Tag: Cybersecurity Threat Advisory
Cybersecurity Threat Advisory: Advanced Persistent Threat Activity exploiting MSPs
What is the Issue? The National Cybersecurity and Communications integration center identified ongoing APT (advanced persistent threat) attempting to infiltrate networks of managed service providers (MSPs). APT actors are leveraging legitimate credentials to exploit trusted network relationships and allowing these...
Cybersecurity Threat Advisory: HIDDEN COBRA – FASTCash Campaign
What is the Issue? The FBI – in partnership with U.S. government partners, DHS, and Treasury – identified malware and other indicators of compromise (IOCs) used by the North Korean government in an Automated Teller Machine (ATM) cash-out scheme –...
Cybersecurity Threat Advisory: Access-Token-Harvesting Attack Affects Facebook
What is the Issue? Many applications typically require an email verification step to authenticate identity before logging the user in. If a person signs up for any app using Facebook Login, an account is created for them, and the authentication...
Cybersecurity Threat Advisory: Newegg Data Breach Left Customer Credit Cards Exposed
What is the Issue? The online retailer Newegg confirmed on Wednesday that credit card information from customers had been stolen using a sophisticated attack. Hackers injected 15 lines of card skimming code on the online retailer’s payments page; the code...
Cybersecurity Threat Advisory: Data Theft Risks from “Cold Boot Attack” Variation
What is the Issue? Researchers have discovered that a new exploit built on the foundations of the cold boot attack leaves nearly all laptops and desktops; both Windows and Mac users vulnerable. Attackers can meddle with a computer’s firmware to...
Cybersecurity Threat Advisory: Infection on E-commerce Platform Magento
What is the Issue? Security researchers have discovered that a massive hacking campaign is targeting the ecommerce platform Magento. Hackers are infecting stores that use the platform with a skimmer script in the source code, dubbed MagentoCore that siphon’s payment...
Cybersecurity Threat Advisory: Qualcomm’s Medical Gateway Critical Vulnerability
What is the Issue? Recently, an undocumented vulnerability in the Qualcomm Life’s Capsule Datacaptor Terminal Server (DTS) medical device gateway was found to be exposed to the “misfortune Cookie” vulnerability CVE-2014-9222. This opens the possibility for remote attackers to gain...
Cybersecurity Threat Advisory: Apache Struts Framework Remote Code Execution Vulnerability
What is the Issue? Apache Struts web framework versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from a critical Remote Code Execution vulnerability that could be exploited by attackers to fully control the application. Apache Struts 2 is a...
Cybersecurity Threat Advisory: Trickbot Trojan Continues to Evolve
What is the Issue: A new Trickbot iteration features a sneaky method of performing process-hollowing using direct system calls, anti-analysis techniques and the disabling of security tools. Process-hollowing is a technique used by malware in which a legitimate process is...
Cybersecurity Threat Advisory: DoS Vulnerability in Cisco Web Security Appliance
What is the Issue? There exists a vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances. This happens because of the improper handling of memory resources by this software for TCP connections on any...
