Linux Variant of Clop Ransomware Spotted, But Uses Faulty Encryption Algorithm

Linux Variant of Clop Ransomware Spotted, But Uses Faulty Encryption Algorithm,

The first-ever Linux variant of the Clop ransomware has been detected in the wild, but with a faulty encryption algorithm that has made it possible to reverse engineer the process.
« The ELF executable contains a flawed encryption algorithm making it possible to decrypt locked files without paying the ransom, » SentinelOne researcher Antonis Terefos said in a report shared with The Hacker News.

,

The first-ever Linux variant of the Clop ransomware has been detected in the wild, but with a faulty encryption algorithm that has made it possible to reverse engineer the process.
« The ELF executable contains a flawed encryption algorithm making it possible to decrypt locked files without paying the ransom, » SentinelOne researcher Antonis Terefos said in a report shared with The Hacker News.

, ,
https://thehackernews.com/2023/02/linux-variant-of-clop-ransomware.html

VMware Finds No Evidence of 0-Day in Ongoing ESXiArgs Ransomware Spree

VMware Finds No Evidence of 0-Day in Ongoing ESXiArgs Ransomware Spree,

VMware on Monday said it found no evidence that threat actors are leveraging an unknown security flaw, i.e., a zero-day, in its software as part of an ongoing ransomware attack spree worldwide.
« Most reports state that End of General Support (EoGS) and/or significantly out-of-date products are being targeted with known vulnerabilities which were previously addressed and disclosed in VMware

,

VMware on Monday said it found no evidence that threat actors are leveraging an unknown security flaw, i.e., a zero-day, in its software as part of an ongoing ransomware attack spree worldwide.
« Most reports state that End of General Support (EoGS) and/or significantly out-of-date products are being targeted with known vulnerabilities which were previously addressed and disclosed in VMware

, ,
https://thehackernews.com/2023/02/vmware-finds-no-evidence-of-0-day-flaw.html

GuLoader Malware Using Malicious NSIS Executables to Target E-Commerce Industry

GuLoader Malware Using Malicious NSIS Executables to Target E-Commerce Industry,

E-commerce industries in South Korea and the U.S. are at the receiving end of an ongoing GuLoader malware campaign, cybersecurity firm Trellix disclosed late last month.
The malspam activity is notable for transitioning away from malware-laced Microsoft Word documents to NSIS executable files for loading the malware. Other countries targeted as part of the campaign include Germany, Saudi Arabia,

,

E-commerce industries in South Korea and the U.S. are at the receiving end of an ongoing GuLoader malware campaign, cybersecurity firm Trellix disclosed late last month.
The malspam activity is notable for transitioning away from malware-laced Microsoft Word documents to NSIS executable files for loading the malware. Other countries targeted as part of the campaign include Germany, Saudi Arabia,

, ,
https://thehackernews.com/2023/02/guloader-malware-using-malicious-nsis.html

Microsoft: Iranian Nation-State Group Sanctioned by U.S. Behind Charlie Hebdo Hack

Microsoft: Iranian Nation-State Group Sanctioned by U.S. Behind Charlie Hebdo Hack,

An Iranian nation-state group sanctioned by the U.S. government has been attributed to the hack of the French satirical magazine Charlie Hebdo in early January 2023.
Microsoft, which disclosed details of the incident, is tracking the activity cluster under its chemical element-themed moniker NEPTUNIUM, which is an Iran-based company known as Emennet Pasargad.
In January 2022, the U.S. Federal

,

An Iranian nation-state group sanctioned by the U.S. government has been attributed to the hack of the French satirical magazine Charlie Hebdo in early January 2023.
Microsoft, which disclosed details of the incident, is tracking the activity cluster under its chemical element-themed moniker NEPTUNIUM, which is an Iran-based company known as Emennet Pasargad.
In January 2022, the U.S. Federal

, ,
https://thehackernews.com/2023/02/microsoft-iranian-nation-state-group.html

SaaS in the Real World: Who’s Responsible to Secure this Data?

SaaS in the Real World: Who’s Responsible to Secure this Data?

,

When SaaS applications started growing in popularity, it was unclear who was responsible for securing the data. Today, most security and IT teams understand the shared responsibility model, in which the SaaS vendor is responsible for securing the application, while the organization is responsible for securing their data. 
What’s far murkier, however, is where the data responsibility lies on the

,

When SaaS applications started growing in popularity, it was unclear who was responsible for securing the data. Today, most security and IT teams understand the shared responsibility model, in which the SaaS vendor is responsible for securing the application, while the organization is responsible for securing their data. 
What’s far murkier, however, is where the data responsibility lies on the

, ,
https://thehackernews.com/2023/02/saas-in-real-world-whos-responsible-to.html

OpenSSH Releases Patch for New Pre-Auth Double Free Vulnerability

OpenSSH Releases Patch for New Pre-Auth Double Free Vulnerability,

The maintainers of OpenSSH have released OpenSSH 9.2 to address a number of security bugs, including a memory safety vulnerability in the OpenSSH server (sshd).
Tracked as CVE-2023-25136, the shortcoming has been classified as a pre-authentication double free vulnerability that was introduced in version 9.1.
« This is not believed to be exploitable, and it occurs in the unprivileged pre-auth

,

The maintainers of OpenSSH have released OpenSSH 9.2 to address a number of security bugs, including a memory safety vulnerability in the OpenSSH server (sshd).
Tracked as CVE-2023-25136, the shortcoming has been classified as a pre-authentication double free vulnerability that was introduced in version 9.1.
« This is not believed to be exploitable, and it occurs in the unprivileged pre-auth

, ,
https://thehackernews.com/2023/02/openssh-releases-patch-for-new-pre-auth.html

FormBook Malware Spreads via Malvertising Using MalVirt Loader to Evade Detection

FormBook Malware Spreads via Malvertising Using MalVirt Loader to Evade Detection,

An ongoing malvertising campaign is being used to distribute virtualized .NET loaders that are designed to deploy the FormBook information-stealing malware.
« The loaders, dubbed MalVirt, use obfuscated virtualization for anti-analysis and evasion along with the Windows Process Explorer driver for terminating processes, » SentinelOne researchers Aleksandar Milenkoski and Tom Hegel said in a

,

An ongoing malvertising campaign is being used to distribute virtualized .NET loaders that are designed to deploy the FormBook information-stealing malware.
« The loaders, dubbed MalVirt, use obfuscated virtualization for anti-analysis and evasion along with the Windows Process Explorer driver for terminating processes, » SentinelOne researchers Aleksandar Milenkoski and Tom Hegel said in a

, ,
https://thehackernews.com/2023/02/formbook-malware-spreads-via.html

PixPirate: New Android Banking Trojan Targeting Brazilian Financial Institutions

PixPirate: New Android Banking Trojan Targeting Brazilian Financial Institutions,

A new Android banking trojan has set its eyes on Brazilian financial institutions to commit fraud by leveraging the PIX payments platform.
Italian cybersecurity company Cleafy, which discovered the malware between the end of 2022 and the beginning of 2023, is tracking it under the name PixPirate.
« PixPirate belongs to the newest generation of Android banking trojan, as it can perform ATS (

,

A new Android banking trojan has set its eyes on Brazilian financial institutions to commit fraud by leveraging the PIX payments platform.
Italian cybersecurity company Cleafy, which discovered the malware between the end of 2022 and the beginning of 2023, is tracking it under the name PixPirate.
« PixPirate belongs to the newest generation of Android banking trojan, as it can perform ATS (

, ,
https://thehackernews.com/2023/02/pixpirate-new-android-banking-trojan.html

New Wave of Ransomware Attacks Exploiting VMware Bug to Target ESXi Servers

New Wave of Ransomware Attacks Exploiting VMware Bug to Target ESXi Servers,

VMware ESXi hypervisors are the target of a new wave of attacks designed to deploy ransomware on compromised systems.
« These attack campaigns appear to exploit CVE-2021-21974, for which a patch has been available since February 23, 2021, » the Computer Emergency Response Team (CERT) of France said in an advisory on Friday.
VMware, in its own alert released at the time, described the issue as an 

,

VMware ESXi hypervisors are the target of a new wave of attacks designed to deploy ransomware on compromised systems.
« These attack campaigns appear to exploit CVE-2021-21974, for which a patch has been available since February 23, 2021, » the Computer Emergency Response Team (CERT) of France said in an advisory on Friday.
VMware, in its own alert released at the time, described the issue as an 

, ,
https://thehackernews.com/2023/02/new-wave-of-ransomware-attacks.html

Warning: Hackers Actively Exploiting Zero-Day in Fortra’s GoAnywhere MFT

Warning: Hackers Actively Exploiting Zero-Day in Fortra’s GoAnywhere MFT

,

A zero-day vulnerability affecting Fortra’s GoAnywhere MFT managed file transfer application is being actively exploited in the wild.
Details of the flaw were first publicly shared by security reporter Brian Krebs on Mastodon. No public advisory has been published by Fortra.
The vulnerability is a case of remote code injection that requires access to the administrative console of the application

,

A zero-day vulnerability affecting Fortra’s GoAnywhere MFT managed file transfer application is being actively exploited in the wild.
Details of the flaw were first publicly shared by security reporter Brian Krebs on Mastodon. No public advisory has been published by Fortra.
The vulnerability is a case of remote code injection that requires access to the administrative console of the application

, ,
https://thehackernews.com/2023/02/warning-hackers-actively-exploiting.html