CISA adds 17 vulnerabilities to list of bugs exploited in attacks
This week, the Cybersecurity and Infrastructure Security Agency (CISA) added seventeen actively exploited vulnerabilities to the 'Known Exploited Vulnerabilities Catalog. The 'Known Exploited Vulnerabilities Catalog' is a list of vulnerabilities that have been seen abused by threat actors in attacks and that are required to be patched by Federal Civilian Executive Branch (FCEB) agencies. READ MORE...
Phishing impersonates shipping giant Maersk to push STRRAT malware
A new phishing campaign using fake shipping delivery lures installs the STRRAT remote access trojan on unsuspecting victim's devices. Fortinet discovered the new campaign after spotting phishing emails impersonating Maersk Shipping, a giant in the global shipping industry, and using seemingly legitimate email addresses. If the recipient opens the attached document, the macro code that runs fetches the STRRAT malware onto their machine, a powerful remote access trojan. READ MORE...
Alleged carder gang mastermind and three acolytes under arrest in Russia
Russian news agency Tass reported over the weekend that the "purported founder" of a notorious cybercrime group known as Infraud Organisation has been arrested. Naked Security first wrote about law enforcement action against this crime crew almost three years ago, back in February 2018, when the US Department of Justice (DOJ) unleashed indictments against 36 defendants. READ MORE...
McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges
McAfee has patched two high-severity vulnerabilities in a component of its McAfee Enterprise product that attackers can use to escalate privileges, including up to SYSTEM. According to McAfee's bulletin, the bugs are in versions prior to 5.7.5 of McAfee Agent, which is used in McAfee Endpoint Security, among other McAfee products. The Agent is the piece of McAfee ePolicy Orchestrator (McAfee ePO) that downloads and enforces policies and executes client-side tasks such as deployment and updating. READ MORE...
F5 Patches Two Dozen Vulnerabilities in BIG-IP
Cloud security and application delivery solutions provider F5 this week announced patches for 25 vulnerabilities affecting its BIG-IP, BIG-IQ, and NGINX products. A total of 23 security flaws were addressed in the BIG-IP application delivery controller (ADC), including 13 high-severity issues, all of which carry a CVSS score of 7.5. The majority of the high-severity bugs can result in the termination of the Traffic Management Microkernel (TMM). READ MORE...
Supply chain attack used legitimate WordPress add-ons to backdoor sites
Dozens of legitimate WordPress add-ons downloaded from their original sources have been found backdoored through a supply chain attack, researchers said. The backdoor has been found on "quite a few" sites running the open source content management system. The backdoor gave the attackers full administrative control of websites that used at least 93 WordPress plugins and themes downloaded from AccessPress Themes. READ MORE...
- ...in 1908, the first Boy Scout troop is organized in England by Robert Baden-Powell.
- ...in 1947, singer-songwriter Warren Zevon ("Werewolves of London", "Lawyers, Guns and Money") is born in Chicago, IL.
- ...in 1978, comedian and cartoon voice artist Kristen Schaal ("Bob's Burgers", "Gravity Falls") is born in Longmont, CO.
- ...in 1984, the Apple Macintosh personal computer is first sold in the United States.
