X-Force Exchange - Collection Feed

Summary For the month of May, Microsoft has published 55 bulletins. Of the bulletins, 4 are rated as Critical, 50 are rated as Important, and 1 is rated as Moderate. None of the vulnerabilities are reported to have been exploited in the wild. Threat Type Vulnerability Overview For the month of May, Microsoft has published 55 bulletins. Of the bulletins, 4 are rated as Critical, 50 are rated as Important, and 1 is rated as Moderate. None of the vulnerabilities are reported to have been exploited in the wild.

Summary Researchers from Netlab 360 discover a new backdoor they have named RotaJakiro, targeting Linux x64 systems. The backdoor uses rotate encryption for it's communications and implements different persistence features depending on whether the user has root privileges or not. Threat Type Malware, Backdoor, Data Theft, APT Overview A new Linux backdoor family, named RotaJakiro, has been discovered by researchers from Netlab at 360. The backdoor uses rotate encryption for it's communications and implement

Summary Trend Micro researchers have discovered a botnet malware campaign that makes use of TOR network proxies to download files, abuses infrastructure-as-code (IaC) tools for malware spreading, and installs a cryptocurrency miner. Threat Type Malware, Botnet, Cryptomining Overview A botnet malware campaign discovered by Trend Micro researchers is making use of TOR proxies to download files including non-malicious binaries it may not find on the victim host but needs in order to carry out its deeds. The ma

Summary Adobe has released twelve security updates. The updates are for Acrobat and Reader, After Effects, Animate, Creative Cloud Desktop Application, Experience Manager, Genuine Service, Illustrator, InCopy, InDesign, Magento, Media Encoder, and Medium. Ten of the updates address at least one vulnerability rated by Adobe as Critical. One of the vulnerabilities addressed in the Acrobat and Reader updates is reported as having been exploited in the wild. Threat Type Vulnerability Overview Adobe has released

Summary Google has released an update to its Chrome web browser for Windows, Mac, and Linux that provides fixes for nineteen vulnerabilities. Of the fifteen CVE-numbered vulnerabilities noted in the advisory, Google has rated thirteen of them as High, and two as Medium. Threat Type Vulnerability Overview Google has released an update, version 90.0.4430.212, to its Chrome web browser for Windows, Mac, and Linux that provides fixes for nineteen vulnerabilities. Of the fifteen CVE-numbered vulnerabilities note

The following report provides X-Force Threat Intelligence's analysis of the DarkSide ransomware family based on publicly available samples. Summary DarkSide, like other ransomware used in targeted attacks, encrypts user data in compromised computers. Recent variants of DarkSide ransomware enumerates various system properties of the victim and beacons them in an encoded POST request to its C2 address. DarkSide also executes an encoded PowerShell command to delete volume shadow copies. It deletes several s

Summary A top U.S. fuel pipeline company has suffered a cyber attack that has forced them to halt operations. Several news sources and the company itself have confirmed the attack. Threat Type Cyber Attack Overview ** Update May 10 - 8:50 AM** The most recent reporting indicates that the attack likely involved DarkSide, a ransomware-as-a-service (RaaS) affiliate operation. DarkSide posted the following statement to their leak site following the attack: We are apolitical, we do not participate in geopolitics

Summary Apple has published a security update for Safari. One vulnerability is addressed in the update, which is reported as being actively exploited in the wild. Threat Type Vulnerability Overview Apple has published a security update for Safari. One vulnerability is addressed in the update, which is reported as being actively exploited in the wild. If successfully exploited, the vulnerability could potentially allow a remote attacker to execute arbitrary code. We recommend updating to the latest version a

Summary The Mozilla Foundation has issued three security advisories that address multiple vulnerabilities in Firefox, Firefox ESR, and Thunderbird. Threat Type Vulnerability Overview The Mozilla Foundation has released Firefox 88.0.1 and Firefox for Android 88.1.3. There are two vulnerabilities addressed in the update of which one is rated as Critical and one as High. The critical vulnerability only affects the Android version and potentially leaves the browser vulnerable to a universal cross-site scripting

Summary About a week ago, the Infosecurity Group reported that Washington D.C.'s metro police department was hit by ransomware threat actors of Russian origins. Threat Type Ransomware Overview The Babuk group claimed to have information on confidential informants used by the district's police department. Metro police only acknowledged the breach but not whether or not they paid the ransom or even that there was an attack and that ransom was being sought. The information the group claimed to have included ga

Summary VMWare published a security advisory, VMSA-2021-0007, that addresses a remote code execution vulnerability in VMware vRealize Business for Cloud. Threat Type Vulnerability Overview VMWare published a security advisory, VMSA-2021-0007, that addresses a vulnerability (CVE-2021-21984) in VMware vRealize Business for Cloud. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on an affected vRealize Business for Cloud Virtual appliance. We recommend reviewing the ad

Summary Cisco has published twenty-nine Security Advisories. Of the advisories, two are rated as Critical, seven are rated as High, nineteen are rated as Medium, and one is rated as Informational. Threat Type Vulnerability Overview Cisco has published twenty-nine Security Advisories. Of the advisories, two are rated as Critical, seven are rated as High, nineteen are rated as Medium, and one is rated as Informational. Please note that one of the advisories summarized below (cisco-sa-anyconnect-profile-AggMUC

Summary Twenty-one vulnerabilities in Exim have been disclosed by Qualys. Three of the vulnerabilities could allow for remote code execution. Threat Type Vulnerability Overview Twenty-one vulnerabilities in Exim have been disclosed by Qualys. Of the most serious vulnerabilities, three could allow for remote code execution, and four could allow for escalation of privileges to those of root. In total, ten of the vulnerabilities are exploitable remotely and eleven are exploitable locally. Qualys has not provid

Summary A security advisory have been published for Xen. The vulnerability addressed in the advisories could potentially allow for an attacker to carry out a Spectre v2 attack against Xen. Threat Type Vulnerability Overview A security advisory have been published for Xen. The vulnerability addressed in the advisories could potentially allow for an attacker to carry out a Spectre v2 attack against Xen. Further information, including a mitigation strategy, is available from the link in the advisory summary be

Summary IBM has published eight security bulletins that apply to QRadar SIEM. In total, seventeen vulnerabilities are addressed in the bulletins. Threat Type Vulnerability Overview IBM has published eight security bulletins that apply to QRadar SIEM. In total, seventeen vulnerabilities are addressed in the bulletins. The potential impacts from successful exploitation of the vulnerabilities includes a remote attacker being able to cause denial of service conditions, obtain sensitive data (including session c

Summary The ICS-CERT has published two advisories that affect Advantech's WISE-PaaS RMM, and Delta Electronics' CNCSoft ScreenEditor. Threat Type Vulnerability Overview The ICS-CERT has published two advisories that affect Advantech's WISE-PaaS RMM, and Delta Electronics' CNCSoft ScreenEditor. Further information is available from the advisories which are summarized below. ICS Advisory ICSA-21-124-01 - Advantech WISE-PaaS RMM CVE-2021-27437 - The affected product allows attackers to obtain sensitive informa

Summary The Android Security Bulletin for May has been released and provides information on the forty-two vulnerabilities that are addressed in this bulletin. Threat Type Vulnerability Overview The April security bulletin for Android has been released. In it, forty-two vulnerabilities are addressed. Some of the potential impacts of successful exploitation of the vulnerabilities are information disclosure, privilege escalation, and remote code execution. Four of the vulnerabilities were rated as Critical, an

Summary Apple has published security updates for macOS Big Sur, iOS, iPadOS and watchOS. In total, four vulnerabilities are addressed in the updates, all of which are reported as being actively exploited in the wild. Threat Type Vulnerability Overview Apple has published security updates which take macOS Big Sur to 11.3.1, iOS (for older devices) to 12.5.3, iOS and iPadOS to 14.5.1, and watchOS to 7.4.1. In total, four vulnerabilities are addressed in the updates, one of which is common to all updates. All

Summary IBM X-Force Threat Intelligence has observed an increase in reconnaissance activity targeting the port associated with SCADA Modbus, highlighting an increasing threat to ICS-based networks. Threat Type Reconnaissance, Information Leakage Overview IBM X-Force Threat Intelligence analysts have identified a persistent trend within our data that points to a very large increase in reconnaissance activity targeting port 502. This port is commonly used by Supervisory Controls and Data Acquisition (SCADA) M

Summary IBM X-Force Threat Intelligence has published a report identifying industry attack trends derived from IBM Security's network telemetry data. Threat Type N/A Overview IBM Security’s network data from monitored devices provides a wealth of insight into attack trends across industries and time. While the majority of the data events in our telemetry represent attempted attacks - rather than successful intrusions - these metrics are helpful in identifying the methods attackers are using in an attempt to