 | Vulnerability Spotlight: Remote code execution vulnerabilities in Cosori smart air fryer (lien direct) | Dave McDaniel of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered two code execution vulnerabilities in the Cosori smart air fryer.
The Cosori Smart Air Fryer is a WiFi-enabled kitchen appliance that cooks food with a variety of...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-16 12:52:12 | (Déjà vu) Threat Roundup for April 9 to April 16 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 9 and April 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
★★★★★ | ||
|
2021-04-16 07:53:10 | Talos Takes Ep. #49: LodaRAT keeps growing....and growing (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
Chris Neal from Talos Outreach has followed LodaRAT for years now. It's gone from a fairly small threat to a full-on...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Threat | ||
|
2021-04-15 11:00:00 | Threat Source Newsletter (April 15, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
If you missed our webinar last week, we've got you covered. We've uploaded an extended version to our YouTube page that includes the scripts used in the presentation. This video will show you how to reverse-engineer and...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-15 08:45:01 | Threat Advisory: NSA SVR Advisory Coverage (lien direct) | The U.S. National Security Agency released an advisory outlining several vulnerabilities that the Russian Foreign Intelligence Services (SVR) is exploiting in the wild. The U.S. formally attributed the recent SolarWinds supply chain attack to the SVR group in this advisory and detailed more of the...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-14 06:59:26 | Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Microsoft Azure Sphere (lien direct) | Claudio Bozzato and Lilith >_> of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos researchers recently discovered multiple vulnerabilities in Microsoft's Azure Sphere, a cloud-connected and custom SoC platform designed specifically with IoT application security...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-13 10:37:37 | (Déjà vu) Microsoft Patch Tuesday for April 2021 - Snort rules and prominent vulnerabilities (lien direct) | By Jon Munshaw, with contributions from Vanja Svajcer.
Microsoft released its monthly security update Tuesday, disclosing 108 vulnerabilities across its suite of products, the most in any month so far this year.
Four new remote code execution vulnerabilities in Microsoft Exchange Server are...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-13 07:40:12 | Vulnerability Spotlight: Multiple vulnerabilities in OpenClinic\'s GA web portal (lien direct) | Yuri Kramarz of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple vulnerabilities in OpenClinic's GA web portal. OpenClinic GA
is an open-source, fully integrated hospital management solution. The web portal allows users to manage...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-12 06:32:04 | Recording: Analyzing Android Malware - From triage to reverse-engineering (lien direct) | It's easy to get wrapped up worry about large-scale ransomware attacks on the threat landscape. These are the types of attacks that make headlines and strike fear into the hearts of CISOs everywhere. But if you want to defend the truly prolific and widespread threats that target some of the devices...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Ransomware Malware Threat | ||
|
2021-04-09 11:40:51 | (Déjà vu) Threat Roundup for April 2 to April 9 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 2 and April 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-09 08:03:31 | Talos Takes Ep. #48: The complete history of ObliqueRAT (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
After researching and writing about ObliqueRAT for several months now, Asheer Malhotra joins Talos Takes for...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-08 11:00:00 | Threat Source Newsletter (April 8, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
We've all heard about spam coming through your email or those robocalls we all hate. But during the COVID-19 pandemic, attackers are now turning to chat rooms and gaming servers to spread spam. Talos researchers this...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Spam | ||
|
2021-04-07 14:53:36 | (Déjà vu) Beers with Talos Ep. #102: Twitter has questions for us (lien direct) | Beers with Talos (BWT) Podcast episode No. 102 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here.
By Mitch Neff.
Recorded Feb. 23, 2021
We've been...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-07 05:06:50 | Sowing Discord: Reaping the benefits of collaboration app abuse (lien direct) | By Nick Biasini, Edmund Brumaghin, and Chris Neal with contributions from Paul Eubanks.
As telework has become the norm throughout the COVID-19 pandemic, attackers are modifying their tactics to take advantage of the changes to employee workflows.Attackers are leveraging collaboration platforms,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-02 14:05:03 | (Déjà vu) Threat Roundup for March 26 to April 2 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 26 and April 2. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-04-02 07:00:00 | Talos Takes Ep. #47: Looking back at the Masslogger trojan (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
We return to our usual formatting this week to discuss the Masslogger trojan. We covered this threat earlier this year...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Threat | ★★★★ |
To see everything:
Our RSS (filtrered)
