New Phishing Apps Discovered on Google Play Store. Several phishing apps have recently been discovered on the Google Play Store. These apps can be games or investment services; however, they are designed to steal sensitive user information. The apps have been downloaded 450, 000 times in total.

• Advisory
• January 30, 2023

Multiple Vulnerabilities in EDRs and Anti-Virus Software Exploited To Turn Them into Data Wipers. SafeBreach researchers discovered a number of zero-day vulnerabilities in various Endpoint Detection and Response (EDR) and Anti-virus solutions. These flaws can be exploited to turn millions of such solutions in use around the world into data wipers capable of deleting any file on a device and causing it to fail to boot. This wiper runs as an unprivileged user but has the ability to wipe almost any file on a system, including system files, and render a computer unbootable. It does all that without implementing code that touches the target files, making it fully undetectable.

• Advisory
• December 19, 2022

Cloud9 Botnet Hijacking Web Browsers and Compromising Windows Operating System. Two Cloud9 malware variants have been discovered in the wild, one of which is a significantly improved version of the other (with added features and bug fixes) that affects web browsers. Cloud9 is a malicious web browser extension that targets a variety of browsers. It can introduce malware into a device and functions similarly to a Remote Access Trojan (RAT), allowing the threat actor to remotely control a device.

• Advisory
• November 14, 2022

Hackers Using Microsoft Edge Malvertising Campaign To Target Users. A malicious advertising campaign has been unearthed on the Microsoft Edge Browser News Feed that redirects victims to fraudulent tech support websites. Cybercriminals have resorted to posting bizarre, attention-grabbing stories or advertisements on the Edge news feed in order to entice users to click on them. This is a type of malvertising – online advertisements that appear legitimate but contain malware and/or other threats.

• Advisory
• September 26, 2022

SharkBot Malware Infiltrates Google Play Store. A new and improved variant of the SharkBot malware has been discovered in the form of a device optimization and antivirus app on the Google Play Store. This malware is said to be targeting Android users' banking logins via apps with tens of thousands of installations.

• Advisory
• September 5, 2022

Messaging Apps Used To Propagate Information-Stealing Malware. Naturally, with the proliferation of messaging apps, some will have gained more traction than others. Discord and Telegram, two of the most popular messaging apps, have a burgeoning community that not only exchanges messages but also develops and shares "bots" - programs that automate a variety of tasks within each platform. Threat actors have exploited this and are now using these platforms to spread information-stealing malware.

• Advisory
• August 3, 2022

Malicious Facebook Messenger Chatbots Used to Compromise Facebook Accounts. As a follow-up to the May 23rd advisory on "Novel Use of Chatbots in Phishing Schemes," the use of a chatbot for phishing purposes is gradually gaining traction, particularly with the discovery of a campaign in which it is used to steal Facebook login credentials. The platform's ubiquitous messaging app, Facebook Messenger, is known to have an integrated chatbot feature. This provides threat actors with a large pool of potential victims who are not only familiar with but also believe in the feature.

• Advisory
• July 4, 2022

New Whatsapp OTP Scam Using Call Forwarding Trick. Hackers have devised a method to gain control of a victim's WhatsApp account by exploiting an automated "call forwarding" feature that is activated when a number is busy or engaged. All telecom service providers offer this feature. This method also makes use of WhatsApp's option to send a one-time password (OTP) via phone call.

• Advisory
• June 10, 2022

Malicious Actors Planting Fileless Malware on target machines using Event Logs. Unknown bad actors have developed a novel method of deploying fileless malware by injecting shellcode directly into Windows event logs. This novel method of payload storage has never been attempted before, emphasizing the importance of remaining vigilant in the face of threats. Fileless malware is a type of malicious activity that executes a cyber attack by utilizing native, legitimate tools built into a system.

• Advisory
• May 20, 2022

FBI Warns of BlackCat Ransomware That Breached Over 60 Organisations Worldwide. The U.S. Federal Bureau of Investigation (FBI) has raised the alarm on the BlackCat ransomware-as-a-service (RaaS), which it said victimized at least 60 entities worldwide as of March 2022 since its emergence last November. The FBI disseminated known indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs) associated with ransomware variants identified through FBI investigations. BlackCat is the first ransomware group to do so successfully using RUST, considered to be a more secure programming language that offers improved performance and reliable concurrent processing. BlackCat-affiliated threat actors typically request ransom payments of several million dollars in Bitcoin and Monero. Many of the developers and money launderers for BlackCat/ALPHV are linked to Darkside/Blackmatter, indicating they have extensive networks and experience with ransomware operations.

• Advisory
• April 25, 2022

New Zero-Day Chrome Web Browser Vulnerability. The Chrome web browser has eight security flaws that have been discovered and reported, including a high-severity flaw that is actively being exploited in real-world attacks. Google, on the other hand, has released fixes for the Chrome web browser's security flaws, marking the internet giant's first zero-day patch in 2022.

• Advisory
• February 15, 2022

Ransomware Attack Warning. Security experts have uncovered a new year scheme employed by a cybercrime group to deliver ransomware to targeted organizations. The group has been mailing out USB thumb drives to many organizations in the hope that recipients will plug them into their PCs and install ransomware on their networks. While businesses are being targeted, criminals could soon begin sending infected USB drives to individuals.

• Advisory
• January 12, 2022

Iranian Hacking Group targets Telecos, ISPs and Ministry of foreign Affairs (MFA) with Upgraded Malware. An Iranian threat group known as Lyceum (aka Hexane, Siamesekitten, or Spirlin) has been reported to be targeting Telcoms, ISPs and Ministry of Foreign Affairs (MFA) in Africa in a recent politically motivated attacks with an active focus on cyberespionage. This group is known to be focused on infiltrating the networks of telecoms companies and internet service providers (ISPs). Between July and October, Lyceum was spotted in attacks against ISPs and telecoms organizations across Israel, Morocco, Tunisia, and Saudi Arabia.  The advanced persistent threat (APT) group has been linked to campaigns striking Middle Eastern oil and gas companies in the past and now appears to have expanded its focus to include the technology sector. In addition, the APT is responsible for a campaign against an unnamed African ministry of foreign affairs.

• Advisory
• November 12, 2021

OpenOffice and LibreOffice Digital Signature Spoofing Vulnerabilities. Three flaws has been uncovered in OpenOffice and LibreOffice that if successfully exploited could permit an attacker to manipulate the timestamp of signed ODF documents, and worse, alter the contents of a document or self-sign a document with an untrusted signature, which is then tweaked to change the signature algorithm to an invalid or unknown algorithm.

• Advisory
• October 12, 2021

COVID-19 RELATED SCAMS. Several fake portals requesting beneficiaries' account details to get the Federal Government’s 2021 Survival Fund, check the N-Power Batch-C eligibility, and apply for CBN The COVID-19 Loan has been discovered to be circulating on the social media and through email messages to unsuspecting members of the public. These fraudsters parade themselves as operators of the Federal Government’s schemes.

• Advisory
• August 25, 2021

Apple Zero-Day Vulnerabilities. Apple has reported a zero-day vulnerability affecting its iOS, macOS and watchOS operating system being exploited by attackers in the wild to craft malicious web content, which may lead to remote code execution. Apple has therefore, released security patches for the zero-day bugs under active attacks.

• Advisory
• May 18, 2021

Fake LinkedIn Job Offer Malware. A new spear-phishing campaign has been discovered to be targeting professionals on LinkedIn with weaponized job offers in an attempt to infect targets with a sophisticated and dangerous backdoor trojan called "more_eggs." According to researchers, the threat actors are using zip files to trick LinkedIn users into executing the More_eggs backdoor.

• Advisory
• April 12, 2021

Security Advisory on Apple Chips Malware. A new malware has been discovered to be crafting multi-architecture applications so that their code will run natively on Apple’s M1 Silicon chips. This is an attempt by malicious actors to target the company’s latest generation of Macs powered by its own processors. The malware is in the form of a Safari adware extension originally written to run on Intel x86 chips. The malicious extension, called "GoSearch22," is a well-known member of the "Pirrit" Mac adware family.

• Advisory
• February 23, 2021

ADVISORY ON SQL INJECTION VULNERABILITY AND OTHER BASIC NETWORK SECURITY MEASURES. An SQL injection is a technique that attackers apply to insert SQL query into input fields to then be processed by the underlying SQL database. These weaknesses are then able to be abused when entry forms allow user-generated SQL statements to query the database directly. The attack results in the unauthorized viewing of user lists, the deletion of database entries and stealing of data.

• Advisory
• October 16, 2020

RV Series Routers Command Injection Vulnerabilities. Researchers discovered multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, and RV082 Routers. This vulnerabilities could allow an authenticated, remote attacker with administrative privileges to execute arbitrary commands on an affected device.

• Advisory
• August 5, 2020

Webex Desktop App Vulnerability. A critical vulnerability was discovered in Cisco Webex Meetings Desktop App which might allow a malicious remote attacker to execute programs on affected end-user system. This vulnerability is caused by improper validation of input that is supplied to application URLs. Also, the attacker could exploit this vulnerability by persuading a user to follow a malicious URL.

• Advisory
• June 24, 2020

Local Privilege Escalation Vulnerability for VMware. VMware Fusion, VMRC, and Horizon Client contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOC/TOU) issue in the service opener. Furthermore, another local privilege escalation was discovered, which allows the application to blindly executes files from an untrusted location. Both vulnerabilities result in arbitrary code execution as root.

• Advisory
• June 16, 2020

Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability. A vulnerability in the REST API of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) releases prior to 3.0.2 could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system.

• Advisory
• February 10, 2020

Windows 10 Task Scheduler Zero-Day Vulnerability. Microsoft Windows Task Scheduler is a set of Microsoft Windows components that allows for the execution of scheduled tasks. The exploit "functions reliably on 32- and 64-bit Windows 10 platforms, as well as Windows Server 2016 and Windows Server 2019.

• Vulnerability
• February 10, 2020