Newsletter
All published 'Cyber Threat Weekly' newsletter issues can be found here.
Cyber Threat Weekly – #10
This week’s newsletter is a bit lighter than earlier this month, although news volumes continue to increase. Let’s start with exploit attempts on the critical Atlassian Confluence bug disclosed last week. First zero-day flaw of the year for Apple. Digging deeper into a pair of malicious traffic direction
Cyber Threat Weekly – #9
Another busy news cycle last week. Let’s start with potential remote code execution in over 178,000 SonicWall firewalls. This is not good, Ivanti Connect Secure VPN now under mass exploitation. CISA releases advisory on Androxgh0st malware. Critical flaw in older versions of Atlassian Confluence Datacenter and Server. First
Cyber Threat Weekly - #8
It got busy last week, a bunch of news to cover. Let’s start with a new extortion tactic by ransomware clown posse threat actors, cyber criminals suck. A great piece on bullet proof hosting by Krebs. Yet another means of extortion for ransomware victims, fake data deletion scam. Honey
Cyber Threat Weekly - #7
Kicking off a new week, last week we saw several interesting threats. Let’s start with a new variation of dynamic link library (DLL) search order hijacking technique. Next, social engineering through LinkedIn, this is a notable trend. Black Basta ransomware decryption tool released. Possible Cisco ASA vulnerability for sale
Cyber Threat Weekly - #6
First off, Happy New Year, and so it begins… a new start to another year. Got to remember to use 2024 instead of 2023. Let’s begin with Carbanak is back and has been observed in ransomware attacks. Poorly secured Linux SSH servers actively attacked. A new version of Medusa
Cyber Threat Weekly - #5
Wishing you Happy Holidays, a Merry Christmas, a Happy New Year, all the things. Kicking it off, over a 3-month period, Blackberry found there was a 70% increase in unique malware hashes from the previous reporting period, about 2.9 unique samples per minute. A Smishing gang has recently changed
Cyber Threat Weekly - #4
As the Threat Landscape continues to evolve… We continue to track the latest threat trends and adversary behavioral patterns. Kicking off this week, researchers uncover links between the Sandman threat group and the Chinese government. Next, Lazarus Group (North Korea) is exploiting vulnerable Internet facing servers using Log4Shell (CVE-2021-44228) and
Cyber Threat Weekly - #3
We got quite a bit to cover this week… Let’s start with malvertising to deploy DanaBot leading to CACTUS ransomware. A botnet uncovered by Palo Alto is upping its game. A Russian APT abusing CVE-2023-23397 and other vulnerabilities. Proofpoint tracking similar behavior from nation state threat actor. To keep
Cyber Threat Weekly - #2
Last week we saw some cyber threat patterns and this week they continue. Quite a bit to cover, let’s start with Google Chrome zero-day, now fixed, under active exploitation. Next up, ownCloud bugs mentioned last week are being exploited in the wild. Defender Application Guard for Office and Windows.
Cyber Threat Weekly - #1
This week let's start with an information stealer with a novel anti-sandbox technique, using trigonometry to detect human behavior. Multiple APT groups are exploiting a WinRAR vulnerability. Cl0p’s mass exploitation of MOVEit vulnerabilities is the gift that keeps on giving. The legitimate NetSupport Manager being used for
