What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2021-09-30 06:22:57 | A wolf in sheep\'s clothing: Actors spread malware by leveraging trust in Amnesty International and fear of Pegasus (lien direct) | By Vitor Ventura and Arnaud Zobec.
Threat actors are impersonating the group Amnesty International and promising to protect against the Pegasus spyware as part of a scheme to deliver malware.
Amnesty International recently made international headlines when it released a groundbreaking report on...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Malware | ||
|
2021-09-24 10:07:01 | (Déjà vu) Threat Roundup for September 17 to September 24 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 17 and Sept. 24. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-09-24 08:52:58 | Talos Takes Ep. #69: Our armadillo in shining armor (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
We also preach the importance of multi-factor authentication. But what happens when the bad guys start going after...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-09-23 11:00:00 | Threat Source newsletter (Sept. 23, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.
The Russian APT Turla is one of the most notorious threat actors out there today. And they aren't stopping, recently adding a new backdoor to their arsenal that serves as a "last chance" to retain a foothold on victim...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Threat | ★★★ | |
|
2021-09-23 08:00:11 | Vulnerability Spotlight: Information disclosure vulnerability in D-LINK DIR-3040 mesh router (lien direct) | Dave McDaniel of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered an exploitable information disclosure vulnerability in the D-LINK DIR-3040 smart WiFi mesh router that could allow an adversary to eventually turn off the device or remove other...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-09-23 05:01:25 | Operation “Armor Piercer:” Targeted attacks in the Indian subcontinent using commercial RATs (lien direct) | By Asheer Malhotra, Vanja Svajcer and Justin Thattil.
Cisco Talos is tracking a campaign targeting government personnel in India using themes and tactics similar to APT36 (aka Mythic Leopard and Transparent Tribe).This campaign distributes malicious documents and archives to deliver the Netwire...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
APT 36 | ||
|
2021-09-21 05:11:17 | TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines (lien direct) | News summary Cisco Talos recently discovered a new backdoor used by the Russian Turla APT group.We have seen infections in the U.S., Germany and, more recently, in Afghanistan. It is likely used as a stealth second-chance backdoor to keep access to infected devicesIt can be used to download, upload...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Malware | ||
|
2021-09-17 13:28:08 | (Déjà vu) Threat Roundup for September 10 to September 17 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 10 and Sept. 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-09-17 07:39:44 | Talos Takes Ep. #68: The various pivots and pitfalls in a malware investigation (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
On this week's episode, Vitor Ventura from our research team walks through his recent work on connecting several...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Malware | ||
|
2021-09-16 11:00:00 | Threat Source newsletter (Sept. 16, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.
It's a bird, it's a plane, it's a rat!
We've been tracking a series of trojans targeting the aviation industry, and trying to lure victims in by sending them spam related to flight itineraries and other transportation...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Spam | ||
|
2021-09-16 05:04:10 | Operation Layover: How we tracked an attack on the aviation industry to five years of compromise (lien direct) | By Tiago Pereira and Vitor Ventura.
Cisco Talos linked the recent aviation targeting campaigns to an actor who has been targeting the aviation industry for two years.The same actor has been running successful malware campaigns for more than five years.Although always using commodity malware, the...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Malware | ||
|
2021-09-14 10:33:50 | Microsoft Patch Tuesday for Sept. 2021 - Snort rules and prominent vulnerabilities (lien direct) | By Jon Munshaw, with contributions from Holger Unterbrink.
Microsoft released its monthly security update Tuesday, disclosing 85 vulnerabilities across the company's firmware and software. This month's release is headlined by an official patch for the critical remote code execution...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-09-13 11:35:56 | Downtime on Talos Intelligence (lien direct) | TalosIntelligence.com will be down for a short time on Sept. 17 around 10 a.m. while we perform some routine maintenance on the site.
We apologize for any inconvenience this may cause. We expect the interruption will only last for about 30 minutes.
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-09-13 07:12:02 | Vulnerability Spotlight: Code execution vulnerability in Nitro Pro PDF (lien direct) | A Cisco Talos team member discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered a vulnerability in the Nitro Pro PDF reader that could allow an attacker to execute code in the context of the application.
Nitro Pro PDF is part of Nitro Software's...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-09-10 12:03:12 | (Déjà vu) Threat Roundup for September 3 to September 10 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 3 and Sept. 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
★★ | ||
|
2021-09-10 07:20:00 | Talos Takes Ep. #67: What a leaked playbook tells us about the Conti ransomware group (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
There's a lot to take apart in the recently leaked Conti ransomware playbook. After a disgruntled member of the...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Ransomware | ||
|
2021-09-09 12:57:25 | Talos release protection against zero-day vulnerability in Microsoft MSHTML (lien direct) | Cisco Talos released new SNORT® rules Thursday to protect against the exploitation of a zero-day vulnerability in Microsoft MSHTML that the company warns is being actively exploited in the wild.
Users are encouraged to deploy SIDs 58120 – 58129, Snort 3 SID 300049 and ClamAV...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-09-09 11:00:00 | Threat Source newsletter (Sept. 9, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.
The biggest security news this week is no doubt another Microsoft zero-day. On the heels of PrintNightmare and multiple Exchange Server vulnerabilities comes a code execution vulnerability in MSHTML, the rendering engine...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-09-07 08:56:17 | (Déjà vu) Vulnerability Spotlight: Heap buffer overflow vulnerability in Ribbonsoft dxflib library (lien direct) | Lilith >_> of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered an exploitable heap-based buffer overflow vulnerability in Ribbonsoft's dxflib library that could lead to code execution.
The dxflib library is a C++ library utilized by...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability Guideline | ||
|
2021-09-03 09:57:19 | (Déjà vu) Threat Roundup for August 27 to September 3 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 27 and Sept. 3. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-09-03 06:09:11 | Talos Takes Ep. #66: Dude, where\'s my bandwidth? (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
“Proxyware” sounds like a complicated topic that you're too afraid to ask about. But really, it's just software that...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-09-02 13:33:13 | Beers with Talos, Ep. #109: We have not secured our society - Or, working out a conference talk in realtime (lien direct) | Beers with Talos (BWT) Podcast episode No. 109 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here.
Most of the Beers with Talos guys got a chance to take...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-09-02 11:00:00 | Threat Source newsletter (Sept. 2, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.
If you haven't seen already, our blog has a lot of cool and new stuff this week.
We first dove into the world of proxyware on Tuesday (aka internet-sharing applications). Attackers are hiding in this newly popular...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-09-02 05:02:00 | Translated: Talos\' insights from the recently leaked Conti ransomware playbook (lien direct) | By Caitlin Huey, David Liebenberg, Azim Khodjibaev, and Dmytro Korzhevin.
Executive summary
Cisco Talos recently became aware of a leaked playbook that has been attributed to the ransomware-as-a-service (RaaS) group Conti. Talos has a team of dedicated, native-level speakers that translated these...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Ransomware | ||
|
2021-08-31 05:00:38 | Attracting flies with Honey(gain): Adversarial abuse of proxyware (lien direct) | By Edmund Brumaghin and Vitor Ventura.
With internet-sharing applications, or "proxyware," users download software that allows them to share a percentage of their bandwidth with other internet users for a fee, with the companies that created this software acting as a go-between.As proxyware has...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-27 11:44:48 | (Déjà vu) Threat Roundup for August 20 to August 27 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 20 and Aug. 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-27 04:33:15 | Talos Takes Ep: #65: How several RAT campaigns in Latin America are connected (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
As more people around the world start to get vaccinated against COVID-19, travel is becoming easier, especially during...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-26 11:00:00 | Threat Source newsletter (Aug. 26, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.
We have RATs on RATs on RATs over the past few weeks. And last week, we found a few more heading to Latin America to target users and try to steal their login credentials.
The threat actor in this case has some compelling...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Threat | ||
|
2021-08-20 11:23:13 | (Déjà vu) Threat Roundup for August 13 to August 20 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 13 and Aug. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-19 11:00:00 | Threat Source newsletter (Aug. 19, 2021) (lien direct) | Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.
I'm writing this on Tuesday morning on account of vacation (again), so apologies if we miss any major stories.
You certainly don't want to miss our latest blog post on the Neurevt remote access trojan that's...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-19 04:58:51 | Malicious Campaign Targets Latin America: The seller, The operator and a curious link (lien direct) | By Asheer Malhotra and Vitor Ventura, with contributions from Vanja Svajcer.
Cisco Talos has observed a new malware campaign delivering commodity RATs, including njRAT and AsyncRAT.The campaign targets travel and hospitality organizations in Latin America.Techniques utilized in this campaign bear...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Malware | ||
|
2021-08-17 10:02:50 | Vulnerability Spotlight: Memory corruption vulnerability in Daemon Tools Pro (lien direct) | Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered a memory corruption vulnerability in Disc Soft Ltd.'s Daemon Tools Pro.
Daemon Tools Pro is a professional emulation software that works with disc images and virtual...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-08-17 05:01:40 | Neurevt trojan takes aim at Mexican users (lien direct) | By Chetan Raghuprasad, with contributions from Vanja Svajcer. News summaryCisco Talos discovered a new version of the Neurevt trojan with spyware and backdoor capabilities in June 2021 using Cisco Secure Endpoint product telemetry.This version of Neurevt appears to target users of Mexican financial...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-16 06:37:29 | Vulnerability Spotlight: Multiple integer overflow vulnerabilities in GPAC Project on Advanced Content (lien direct) | A Cisco Talos team member discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple integer overflow vulnerabilities in the GPAC Project on Advanced Content that could lead to memory corruption.
The GPAC Project on Advanced Content is an open-source...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Guideline | ||
|
2021-08-13 10:12:55 | (Déjà vu) Threat Roundup for August 6 to August 13 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 6 and Aug. 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-13 07:00:00 | Talos Takes Ep. #64: Back 2 Skool edition (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
There's no shortage of complications leading into this new school year. Students, parents, teachers and admins alike...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Guideline | ||
|
2021-08-12 15:35:12 | Vice Society Leverages PrintNightmare In Ransomware Attacks (lien direct) | By Edmund Brumaghin, Joe Marshall, and Arnaud Zobec.
Executive Summary
Another threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Ransomware Vulnerability Threat | ||
|
2021-08-12 11:00:02 | Threat Source newsletter (Aug. 12, 2021) (lien direct) |
Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.
No, that's not Ratatouille. It's ServHelper, who is much more dangerous (albeit just as cute) as the cartoon chef. We have a new blog post out today detailing this RAT, run by the threat actor Group TA505, that is...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Threat | ||
|
2021-08-12 05:01:54 | Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT (lien direct) | By Vanja Svajcer.
News summaryGroup TA505 has been active for at least seven years, making wide-ranging connections with other threat actors involved in ransomware, stealing credit card numbers and exfiltrating data. One of the common tools in TA505's arsenal is ServHelper. In mid-June, Cisco Talos...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Threat | ||
|
2021-08-11 05:00:00 | Talos Incident Response quarterly threat report - The top malware families and TTPs used in Q2 2021 (lien direct) | By David Liebenberg and Caitlin Huey.
Last quarter, ransomware was not the most dominant threat for the first time since we began compiling these reports. We theorized that this was due to a huge uptick in Microsoft Exchange exploitation, which temporarily became a primary focus for Cisco...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Ransomware Malware Threat | ||
|
2021-08-10 10:36:49 | Microsoft Patch Tuesday for August 2021 - Snort rules and prominent vulnerabilities (lien direct) | By Jon Munshaw, with contributions from Martin Lee.
Microsoft released its monthly security update Tuesday, disclosing 44 vulnerabilities in the company's firmware and software. This is the fewest amount of vulnerabilities Microsoft has patched in a month in more than two years.
There...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-10 10:22:06 | Vulnerability Spotlight: Multiple vulnerabilities in AT&T Labs\' Xmill utility (lien direct) | Carl Hurd of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered multiple vulnerabilities in AT&T Labs' Xmill utility. An attacker could take advantage of these issues to carry out a variety of malicious actions, including corrupting the...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-10 09:21:33 | Vulnerability Spotlight: Code execution vulnerability in Mozilla Firefox (lien direct) | Marcin “Icewall” Noga of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered a use-after-free vulnerability in Mozilla Firefox that could lead to code execution.
Firefox is a widely used web browser available on many operating systems. This...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability Guideline | ||
|
2021-08-06 10:50:05 | Talos Takes Ep: #63: Shield your eyes from the Solarmarker (lien direct) | By Jon Munshaw.
The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page.
Andrew Windsor has been following the Solarmarker threat for months. But it really started to catch his eye when he...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Threat | ||
|
2021-08-06 10:49:27 | (Déjà vu) Threat Roundup for July 30 to August 6 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 30 and Aug. 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-05 10:58:52 | Threat Source newsletter (Aug. 5, 2021) (lien direct) |
Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers.
We hope everyone is enjoying BlackHat and/or DEFCON this week, regardless of if you're attending virtually or in person. In case you missed any of our talks from BlackHat, you can check them out here, along...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-04 11:56:13 | Beers with Talos, Ep. #108: Kaseya it ain\'t so (lien direct) | Beers with Talos (BWT) Podcast episode No. 108 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here.
Who needed a summer vacation anyway? The whole Beers...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-08-04 07:18:22 | Vulnerability Spotlight: Use-after-free vulnerability in tinyobjloader (lien direct) | Lilith >_> of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos recently discovered a use-after-free vulnerability in a specific function of tinyobjloader. An adversary could trick a user into opening a specially crafted file, causing a use-after-free condition, and...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
Vulnerability | ||
|
2021-08-03 08:14:39 | Updates to the Cisco Talos Email Status Portal (lien direct) | Cisco Talos is rolling out several changes to the Email Status Portal that adds new features and makes the Portal even easier to use.
The Talos Email Status Portal allows users to view mail samples submitted and their statuses, analyze graphical displays of submission metrics, administer...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
|||
|
2021-07-30 14:50:53 | (Déjà vu) Threat Roundup for July 23 to July 30 (lien direct) | Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 23 and July 30. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...
[[ This is only the beginning! Please visit the blog for the complete entry ]] |
To see everything:
Our RSS (filtrered)
