Chinese Hackers Exploit VMware Zero-Day to Backdoor Windows and Linux Systems

Chinese Hackers Exploit VMware Zero-Day to Backdoor Windows and Linux Systems,

The Chinese state-sponsored group known as UNC3886 has been found to exploit a zero-day flaw in VMware ESXi hosts to backdoor Windows and Linux systems.
The VMware Tools authentication bypass vulnerability, tracked as CVE-2023-20867 (CVSS score: 3.9), « enabled the execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs without authentication of guest credentials

,

The Chinese state-sponsored group known as UNC3886 has been found to exploit a zero-day flaw in VMware ESXi hosts to backdoor Windows and Linux systems.
The VMware Tools authentication bypass vulnerability, tracked as CVE-2023-20867 (CVSS score: 3.9), « enabled the execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs without authentication of guest credentials

, ,
https://thehackernews.com/2023/06/chinese-hackers-exploit-vmware-zero-day.html

Severe Vulnerabilities Reported in Microsoft Azure Bastion and Container Registry

Severe Vulnerabilities Reported in Microsoft Azure Bastion and Container Registry,

Two « dangerous » security vulnerabilities have been disclosed in Microsoft Azure Bastion and Azure Container Registry that could have been exploited to carry out cross-site scripting (XSS) attacks.
« The vulnerabilities allowed unauthorized access to the victim’s session within the compromised Azure service iframe, which can lead to severe consequences, including unauthorized data access,

,

Two « dangerous » security vulnerabilities have been disclosed in Microsoft Azure Bastion and Azure Container Registry that could have been exploited to carry out cross-site scripting (XSS) attacks.
« The vulnerabilities allowed unauthorized access to the victim’s session within the compromised Azure service iframe, which can lead to severe consequences, including unauthorized data access,

, ,
https://thehackernews.com/2023/06/severe-vulnerabilities-reported-in.html

New Golang-based Skuld Malware Stealing Discord and Browser Data from Windows PCs

New Golang-based Skuld Malware Stealing Discord and Browser Data from Windows PCs,

A new Golang-based information stealer called Skuld has compromised Windows systems across Europe, Southeast Asia, and the U.S.
« This new malware strain tries to steal sensitive information from its victims, » Trellix researcher Ernesto Fernández Provecho said in a Tuesday analysis. « To accomplish this task, it searches for data stored in applications such as Discord and web browsers; information

,

A new Golang-based information stealer called Skuld has compromised Windows systems across Europe, Southeast Asia, and the U.S.
« This new malware strain tries to steal sensitive information from its victims, » Trellix researcher Ernesto Fernández Provecho said in a Tuesday analysis. « To accomplish this task, it searches for data stored in applications such as Discord and web browsers; information

, ,
https://thehackernews.com/2023/06/new-golang-based-skuld-malware-stealing.html

Where from, Where to — The Evolution of Network Security

Where from, Where to — The Evolution of Network Security,

For the better part of the 90s and early aughts, the sysadmin handbook said, « Filter your incoming traffic, not everyone is nice out there » (later coined by Gandalf as « You shall not pass »). So CIOs started to supercharge their network fences with every appliance they could get to protect against inbound (aka INGRESS) traffic.
In the wake of the first mass phishing campaigns in the early 2010s,

,

For the better part of the 90s and early aughts, the sysadmin handbook said, « Filter your incoming traffic, not everyone is nice out there » (later coined by Gandalf as « You shall not pass »). So CIOs started to supercharge their network fences with every appliance they could get to protect against inbound (aka INGRESS) traffic.
In the wake of the first mass phishing campaigns in the early 2010s,

, ,
https://thehackernews.com/2023/06/where-from-where-to-evolution-of.html

Fake Researcher Profiles Spread Malware through GitHub Repositories as PoC Exploits

Fake Researcher Profiles Spread Malware through GitHub Repositories as PoC Exploits,

At least half of dozen GitHub accounts from fake researchers associated with a fraudulent cybersecurity company have been observed pushing malicious repositories on the code hosting service.
All seven repositories, which are still available as of writing, claim to be a proof-of-concept (PoC) exploit for purported zero-day flaws in Discord, Google Chrome, and Microsoft Exchange.
VulnCheck, which

,

At least half of dozen GitHub accounts from fake researchers associated with a fraudulent cybersecurity company have been observed pushing malicious repositories on the code hosting service.
All seven repositories, which are still available as of writing, claim to be a proof-of-concept (PoC) exploit for purported zero-day flaws in Discord, Google Chrome, and Microsoft Exchange.
VulnCheck, which

, ,
https://thehackernews.com/2023/06/fake-researcher-profiles-spread-malware.html

Critical Security Vulnerability Discovered in WooCommerce Stripe Gateway Plugin

Critical Security Vulnerability Discovered in WooCommerce Stripe Gateway Plugin,

A security flaw has been uncovered in the WooCommerce Stripe Gateway WordPress plugin that could lead to the unauthorized disclosure of sensitive information.
The flaw, tracked as CVE-2023-34000, impacts versions 7.4.0 and below. It was addressed by the plugin maintainers in version 7.4.1, which shipped on May 30, 2023.
WooCommerce Stripe Gateway allows e-commerce websites to directly accept

,

A security flaw has been uncovered in the WooCommerce Stripe Gateway WordPress plugin that could lead to the unauthorized disclosure of sensitive information.
The flaw, tracked as CVE-2023-34000, impacts versions 7.4.0 and below. It was addressed by the plugin maintainers in version 7.4.1, which shipped on May 30, 2023.
WooCommerce Stripe Gateway allows e-commerce websites to directly accept

, ,
https://thehackernews.com/2023/06/critical-security-vulnerability.html

Microsoft Releases Updates to Patch Critical Flaws in Windows and Other Software

Microsoft Releases Updates to Patch Critical Flaws in Windows and Other Software,

Microsoft has rolled out fixes for its Windows operating system and other software components to remediate major security shortcomings as part of Patch Tuesday updates for June 2023.
Of the 73 flaws, six are rated Critical, 63 are rated Important, two are rated Moderate, and one is rated Low in severity. This also includes three issues the tech giant addressed in its Chromium-based Edge browser.

,

Microsoft has rolled out fixes for its Windows operating system and other software components to remediate major security shortcomings as part of Patch Tuesday updates for June 2023.
Of the 73 flaws, six are rated Critical, 63 are rated Important, two are rated Moderate, and one is rated Low in severity. This also includes three issues the tech giant addressed in its Chromium-based Edge browser.

, ,
https://thehackernews.com/2023/06/microsoft-releases-updates-to-patch.html

Beware: New DoubleFinger Loader Targets Cryptocurrency Wallets with Stealer

Beware: New DoubleFinger Loader Targets Cryptocurrency Wallets with Stealer,

A novel multi-stage loader called DoubleFinger has been observed delivering a cryptocurrency stealer dubbed GreetingGhoul in what’s an advanced attack targeting users in Europe, the U.S., and Latin America.
« DoubleFinger is deployed on the target machine, when the victim opens a malicious PIF attachment in an email message, ultimately executing the first of DoubleFinger’s loader stages, »

,

A novel multi-stage loader called DoubleFinger has been observed delivering a cryptocurrency stealer dubbed GreetingGhoul in what’s an advanced attack targeting users in Europe, the U.S., and Latin America.
« DoubleFinger is deployed on the target machine, when the victim opens a malicious PIF attachment in an email message, ultimately executing the first of DoubleFinger’s loader stages, »

, ,
https://thehackernews.com/2023/06/beware-new-doublefinger-loader-targets.html

Over Half of Security Leaders Lack Confidence in Protecting App Secrets, Study Reveals

Over Half of Security Leaders Lack Confidence in Protecting App Secrets, Study Reveals,

It might come as a surprise, but secrets management has become the elephant in the AppSec room. While security vulnerabilities like Common Vulnerabilities and Exposures (CVEs) often make headlines in the cybersecurity world, secrets management remains an overlooked issue that can have immediate and impactful consequences for corporate safety. 
A recent study by GitGuardian found that 75% of IT

,

It might come as a surprise, but secrets management has become the elephant in the AppSec room. While security vulnerabilities like Common Vulnerabilities and Exposures (CVEs) often make headlines in the cybersecurity world, secrets management remains an overlooked issue that can have immediate and impactful consequences for corporate safety. 
A recent study by GitGuardian found that 75% of IT

, ,
https://thehackernews.com/2023/06/over-half-of-security-leaders-lack.html

Adversary-in-the-Middle Attack Campaign Hits Dozens of Global Organizations

Adversary-in-the-Middle Attack Campaign Hits Dozens of Global Organizations,

« Dozens » of organizations across the world have been targeted as part of a broad business email compromise (BEC) campaign that involved the use of adversary-in-the-middle (AitM) techniques to carry out the attacks.
« Following a successful phishing attempt, the threat actor gained initial access to one of the victim employee’s account and executed an ‘adversary-in-the-middle’ attack to bypass

,

« Dozens » of organizations across the world have been targeted as part of a broad business email compromise (BEC) campaign that involved the use of adversary-in-the-middle (AitM) techniques to carry out the attacks.
« Following a successful phishing attempt, the threat actor gained initial access to one of the victim employee’s account and executed an ‘adversary-in-the-middle’ attack to bypass

, ,
https://thehackernews.com/2023/06/adversary-in-middle-attack-campaign.html