CVE-2019-0708
published 2019-05-16CVE-2019-0708: A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
100.00%
100.0th percentile
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
Affected
67 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| huawei | agile_controller-campus_firmware | — | — |
| huawei | agile_controller-campus_firmware | — | — |
| huawei | bh620_v2_firmware | — | — |
| huawei | bh621_v2_firmware | — | — |
| huawei | bh622_v2_firmware | — | — |
| huawei | bh640_v2_firmware | — | — |
| huawei | ch121_firmware | — | — |
| huawei | ch140_firmware | — | — |
| huawei | ch220_firmware | — | — |
| huawei | ch221_firmware | — | — |
| huawei | ch222_firmware | — | — |
| huawei | ch240_firmware | — | — |
| huawei | ch242_firmware | — | — |
| huawei | ch242_v3_firmware | — | — |
| huawei | e6000_chassis_firmware | — | — |
| huawei | e6000_firmware | — | — |
| huawei | elog_firmware | — | — |
| huawei | espace_ecs_firmware | — | — |
| huawei | gtsoftx3000_firmware | — | — |
| huawei | gtsoftx3000_firmware | — | — |
| huawei | gtsoftx3000_firmware | — | — |
| huawei | oceanstor_18500_firmware | — | — |
| huawei | oceanstor_18800_firmware | — | — |
| huawei | oceanstor_18800f_firmware | — | — |
| huawei | oceanstor_hvs85t_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The 'Frenchy' custom AutoIT packer checks for 'vmtoolsd.exe' and 'vbox.exe' at runtime; presence of these process checks in an AutoIT-delivered sample is a behavioral indicator of this packer family. ↗
- →The 'Frenchy' packer achieves persistence by creating a shortcut inside the user's startup directory and drops a VisualBasic script plus a copy of itself into an arbitrary folder under the user's profile directory. ↗
- →The 'Frenchy' packer uses two UAC bypass techniques: event viewer UAC bypass for Windows 7/8 targets, and fodhelper for Windows 10 targets. ↗
- →The 'Frenchy' packer uses process hollowing and injects into different legitimate Microsoft executables depending on the resource type embedded in the sample. ↗
- →Fortinet detects the 'Frenchy' packer family (used to deliver Lokibot and other malware) under the signature name AutoIt/Injector.ELI!tr. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2019-0708 [CRITICAL] CWE-416 Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Vulnerability: Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Affected: Microsoft Remote Desktop Services
Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-0708
Remediation Due Date: 2022-05-03
Microsoft
Remote Desktop Services Remote Code Execution Vulnerability
vendor_msrc·2019-05-14·CVSS 9.8
CVE-2019-0708 [CRITICAL] Remote Desktop Services Remote Code Execution Vulnerability
Remote Desktop Services Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.
The update addresses the vulnerability by correcting how R
GHSA
GHSA-fq64-gmq7-jjvg: A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects
ghsa_unreviewed·2022-05-24
CVE-2019-0708 [CRITICAL] CWE-416 GHSA-fq64-gmq7-jjvg: A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
VulnCheck
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
vulncheck·2019·CVSS 9.8
CVE-2019-0708 [CRITICAL] CWE-416 Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.
Affected: Microsoft Remote Desktop Services
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://securelist.com/apt-trends-report-q2-2019/91897/; https://www.microsoft.com/en-us/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/; https://blog.sonicwall.com/en-us/2019/12/top-c
Suricata
ET EXPLOIT [NCC GROUP] Possible Bluekeep Inbound RDP Exploitation Attempt (CVE-2019-0708)
suricata·2019-05-21·CVSS 9.8
CVE-2019-0708 [CRITICAL] ET EXPLOIT [NCC GROUP] Possible Bluekeep Inbound RDP Exploitation Attempt (CVE-2019-0708)
ET EXPLOIT [NCC GROUP] Possible Bluekeep Inbound RDP Exploitation Attempt (CVE-2019-0708)
Rule: alert tcp any any -> any 3389 (msg:"ET EXPLOIT [NCC GROUP] Possible Bluekeep Inbound RDP Exploitation Attempt (CVE-2019-0708)"; flow:established,to_server; content:"|03 00|"; depth:2; content:"|02 f0|"; distance:2; within:2; content:"|00 05 00 14 7c 00 01|"; within:512; content:"|03 c0|"; distance:3; within:384; content:"MS_T120|00|"; distance:6; within:372; nocase; fast_pattern; threshold: type limit, track by_src, count 2, seconds 600; reference:cve,CVE-2019-0708; reference:url,portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708; reference:url,github.com/nccgroup/Cyber-Defence/blob/master/Signatures/suricata/2019_05_rdp_cve_2019_0708.txt; classtype:attempted-admin; sid:20
Sigma
Terminal Service Process Spawn
sigma·CVSS 9.8
CVE-2019-0708 [CRITICAL] Terminal Service Process Spawn
Terminal Service Process Spawn
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Detection:
condition: selection and not 1 of filter_*
filter_img:
Image|endswith:
- \rdpclip.exe
- :\Windows\System32\csrss.exe
- :\Windows\System32\wininit.exe
- :\Windows\System32\winlogon.exe
filter_null:
Image: null
selection:
ParentCommandLine|contains|all:
- \svchost.exe
- termsvcs
Log Source: category: process_creation
product: windows
Exploit-DB
Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free
exploitdb·2019-11-19
CVE-2019-0708 Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free
Microsoft Windows 7 (x86) - 'BlueKeep' Remote Desktop Protocol (RDP) Remote Windows Kernel Use After Free
---
# EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47683.zip
import rdp
import socket
import binascii
import time
def pool_spray(s, crypter, payload):
times = 10000
count = 0
while count < times:
count += 1
#print('time through %d' % count)
try:
s.sendall(rdp.write_virtual_channel(crypter, 7, 1005, payload))
except ConnectionResetError:
print('ConnectionResetError pool_spray Aborting')
quit()
def main():
# change to your target
host = '192.168.0.46'
port = 3389
times = 4000
count = 0
target = (host, port)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(target)
crypter = rdp.connect(s)
# this add
Exploit-DB
Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)
exploitdb·2019-09-24
CVE-2019-0708 Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)
Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
# Exploitation and Caveats from zerosum0x0:
#
# 1. Register with channel MS_T120 (and others such as RDPDR/RDPSND) nominally.
# 2. Perform a full RDP handshake, I like to wait for RDPDR handshake too (code in the .py)
# 3. Free MS_T120 with the DisconnectProviderIndication message to MS_T120.
# 4. RDP has chunked messages, so we use this to groom.
# a. Chunked messaging ONLY works properly when sent to RDPSND/MS_T120.
# b. However, on 7+, MS_T120 will not work and you have to use RDPSND.
# i. RDPSND only works when
# HKLM\SYSTEM\CurrentControlSet\Control\TerminalSer
Exploit-DB
Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service (Metasploit)
exploitdb·2019-07-15·CVSS 9.8
CVE-2019-0708 [CRITICAL] Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service (Metasploit)
Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service (Metasploit)
---
# Exploit Title: Bluekeep Denial of Service (metasploit module)
# Shodan Dork: port:3389
# Date: 07/14/2019
# Exploit Author: RAMELLA Sebastien (https://github.com/mekhalleh/)
# Vendor Homepage: https://microsoft.com
# Version: all affected RDP services by cve-2019-0708
# Tested on: Windows XP (32-bits) / Windows 7 (64-bits)
# CVE : 2019-0708
# I just modified the initial metasploit module for this vuln to produce a denial of service attack.
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE',
'Description' => %q{
This module checks a range of ho
Exploit-DB
Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service
exploitdb·2019-05-30
CVE-2019-0708 Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service
Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service
---
import socket, sys, struct
from OpenSSL import SSL
from impacket.structure import Structure
# I'm not responsible for what you use this to accomplish and should only be used for education purposes
# Could clean these up since I don't even use them
class TPKT(Structure):
commonHdr = (
('Version','B=3'),
('Reserved','B=0'),
('Length','>H=len(TPDU)+4'),
('_TPDU','_-TPDU','self["Length"]-4'),
('TPDU',':=""'),
)
class TPDU(Structure):
commonHdr = (
('LengthIndicator','B=len(VariablePart)+1'),
('Code','B=0'),
('VariablePart',':=""'),
)
def __init__(self, data = None):
Structure.__init__(self,data)
self['VariablePart']=''
class CR_TPDU(Structure):
commonHdr = (
('DST-REF','h", len(p))
size1 = struct.pack(">h", len(p)-12)
si
Metasploit
CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check
metasploit·CVSS 9.8
CVE-2019-0708 [CRITICAL] CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check
CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check
This module checks a range of hosts for the CVE-2019-0708 vulnerability by binding the MS_T120 channel outside of its normal slot and sending non-DoS packets which respond differently on patched and vulnerable hosts. It can optionally trigger the DoS vulnerability.
Metasploit
CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free
metasploit·CVSS 9.8
CVE-2019-0708 [CRITICAL] CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free
CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free
The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120, allowing a malformed Disconnect Provider Indication message to cause use-after-free. With a controllable data/size remote nonpaged pool spray, an indirect call gadget of the freed channel is used to achieve arbitrary code execution. Windows 7 SP1 and Windows Server 2008 R2 are the only currently supported targets. Windows 7 SP1 should be exploitable in its default configuration, assuming your target selection is correctly matched to the system's memory layout. HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer\Winstations\RDP-Tcp\fDisableCam *needs* to be set to 0 for exploitation to succeed against Windows Server 2008 R2. This is a non-sta
Hackernews
ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories
blogs_hackernews·2026-04-30
CVE-2019-0708 ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories
The internet is noisy this week. We are seeing some wild new tactics, like people using fake cell towers to send scam texts, while some developers are accidentally downloading tools that peek into their private files during a simple install. It is definitely a busy time to be online.
Security is always a moving target. Millions of servers are currently sitting online without any passwords, and old software bugs are showing up in the most unexpected places. Even with the right fixes available, staying one step ahead is a full-time job
Greynoiseio
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
blogs_greynoiseio·2026-02-02
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
Nearly 2,000 Malicious IPs Probe Microsoft Remote Desktop After Single-Day Surge
blogs_greynoiseio·2025-08-25
Nearly 2,000 Malicious IPs Probe Microsoft Remote Desktop After Single-Day Surge
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations
blogs_qualys·2025-05-08
Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations
## Table of Contents
Who is LockBit? How it Evolved and Operates
Monero: The Coin of the Realm
Patch or Mitigate Now: Critical CVEs Exploited by LockBit
Beyond Traditional Endpoints: Other Compromised Systems
Initial Access and Deployment
Conclusion
The LockBit ransomware gang recently suffered a significant data breach. Their dark web affiliate panels were defaced with the message “Don’t do crime CRIME IS BAD xoxo from Prague,” linking to a MySQL database dump. This archive contains a SQL file from LockBit’s affiliate panel database that includes twenty tables, notably including a ‘btc_addresses’ table with 59,975 unique bitcoin addresses and a ‘chats’ table containing over 4,400 victim negotiation messages from December 2024 to the end of April 2025.
This blog post will leverage
Trendmicro
Unmasking Prometei A Deep Dive Into Our MXDR Findings
blogs_trendmicro·2024-10-23·CVSS 9.8
[CRITICAL] Unmasking Prometei A Deep Dive Into Our MXDR Findings
Cyber Threats
# Unmasking Prometei: A Deep Dive Into Our MXDR Findings
How does Prometei insidiously operate in a compromised system? This Managed Extended Detection and Response investigation conducted with the help of Trend Vision One provides a comprehensive analysis of the inner workings of this botnet so users can stop the threat in its tracks before it inflicts damage to the system.
By: Buddy Tancio, Bren Matthew Ebriega, Mohamed Fahmy
2024/10/23
Read time: ( words)
Save to Folio
Key Takeaways
- The botnet Prometei was used in an attempt to infiltrate a customer’s system through what appeared to be a targeted brute force attack.
- Our Managed Extended Detection and Response investigation leveraged Trend Vision One and its response actions to detect and mitigate the attack proa
Tenable
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
blogs_tenable·2024-10-22
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
blogs_tenable·2023-08-03
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Fortinet
Meet LockBit: The Most Prevalent Ransomware in 2022 | FortiGuard Labs
blogs_fortinet·2023-07-10
Meet LockBit: The Most Prevalent Ransomware in 2022 | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Meet LockBit: The Most Prevalent Ransomware in 2022
By Shunichi Imano and James Slaughter | July 10, 2023
Affected platforms: Microsoft Windows, Linux, ESXi, MacOS
Impacted parties: Microsoft Windows, Linux, ESXi, and MacOS Users
Impact: Encrypts and exfiltrates victims’ files and demands ransom for file decryption and not to leak stolen files
Severity level: High
On June 14th, 2023, the CISA, FBI, MS-ISAC, and multiple international cyber security organizations released a joint advisory for the LockBit ransomware. This ransomware group has been active since early 2020, targeting organizations across numerous industries, including energy and government sectors. According to the advisory, LockBit was the most active ransomware in 2022.
This blog provides
Talos
Prometei botnet improves modules and exhibits new capabilities in recent updates
blogs_talos·2023-03-09
Prometei botnet improves modules and exhibits new capabilities in recent updates
- Prometei botnet continued its activity since Cisco Talos first reported about it in 2020. Since November 2022, we have observed Prometei improving the infrastructure components and capabilities. More specifically, the botnet operators updated certain submodules of the execution chain to automate processes and challenge forensic analysis methods.
- We assess with high confidence that v3 of the Prometei botnet is of medium size, with more than 10,000 infected systems worldwide, based on data obtained by sinkholing the DGA domains over a period of one week in February 2023.
- Based on open-source intelligence, the actors have also been actively spreading improved Linux versions of the Prometei bot, continuously improving the current version, v3.
- We have observed previously undocumented fu
Talos
Prometei botnet improves modules and exhibits new capabilities in recent updates
blogs_talos·2023-03-09
Prometei botnet improves modules and exhibits new capabilities in recent updates
## Prometei botnet improves modules and exhibits new capabilities in recent updates
Prometei botnet continued its activity since Cisco Talos first reported about it in 2020. Since November 2022, we have observed Prometei improving the infrastructure components and capabilities. More specifically, the botnet operators updated certain submodules of the execution chain to automate processes and challenge forensic analysis methods.
We assess with high confidence that v3 of the Prometei botnet is of medium size, with more than 10,000 infected systems worldwide, based on data obtained by sinkholing the DGA domains over a period of one week in February 2023.
Based on open-source intelligence, the actors have also been actively spreading improved Linux versions of the Prometei bot, continuously
Trendmicro
Uncovering a Kingminer Botnet Attack Using Trend Micro Managed XDR
blogs_trendmicro·2022-05-18
Uncovering a Kingminer Botnet Attack Using Trend Micro Managed XDR
## Uncovering a Kingminer Botnet Attack Using Trend Micro™ Managed XDR
Trend Micro’s Managed XDR team addressed a Kingminer botnet attack conducted through an SQL exploit. We discuss our findings and analysis in this report.
By: Buddy Tancio, Jed Valderama May 18, 2022 Read time: ( words)
Save to Folio
We observed malicious activities in a client’s SQL server that flagged a potential exploit in one public-facing device. A quick look at the Trend Micro Vision One™ Workbench showed that a Microsoft SQL server process created an obfuscated PowerShell command. This suggested that the machine had been compromised, prompting us to investigate further.
The tactics, techniques, and procedures (TTPs) discussed here reflect many of the TTPs that threat researchers have identified with the Kingm
Trendmicro
Uncovering a Kingminer Botnet Attack Using Trend Micro Managed XDR
blogs_trendmicro·2022-05-18
Uncovering a Kingminer Botnet Attack Using Trend Micro Managed XDR
# Uncovering a Kingminer Botnet Attack Using Trend Micro™ Managed XDR
Trend Micro’s Managed XDR team addressed a Kingminer botnet attack conducted through an SQL exploit. We discuss our findings and analysis in this report.
By: Buddy Tancio, Jed Valderama
2022/05/18
Read time: ( words)
Save to Folio
We observed malicious activities in a client’s SQL server that flagged a potential exploit in one public-facing device. A quick look at the Trend Micro Vision One™ Workbench showed that a Microsoft SQL server process created an obfuscated PowerShell command. This suggested that the machine had been compromised, prompting us to investigate further.
The tactics, techniques, and procedures (TTPs) discussed here reflect many of the TTPs that threat researchers have identified with the Kingmin
Trendmicro
Uncovering a Kingminer Botnet Attack Using Trend Micro Managed XDR
blogs_trendmicro·2022-05-18
Uncovering a Kingminer Botnet Attack Using Trend Micro Managed XDR
## Uncovering a Kingminer Botnet Attack Using Trend Micro™ Managed XDR
Trend Micro’s Managed XDR team addressed a Kingminer botnet attack conducted through an SQL exploit. We discuss our findings and analysis in this report.
By: Buddy Tancio, Jed Valderama 2022/05/18 Read time: ( words)
Save to Folio
We observed malicious activities in a client’s SQL server that flagged a potential exploit in one public-facing device. A quick look at the Trend Micro Vision One™ Workbench showed that a Microsoft SQL server process created an obfuscated PowerShell command. This suggested that the machine had been compromised, prompting us to investigate further.
The tactics, techniques, and procedures (TTPs) discussed here reflect many of the TTPs that threat researchers have identified with the Kingmin
Fortinet
Fresh TOTOLINK Vulnerabilities Picked Up by Beastmode Mirai Campaign
blogs_fortinet·2022-04-01·CVSS 9.8
[CRITICAL] Fresh TOTOLINK Vulnerabilities Picked Up by Beastmode Mirai Campaign
FORTIGUARD LABS THREAT RESEARCH
Fresh TOTOLINK Vulnerabilities Picked Up by Beastmode Mirai Campaign
By Joie Salvio and Roy Tay | April 01, 2022
Between February and March 2022, our FortiGuard Labs team observed that the Beastmode (aka B3astmode) Mirai-based DDoS campaign has aggressively updated its arsenal of exploits. Five new exploits were added within a month, with three targeting various models of TOTOLINK routers.
This inclusion of TOTOLINK exploits is especially noteworthy as they were added just a week after the exploit codes were published on GitHub. We previously reported on the MANGA campaign, which similarly adopted exploit code within weeks of their release.
By rapidly adopting newly released exploit code, threat actors can potentially infect vulnerable devices and expan
Fortinet
New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits
blogs_fortinet·2022-03-30
New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits
FORTIGUARD LABS THREAT RESEARCH
New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili Rootkits
By Rotem Sde-Or and Eliran Voronovitch | March 30, 2022
During the past month, FortiEDR detected a campaign by Deep Panda, a Chinese APT group. The group exploited the infamous Log4Shell vulnerability in VMware Horizon servers. The nature of targeting was opportunistic insofar that multiple infections in several countries and various sectors occurred on the same dates. The victims belong to the financial, academic, cosmetics, and travel industries.
Following exploitation, Deep Panda deployed a backdoor on the infected machines. Following forensic leads from the backdoor led us to discover a novel kernel rootkit signed with a stolen digital certificate. We found that the sam
Fortinet
Spoofed Invoice Used to Drop IcedID | FortiGuard Labs
blogs_fortinet·2022-03-28
Spoofed Invoice Used to Drop IcedID | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Spoofed Invoice Used to Drop IcedID
By James Slaughter | March 28, 2022
Spearphishing crafted with industry-specific terms derived from intelligence gathering techniques to trick a recipient into opening a file is especially difficult to identify. This is especially true when an adversary has knowledge of how a business works and the processes that underpin it. Using this knowledge, a lure can be crafted that takes advantage of these day-to-day processes – for example, settling the cost of a fuel transaction.
FortiGuard Labs recently encountered such a scenario, where a fuel company in Kyiv, Ukraine received a spearphishing e-mail that contained an attached invoice—seemingly from another fuel provider—that was spoofed. The attachment is a zip file that c
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Tenable
Examining the Treat Landscape
blogs_tenable·2021-10-29
Examining the Treat Landscape
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Roundup for August 20 to August 27
blogs_talos·2021-08-27
Threat Roundup for August 20 to August 27
## Threat Roundup for August 20 to August 27
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 20 and Aug. 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for August 20 to August 27
blogs_talos·2021-08-27
Threat Roundup for August 20 to August 27
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 20 and Aug. 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for July 9 to July 16
blogs_talos·2021-07-16
Threat Roundup for July 9 to July 16
## Threat Roundup for July 9 to July 16
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 9 and July 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subje
Talos
Threat Roundup for July 9 to July 16
blogs_talos·2021-07-16
Threat Roundup for July 9 to July 16
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 9 and July 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for July 2 to July 9
blogs_talos·2021-07-09
Threat Roundup for July 2 to July 9
## Threat Roundup for July 2 to July 9
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 2 and July 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for thet following threats is subjec
Talos
Threat Roundup for July 2 to July 9
blogs_talos·2021-07-09
Threat Roundup for July 2 to July 9
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 2 and July 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for thet following threats is subject to updates, pending additional threat
Talos
Threat Roundup for June 25 to July 2
blogs_talos·2021-07-02
Threat Roundup for June 25 to July 2
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 25 and July 2. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for June 25 to July 2
blogs_talos·2021-07-02
Threat Roundup for June 25 to July 2
## Threat Roundup for June 25 to July 2
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 25 and July 2. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subje
Talos
Threat Roundup for June 18 to June 25
blogs_talos·2021-06-25
Threat Roundup for June 18 to June 25
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 18 and June 25. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for June 18 to June 25
blogs_talos·2021-06-25
Threat Roundup for June 18 to June 25
## Threat Roundup for June 18 to June 25
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 18 and June 25. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is sub
Talos
Threat Roundup for June 11 to June 17
blogs_talos·2021-06-17
Threat Roundup for June 11 to June 17
## Threat Roundup for June 11 to June 17
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 11 and June 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is sub
Talos
Threat Roundup for June 11 to June 17
blogs_talos·2021-06-17
Threat Roundup for June 11 to June 17
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 11 and June 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for May 28 to June 4
blogs_talos·2021-06-04
Threat Roundup for May 28 to June 4
## Threat Roundup for May 28 to June 4
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 28 and June 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject
Talos
Threat Roundup for May 28 to June 4
blogs_talos·2021-06-04
Threat Roundup for May 28 to June 4
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 28 and June 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat o
Talos
Threat Roundup for May 21 to May 28
blogs_talos·2021-05-28
Threat Roundup for May 21 to May 28
## Threat Roundup for May 21 to May 28
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 21 and May 28. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject
Talos
Threat Roundup for May 21 to May 28
blogs_talos·2021-05-28
Threat Roundup for May 21 to May 28
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 21 and May 28. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat o
Talos
Threat Roundup for May 7 to May 14
blogs_talos·2021-05-14
Threat Roundup for May 7 to May 14
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 7 and May 14. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threatsbubl in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threa
Talos
Threat Roundup for May 7 to May 14
blogs_talos·2021-05-14
Threat Roundup for May 7 to May 14
## Threat Roundup for May 7 to May 14
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 7 and May 14. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threatsbubl in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subje
Talos
Threat Roundup for April 30 to May 7
blogs_talos·2021-05-07
Threat Roundup for April 30 to May 7
## Threat Roundup for April 30 to May 7
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 30 and May 7. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subje
Talos
Threat Roundup for April 30 to May 7
blogs_talos·2021-05-07
Threat Roundup for April 30 to May 7
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 30 and May 7. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Cyberbedrohungen
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay Apr 28, 2021 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabili
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Cyber Threats
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay 2021/04/28 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabilities
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Minacce cyber
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay Apr 28, 2021 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabilitie
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Ciberamenazas
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay Apr 28, 2021 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabilitie
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Cyber Threats
## How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay Apr 28, 2021 Read time: ( words)
Save to Folio
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands of new vulnerabilitie
Trendmicro
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
blogs_trendmicro·2021-04-28
Manage Zero Day Exploits (ZDI) with Trend Micro Solutions
Cyber Threats
# How Trend Micro Helps Manage Exploited Vulnerabilities
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Read how Trend Micro protects customers from vulnerability exploits by blocking them as early as possible.
By: Jon Clay
2021/04/28
Read time: ( words)
Save to Folio
Photo credit: pxhere
As technological innovations evolve, protecting companies from cyber threats tomorrow secures their businesses today. Exploiting known vulnerabilities to successfully compromise an organization has long been a common tactic used by malicious actors. Whether Heartbleed, EternalBlue, or most recently Zerologon, threat actors take advantage of newly disclosed vulnerabilities in their attacks. But even with thousands o
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
CVE-2020-28188 [HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
# Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020. Several newly observed exploits, including CVE-2020-28188, CVE-2020-17519, and CVE-2020-29227, have emerged and were continuously being exploited in the wild as of late 2020 to early 2021.
This blog provides details of the newly observed exploits as well as a dive deep into the exploitation analysis, vendor analysis, attack origin, and attack category distribution.
Palo Alto Networks Next-Generation Firewall customers are protected from these attacks with the URL Filtering an
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
[HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (November 2020-January 2021)
Lei Xu
Yue Guan
Vaibhav Singhal
Published: April 12, 2021
Malware
Trend Reports
Vulnerabilities
Botnet
DDoS
Exploit kit
IoT
Network security trends
## Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020 . Several newly observed exploits, including CVE-2020-28188 , CVE-2020-17519 , and CVE-2020-29227 , have emerged and were continuously being exploited in the wild as of late 2020 to earl
Talos
Threat Roundup for April 2 to April 9
blogs_talos·2021-04-09
Threat Roundup for April 2 to April 9
## Threat Roundup for April 2 to April 9
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 2 and April 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is sub
Talos
Threat Roundup for April 2 to April 9
blogs_talos·2021-04-09
Threat Roundup for April 2 to April 9
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 2 and April 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for March 26 to April 2
blogs_talos·2021-04-02
Threat Roundup for March 26 to April 2
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 26 and April 2. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for theinyban following threats is subject to updates, pending additional
Talos
Threat Roundup for March 26 to April 2
blogs_talos·2021-04-02
Threat Roundup for March 26 to April 2
## Threat Roundup for March 26 to April 2
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 26 and April 2. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for theinyban following threat
Talos
Threat Roundup for March 5 to March 12
blogs_talos·2021-03-12
Threat Roundup for March 5 to March 12
## Threat Roundup for March 5 to March 12
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 5 and March 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats. As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is su
Talos
Threat Roundup for March 5 to March 12
blogs_talos·2021-03-12
Threat Roundup for March 5 to March 12
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 5 and March 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats. As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Tenable
Healthcare Security: Ransomware Plays a Prominent Role in COVID-19 Era Breaches
blogs_tenable·2021-03-10
Healthcare Security: Ransomware Plays a Prominent Role in COVID-19 Era Breaches
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Roundup for February 26 to March 5
blogs_talos·2021-03-05
Threat Roundup for February 26 to March 5
## Threat Roundup for February 26 to March 5
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 26 and March 5. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for February 26 to March 5
blogs_talos·2021-03-05
Threat Roundup for February 26 to March 5
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 26 and March 5. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for February 19 to February 26
blogs_talos·2021-02-26
Threat Roundup for February 19 to February 26
## Threat Roundup for February 19 to February 26
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 19 and Feb. 26. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threat
Talos
Threat Roundup for February 19 to February 26
blogs_talos·2021-02-26
Threat Roundup for February 19 to February 26
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 19 and Feb. 26. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for February 12 to February 19
blogs_talos·2021-02-19
Threat Roundup for February 12 to February 19
## Threat Roundup for February 12 to February 19
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 12 and Feb. 19. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threat
Talos
Threat Roundup for February 12 to February 19
blogs_talos·2021-02-19
Threat Roundup for February 12 to February 19
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 12 and Feb. 19. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for February 5 to February 12
blogs_talos·2021-02-12
Threat Roundup for February 5 to February 12
## Threat Roundup for February 5 to February 12
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 5 and Feb. 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for February 5 to February 12
blogs_talos·2021-02-12
Threat Roundup for February 5 to February 12
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 5 and Feb. 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for January 29 to February 5
blogs_talos·2021-02-05
Threat Roundup for January 29 to February 5
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 29 and Feb. 5. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threatsx we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Qualys
Unpacking the CVEs in the FireEye Breach – Start Here First
blogs_qualys·2021-02-01·CVSS 7.8
CVE-2020-1472 [HIGH] Unpacking the CVEs in the FireEye Breach – Start Here First
In a blog post on Dec. 22, 2020, Qualys revealed it has identified 7.5 million instances of vulnerability to the stolen FireEye Red Team assessment tools across an anonymized set of its 15,700-member customer base.
Of the 7.5 million instances of vulnerability, 99.84% were caused by only 8 CVEs, and over 99% were caused by these five CVEs: CVE-2020-1472, CVE-2019-0604, CVE-2017-11774, CVE-2016-0167 and CVE-2019-0708.
In this article, we examine the five CVEs in detail to:
Help SOC and operational security teams understand the behavioral aspects of these CVEs and plan defensive strategies;
Help threat hunting teams understand their threat attributes and associated attack vectors and take defensive actions against adversaries actively exploiting these CVEs.
From a threat perspective, we
Qualys
Unpacking the CVEs in the FireEye Breach - Start Here First | Qualys
blogs_qualys·2021-02-01·CVSS 7.8
CVE-2020-1472 [HIGH] Unpacking the CVEs in the FireEye Breach - Start Here First | Qualys
In a blog post on Dec. 22, 2020, Qualys revealed it has identified 7.5 million instances of vulnerability to the stolen FireEye Red Team assessment tools across an anonymized set of its 15,700-member customer base.
Of the 7.5 million instances of vulnerability, 99.84% were caused by only 8 CVEs, and over 99% were caused by these five CVEs: CVE-2020-1472, CVE-2019-0604, CVE-2017-11774, CVE-2016-0167 and CVE-2019-0708.
In this article, we examine the five CVEs in detail to:
1. Help SOC and operational security teams understand the behavioral aspects of these CVEs and plan defensive strategies;
2. Help threat hunting teams understand their threat attributes and associated attack vectors and take defensive actions against adversaries actively exploiting these CVEs.
From a threat perspectiv
Talos
Threat Roundup for January 15 to January 22
blogs_talos·2021-01-22
Threat Roundup for January 15 to January 22
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 15 and Jan. 22. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for January 15 to January 22
blogs_talos·2021-01-22
Threat Roundup for January 15 to January 22
## Threat Roundup for January 15 to January 22
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 15 and Jan. 22. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for January 8 to January 15
blogs_talos·2021-01-15
Threat Roundup for January 8 to January 15
## Threat Roundup for January 8 to January 15
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 8 and Jan. 15. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for January 8 to January 15
blogs_talos·2021-01-15
Threat Roundup for January 8 to January 15
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 8 and Jan. 15. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Qualys
Qualys Security Advisory: SolarWinds / FireEye | Qualys
blogs_qualys·2020-12-22
Qualys Security Advisory: SolarWinds / FireEye | Qualys
#### Qualys Researchers found Millions of devices exposed to vulnerabilities used in the stolen FireEye Red Team tools and SolarWinds Orion by analyzing the anonymized set of vulnerabilities across Qualys’ worldwide customer base
##### Qualys to offer a free 60-day integrated Vulnerability Management, Detection and Response service to help organizations quickly assess the devices impacted by SolarWinds Orion vulnerabilities, SUNBURST Trojan detections, or FireEye Red Team tools, and to remediate them and track their remediation via dynamic dashboards. Register athttps://www.qualys.com/solarhack/
On Dec 8, FireEye disclosed the theft of its Red Team assessment tools which leverage over 16 known CVE’s to exploit client environments to test and validate their security posture. FireEye also
Qualys
Qualys Security Advisory: SolarWinds / FireEye
blogs_qualys·2020-12-22
Qualys Security Advisory: SolarWinds / FireEye
## Qualys Researchers found Millions of devices exposed to vulnerabilities used in the stolen FireEye Red Team tools and SolarWinds Orion by analyzing the anonymized set of vulnerabilities across Qualys’ worldwide customer base
## Qualys to offer a free 60-day integrated Vulnerability Management, Detection and Response service to help organizations quickly assess the devices impacted by SolarWinds Orion vulnerabilities, SUNBURST Trojan detections, or FireEye Red Team tools, and to remediate them and track their remediation via dynamic dashboards. Register at https://www.qualys.com/solarhack/
On Dec 8, FireEye disclosed the theft of its Red Team assessment tools which leverage over 16 known CVE’s to exploit client environments to test and validate their security posture. FireEye also conf
Talos
Threat Roundup for December 11 to December 18
blogs_talos·2020-12-18
Threat Roundup for December 11 to December 18
## Threat Roundup for December 11 to December 18
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 11 and Dec. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threat
Talos
Threat Roundup for December 11 to December 18
blogs_talos·2020-12-18
Threat Roundup for December 11 to December 18
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 11 and Dec. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Unit42
Threat Brief: FireEye Red Team Tool Breach
blogs_unit42·2020-12-11
Threat Brief: FireEye Red Team Tool Breach
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: FireEye Red Team Tool Breach
Unit 42
Published: December 10, 2020
High Profile Threats
Malware
Vulnerabilities
FireEye breach
## Executive Summary
On Dec. 8, 2020, one of the leading cybersecurity companies in the industry, FireEye, reported a breach and data exfiltration unlike any that we have seen previously. What makes this attack unique is not only the target, FireEye being a well-known cybersecurity company, but that the stolen data contains the internal, custom-crafted red-team and penetration testing tools used by the company to imitate different threat actors during customer security consultations. FireEye’s blog provided a wealth of information for defenders to implement security controls
Talos
Threat Roundup for December 4 to December 11
blogs_talos·2020-12-11
Threat Roundup for December 4 to December 11
## Threat Roundup for December 4 to December 11
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 4 and Dec. 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Unit42
Threat Brief: FireEye Red Team Tool Breach
blogs_unit42·2020-12-11
Threat Brief: FireEye Red Team Tool Breach
## Executive Summary
On Dec. 8, 2020, one of the leading cybersecurity companies in the industry, FireEye, reported a breach and data exfiltration unlike any that we have seen previously. What makes this attack unique is not only the target, FireEye being a well-known cybersecurity company, but that the stolen data contains the internal, custom-crafted red-team and penetration testing tools used by the company to imitate different threat actors during customer security consultations. FireEye’s blog provided a wealth of information for defenders to implement security controls and mitigations for defense against the stolen tools. This data is being used by Palo Alto Networks to help ensure our customers are protected if the attackers choose to utilize the tools for malicious purposes.
It i
Talos
Threat Roundup for December 4 to December 11
blogs_talos·2020-12-11
Threat Roundup for December 4 to December 11
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 4 and Dec. 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Fortinet
FireEye Red Team Tool Breach | Fortinet
blogs_fortinet·2020-12-11·CVSS 8.8
[HIGH] FireEye Red Team Tool Breach | Fortinet
PSIRT BLOGS
FireEye Red Team Tool Breach
By Carl Windsor | December 11, 2020
Executive Summary
On December 8th cyber security vendor FireEye reported a breach of their network and data exfiltration which included their internally developed Red Team tools. FireEye took the step of publishing details of these tools in a GitHub repository to allow other vendors to protect against their use by potential adversaries.
This breach has been attributed to a nation state threat actor so we do not expect to see these tools be widely abused in the wild, however with the additional information provided by FireEye, Fortinet have been able to ensure that these tools cannot be abused.
Threat Mitigation
None of the vulnerabilities disclosed as targeted in the tools were zero days, therefore FortiGuard
Qualys
Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach
blogs_qualys·2020-12-10
Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach
Update Jan 5, 2021 : New patching section with two new dashboard widgets showing the number of missing FireEye-related patches in your environment and the number of assets in your environment missing one of those patches.
Update Dec 23, 2020 : Added a new section on compensating controls.
Update Dec 22, 2020: FireEye disclosed the theft of their Red Team assessment tools. Hackers now have an influential collection of new techniques to draw upon.
Using Qualys VMDR, the vulnerabilities for Solorigate/SUNBURST can be prioritized for the following Real-Time Threat Indicators (RTIs):
Active Attacks
Solorigate Sunburst ( New RTI )
Original post : On December 8, 2020, FireEye disclosed theft of their Red Team assessment tools. These tools are used by FireEye to test and validate the securit
Qualys
Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach | Qualys
blogs_qualys·2020-12-10
Solorigate/Sunburst : Theft of Cybersecurity Tools | FireEye Breach | Qualys
Update Jan 5, 2021: New patching section with two new dashboard widgets showing the number of missing FireEye-related patches in your environment and the number of assets in your environment missing one of those patches.
Update Dec 23, 2020: Added a new section on compensating controls.
Update Dec 22, 2020: FireEye disclosed the theft of their Red Team assessment tools. Hackers now have an influential collection of new techniques to draw upon.
Using Qualys VMDR, the vulnerabilities for Solorigate/SUNBURST can be prioritized for the following Real-Time Threat Indicators (RTIs):
- Active Attacks
- Solorigate Sunburst (New RTI)
Original post: On December 8, 2020, FireEye disclosed theft of their Red Team assessment tools. These tools are used by FireEye to test and validate the security
Zscaler
SolarWinds CyberAttack and FireEye Red Team Tools Coverage
blogs_zscaler·2020-12-09
SolarWinds CyberAttack and FireEye Red Team Tools Coverage
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Unit42
Exploitation of Windows RDP Vulnerability CVE-2019-0708 (BlueKeep): Get RCE with System Privilege Using Refresh Rect PDU and RDPDR Client Name Request PDU
blogs_unit42·2020-12-07·CVSS 9.8
CVE-2019-0708 [CRITICAL] Exploitation of Windows RDP Vulnerability CVE-2019-0708 (BlueKeep): Get RCE with System Privilege Using Refresh Rect PDU and RDPDR Client Name Request PDU
Threat Research Center
Threat Research
Vulnerabilities
## Exploitation of Windows RDP Vulnerability CVE-2019-0708 (BlueKeep): Get RCE with System Privilege Using Refresh Rect PDU and RDPDR Client Name Request PDU
Tao Yan
Jin Chen
Published: December 7, 2020
Threat Research
Vulnerabilities
Bluekeep
CVE-2019-0708
RDP
Remote Code Execution
## Executive Summary
In May 2019, Microsoft released an out-of-band patch update for remote code execution (RCE) vulnerability CVE-2019-0708, which is also known as “BlueKeep” and resides in code for Remote Desktop Services (RDS). Over the last year, researchers had proved the exploitability of BlueKeep and proposed countermeasures to detect and prevent it. However, RDP is still one of the most popular attack vectors used by attackers toda
Unit42
Exploitation of Windows RDP Vulnerability CVE-2019-0708 (BlueKeep): Get RCE with System Privilege Using Refresh Rect PDU and RDPDR Client Name Request PDU
blogs_unit42·2020-12-07·CVSS 9.8
CVE-2019-0708 [CRITICAL] Exploitation of Windows RDP Vulnerability CVE-2019-0708 (BlueKeep): Get RCE with System Privilege Using Refresh Rect PDU and RDPDR Client Name Request PDU
## Executive Summary
In May 2019, Microsoft released an out-of-band patch update for remote code execution (RCE) vulnerability CVE-2019-0708, which is also known as “BlueKeep” and resides in code for Remote Desktop Services (RDS). Over the last year, researchers had proved the exploitability of BlueKeep and proposed countermeasures to detect and prevent it. However, RDP is still one of the most popular attack vectors used by attackers today. To make it harder for RDP attacks to succeed and to better protect Windows users and our customers, we will disclose detailed information in this blog about how attackers might exploit BlueKeep on Windows RDP endpoints.
In August 2019, Unit 42 researchers published a blog on CVE-2019-0708, covering how Bitmap Cache protocol data unit (PDU), Refresh R
Talos
Threat Roundup for November 27 to December 4
blogs_talos·2020-12-04
Threat Roundup for November 27 to December 4
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 27 and Dec. 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for November 27 to December 4
blogs_talos·2020-12-04
Threat Roundup for November 27 to December 4
## Threat Roundup for November 27 to December 4
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 27 and Dec. 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for November 13 to November 20
blogs_talos·2020-11-20
Threat Roundup for November 13 to November 20
## Threat Roundup for November 13 to November 20
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 13 and Nov. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threat
Talos
Threat Roundup for November 13 to November 20
blogs_talos·2020-11-20
Threat Roundup for November 13 to November 20
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 13 and Nov. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for November 6 to November 13
blogs_talos·2020-11-13
Threat Roundup for November 6 to November 13
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 6 and Nov. 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for November 6 to November 13
blogs_talos·2020-11-13
Threat Roundup for November 6 to November 13
## Threat Roundup for November 6 to November 13
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 6 and Nov. 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for October 30 to November 6
blogs_talos·2020-11-06
Threat Roundup for October 30 to November 6
## Threat Roundup for October 30 to November 6
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 30 and Nov. 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats i
Talos
Threat Roundup for October 30 to November 6
blogs_talos·2020-11-06
Threat Roundup for October 30 to November 6
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 30 and Nov. 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Tenable
CVE-2020-14871: Critical Buffer Overflow in Oracle Solaris Exploited in the Wild as Zero-Day
blogs_tenable·2020-11-05·CVSS 10.0
[CRITICAL] CVE-2020-14871: Critical Buffer Overflow in Oracle Solaris Exploited in the Wild as Zero-Day
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Roundup for October 23 to October 30
blogs_talos·2020-10-30
Threat Roundup for October 23 to October 30
## Threat Roundup for October 23 to October 30
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 23 and Oct. 30. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for October 23 to October 30
blogs_talos·2020-10-30
Threat Roundup for October 23 to October 30
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 23 and Oct. 30. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Tenable
Government Agencies Warn of State-Sponsored Actors Exploiting Publicly Known Vulnerabilities
blogs_tenable·2020-10-23
Government Agencies Warn of State-Sponsored Actors Exploiting Publicly Known Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Roundup for October 16 to October 23
blogs_talos·2020-10-23
Threat Roundup for October 16 to October 23
## Threat Roundup for October 16 to October 23
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 16 and Oct. 23. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for October 16 to October 23
blogs_talos·2020-10-23
Threat Roundup for October 16 to October 23
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 16 and Oct. 23. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Qualys
NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities | Qualys
blogs_qualys·2020-10-22·CVSS 9.8
CVE-2020-15505 [CRITICAL] NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities | Qualys
#### Table of Contents
- Detect 25 Publicly Known Vulnerabilities using VMDR
Update November 25, 2020: The UK National Cyber Security Centre alerts that APT nation-state groups and cybercriminals are exploiting MobileIron RCE vulnerability (CVE-2020-15505).
Original post: On October 20, 2020, the United States National Security Agency (NSA) released a cybersecurity advisory on Chinese state-sponsored malicious cyber activity. The NSA alert provided a list of 25 publicly known vulnerabilities that are known to be recently leveraged by cyber actors for various hacking operations.
“Since these techniques include exploitation of publicly known vulnerabilities, it is critical that network defenders prioritize patching and
mitigation efforts,” said the NSA advisory. It also recommended “crit
Qualys
NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities
blogs_qualys·2020-10-22·CVSS 10.0
CVE-2020-15505 [CRITICAL] NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities
## Table of Contents
Detect 25 Publicly Known Vulnerabilities using VMDR
Update November 25, 2020 : The UK National Cyber Security Centre alerts that APT nation-state groups and cybercriminals are exploiting MobileIron RCE vulnerability (CVE-2020-15505).
Original post : On October 20, 2020, the United States National Security Agency (NSA) released a cybersecurity advisory on Chinese state-sponsored malicious cyber activity. The NSA alert provided a list of 25 publicly known vulnerabilities that are known to be recently leveraged by cyber actors for various hacking operations.
“Since these techniques include exploitation of publicly known vulnerabilities, it is critical that network defenders prioritize patching and mitigation efforts,” said the NSA advisory. It also recommended “critic
Talos
Threat Roundup for October 9 to October 16
blogs_talos·2020-10-16
Threat Roundup for October 9 to October 16
## Threat Roundup for October 9 to October 16
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 9 and Oct. 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for October 9 to October 16
blogs_talos·2020-10-16
Threat Roundup for October 9 to October 16
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 9 and Oct. 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for October 2 to October 9
blogs_talos·2020-10-09
Threat Roundup for October 2 to October 9
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 2 and Oct. 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat o
Talos
Threat Roundup for September 25 to October 2
blogs_talos·2020-10-02
Threat Roundup for September 25 to October 2
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 25 and Oct. 2. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not
Talos
Threat Roundup for September 18 to September 25
blogs_talos·2020-09-25
Threat Roundup for September 18 to September 25
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 18 and Sept. 25. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional thre
Talos
Threat Roundup for September 11 to September 18
blogs_talos·2020-09-18
Threat Roundup for September 11 to September 18
## Threat Roundup for September 11 to September 18
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 11 and Sept. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following th
Talos
Threat Roundup for September 11 to September 18
blogs_talos·2020-09-18
Threat Roundup for September 11 to September 18
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 11 and Sept. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional thre
Talos
Threat Roundup for September 4 to September 11
blogs_talos·2020-09-11
Threat Roundup for September 4 to September 11
## Threat Roundup for September 4 to September 11
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 4 and Sept. 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following thre
Talos
Threat Roundup for September 4 to September 11
blogs_talos·2020-09-11
Threat Roundup for September 4 to September 11
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 4 and Sept. 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threa
Talos
Threat Roundup for August 28 to September 4
blogs_talos·2020-09-04
Threat Roundup for August 28 to September 4
## Threat Roundup for August 28 to September 4
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 28 and Sept. 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. Additionally, please keep in mind that IOC searching is only one part o
Talos
Threat Roundup for August 28 to September 4
blogs_talos·2020-09-04
Threat Roundup for August 28 to September 4
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 28 and Sept. 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not
Talos
Threat Roundup for August 21 to August 27
blogs_talos·2020-08-27
Threat Roundup for August 21 to August 27
## Threat Roundup for August 21 to August 27
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 21 and Aug. 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for August 21 to August 27
blogs_talos·2020-08-27
Threat Roundup for August 21 to August 27
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 21 and Aug. 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for August 14 to August 21
blogs_talos·2020-08-21
Threat Roundup for August 14 to August 21
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 14 and Aug. 21. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for August 14 to August 21
blogs_talos·2020-08-21
Threat Roundup for August 14 to August 21
## Threat Roundup for August 14 to August 21
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 14 and Aug. 21. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for August 7 to August 14
blogs_talos·2020-08-14
Threat Roundup for August 7 to August 14
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 7 and Aug. 14. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for August 7 to August 14
blogs_talos·2020-08-14
Threat Roundup for August 7 to August 14
## Threat Roundup for August 7 to August 14
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 7 and Aug. 14. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is s
Talos
Threat Roundup for July 31 to August 7
blogs_talos·2020-08-07
Threat Roundup for July 31 to August 7
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 31 and Aug. 7. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for July 31 to August 7
blogs_talos·2020-08-07
Threat Roundup for July 31 to August 7
## Threat Roundup for July 31 to August 7
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 31 and Aug. 7. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is sub
Securelist
Incident Response Analyst Report of 2019
blogs_securelist·2020-08-06
Incident Response Analyst Report of 2019
Table of Contents
- Executive summary
- Recommendations
- Reasons for incident response
- Distribution of reasons for top regions
- Distribution of reasons for industries
- Initial vectors or how adversaries get in
- Tools and exploits
- Attack duration
- Operational metrics
- How fast we responded
- How long response took
- MITRE ATT&CK tactics and techniques
- Conclusion
Authors
- Ayman Shaaban
- Grigory Sablin
- Kaspersky GERT
Download full report (PDF)
As an incident response service provider, Kaspersky delivers a global service that results in global visibility of adversaries’ cyber-incident tactics and techniques used in the wild. In this report, we share our teams’ conclusions and analysis based on incident responses and statistics from 2019. As well as a range of highlights,
Securelist
Incident Response Analyst Report 2019
blogs_securelist·2020-08-06
Incident Response Analyst Report 2019
Table of Contents
Executive summary
Verticals and industries
Recommendations
Reasons for incident response
Distribution of reasons for top regions
Distribution of reasons for industries
Initial vectors or how adversaries get in
Tools and exploits
30% of all incidents were tied to legitimate tools
Exploits
Attack duration
Operational metrics
False positives rate
Age of attack
How fast we responded
How long response took
MITRE ATT&CK tactics and techniques
Conclusion
Authors
Ayman Shaaban
Grigory Sablin
Kaspersky GERT
Download full report (PDF)
As an incident response service provider, Kaspersky delivers a global service that results in global visibility of adversaries’ cyber-incident tactics and techniques used in the wild. In this report, we share our teams’ conclus
Talos
Threat Roundup for July 24 to July 31
blogs_talos·2020-07-31
Threat Roundup for July 24 to July 31
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 24 and July 31. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for July 24 to July 31
blogs_talos·2020-07-31
Threat Roundup for July 24 to July 31
## Threat Roundup for July 24 to July 31
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 24 and July 31. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is sub
Talos
Threat Roundup for July 10 to July 17
blogs_talos·2020-07-17
Threat Roundup for July 10 to July 17
## Threat Roundup for July 10 to July 17
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 10 and July 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is sub
Talos
Threat Roundup for July 10 to July 17
blogs_talos·2020-07-17
Threat Roundup for July 10 to July 17
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 10 and July 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for July 3 to July 10
blogs_talos·2020-07-10
Threat Roundup for July 3 to July 10
## Threat Roundup for July 3 to July 10
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 3 and July 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subje
Talos
Threat Roundup for July 3 to July 10
blogs_talos·2020-07-10
Threat Roundup for July 3 to July 10
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 3 and July 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for June 19 to June 26
blogs_talos·2020-06-26
Threat Roundup for June 19 to June 26
## Threat Roundup for June 19 to June 26
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 19 and June 26. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is sub
Talos
Threat Roundup for June 19 to June 26
blogs_talos·2020-06-26
Threat Roundup for June 19 to June 26
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 19 and June 26. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for June 5 to June 12
blogs_talos·2020-06-12
Threat Roundup for June 5 to June 12
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 5 and June 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for June 5 to June 12
blogs_talos·2020-06-12
Threat Roundup for June 5 to June 12
## Threat Roundup for June 5 to June 12
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 5 and June 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subje
Talos
Threat Roundup for May 29 to June 5
blogs_talos·2020-06-05
Threat Roundup for May 29 to June 5
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 29 and June 5. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat o
Talos
Threat Roundup for May 29 to June 5
blogs_talos·2020-06-05
Threat Roundup for May 29 to June 5
## Threat Roundup for May 29 to June 5
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 29 and June 5. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject
Talos
Threat Roundup for May 22 to May 29
blogs_talos·2020-05-29
Threat Roundup for May 22 to May 29
## Threat Roundup for May 22 to May 29
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 22 and May 29. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject
Talos
Threat Roundup for May 22 to May 29
blogs_talos·2020-05-29
Threat Roundup for May 22 to May 29
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 22 and May 29. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat o
Talos
Threat Roundup for May 8 to May 15
blogs_talos·2020-05-15
Threat Roundup for May 8 to May 15
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 8 and May 15. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or
Talos
Threat Roundup for May 8 to May 15
blogs_talos·2020-05-15
Threat Roundup for May 8 to May 15
## Threat Roundup for May 8 to May 15
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 8 and May 15. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject t
Talos
Threat Roundup for May 1 to May 8
blogs_talos·2020-05-08
Threat Roundup for May 1 to May 8
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 1 and May 8. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or
Talos
Threat Roundup for May 1 to May 8
blogs_talos·2020-05-08
Threat Roundup for May 1 to May 8
## Threat Roundup for May 1 to May 8
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 1 and May 8. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to
Talos
Threat Roundup for April 24 to May 1
blogs_talos·2020-05-01
Threat Roundup for April 24 to May 1
## Threat Roundup for April 24 to May 1
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 24 and May 1. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subje
Talos
Threat Roundup for April 24 to May 1
blogs_talos·2020-05-01
Threat Roundup for April 24 to May 1
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 24 and May 1. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Tenable
How VPR Helped Prioritize the Most Dangerous CVEs in 2019
blogs_tenable·2020-04-30
How VPR Helped Prioritize the Most Dangerous CVEs in 2019
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Roundup for April 17 to April 24
blogs_talos·2020-04-24
Threat Roundup for April 17 to April 24
## Threat Roundup for April 17 to April 24
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 17 and April 24. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for April 17 to April 24
blogs_talos·2020-04-24
Threat Roundup for April 17 to April 24
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 17 and April 24. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional thre
Talos
Threat Roundup for April 10 to April 17
blogs_talos·2020-04-17
Threat Roundup for April 10 to April 17
## Threat Roundup for April 10 to April 17
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 10 and April 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for April 10 to April 17
blogs_talos·2020-04-17
Threat Roundup for April 10 to April 17
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 10 and April 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional thre
Tenable
Critical Vulnerabilities You Need to Find and Fix to Protect the Remote Workforce
blogs_tenable·2020-04-13
Critical Vulnerabilities You Need to Find and Fix to Protect the Remote Workforce
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Management (CSPM)
Compliance
Cyber insurance
Data Security Posture Management (DSPM)
Google Cloud security
Infrastructure as Code (IaC) security
Kubernetes Security Pos
Talos
Threat Roundup for April 3 to April 10
blogs_talos·2020-04-10
Threat Roundup for April 3 to April 10
## Threat Roundup for April 3 to April 10
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 3 and April 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is s
Talos
Threat Roundup for April 3 to April 10
blogs_talos·2020-04-10
Threat Roundup for April 3 to April 10
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 3 and April 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threa
Talos
Threat Roundup for March 27 to April 3
blogs_talos·2020-04-03
Threat Roundup for March 27 to April 3
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 27 and April 3. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threa
Talos
Threat Roundup for March 27 to April 3
blogs_talos·2020-04-03
Threat Roundup for March 27 to April 3
## Threat Roundup for March 27 to April 3
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 27 and April 3. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is s
Tenable
How COVID-19 Response Is Expanding the Cyberattack Surface
blogs_tenable·2020-03-30
How COVID-19 Response Is Expanding the Cyberattack Surface
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Roundup for March 20 to March 27
blogs_talos·2020-03-27
Threat Roundup for March 20 to March 27
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 20 and March 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional thre
Talos
Threat Roundup for March 20 to March 27
blogs_talos·2020-03-27
Threat Roundup for March 20 to March 27
## Threat Roundup for March 20 to March 27
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 20 and March 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for March 13 to March 20
blogs_talos·2020-03-20
Threat Roundup for March 13 to March 20
## Threat Roundup for March 13 to March 20
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 13 and March 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for March 13 to March 20
blogs_talos·2020-03-20
Threat Roundup for March 13 to March 20
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 13 and March 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional thre
Talos
Threat Roundup for March 6 to March 13
blogs_talos·2020-03-13
Threat Roundup for March 6 to March 13
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 6 and March 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threa
Talos
Threat Roundup for March 6 to March 13
blogs_talos·2020-03-13
Threat Roundup for March 6 to March 13
## Threat Roundup for March 6 to March 13
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 6 and March 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is s
Talos
Threat Roundup for February 28 to March 6
blogs_talos·2020-03-06
Threat Roundup for February 28 to March 6
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 28 and March 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for February 28 to March 6
blogs_talos·2020-03-06
Threat Roundup for February 28 to March 6
## Threat Roundup for February 28 to March 6
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 28 and March 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for February 21 to February 28
blogs_talos·2020-02-28
Threat Roundup for February 21 to February 28
## Threat Roundup for February 21 to February 28
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 21 and Feb. 28. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threat
Talos
Threat Roundup for February 21 to February 28
blogs_talos·2020-02-28
Threat Roundup for February 21 to February 28
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 21 and Feb. 28. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for February 14 to February 21
blogs_talos·2020-02-21
Threat Roundup for February 14 to February 21
## Threat Roundup for February 14 to February 21
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 14 and Feb. 21. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threat
Talos
Threat Roundup for February 14 to February 21
blogs_talos·2020-02-21
Threat Roundup for February 14 to February 21
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 14 and Feb. 21. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for February 7 to February 14
blogs_talos·2020-02-14
Threat Roundup for February 7 to February 14
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 7 and Feb. 14. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for February 7 to February 14
blogs_talos·2020-02-14
Threat Roundup for February 7 to February 14
## Threat Roundup for February 7 to February 14
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 7 and Feb. 14. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for January 31 to February 7
blogs_talos·2020-02-07
Threat Roundup for January 31 to February 7
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 31 and Feb. 7. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for January 31 to February 7
blogs_talos·2020-02-07
Threat Roundup for January 31 to February 7
## Threat Roundup for January 31 to February 7
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 31 and Feb. 7. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats i
Talos
Threat Roundup for January 24 to January 31
blogs_talos·2020-01-31
Threat Roundup for January 24 to January 31
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 24 and Jan. 31. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for January 24 to January 31
blogs_talos·2020-01-31
Threat Roundup for January 24 to January 31
## Threat Roundup for January 24 to January 31
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 24 and Jan. 31. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for January 17 to January 24
blogs_talos·2020-01-24
Threat Roundup for January 17 to January 24
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 17 and Jan. 24. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for January 17 to January 24
blogs_talos·2020-01-24
Threat Roundup for January 17 to January 24
## Threat Roundup for January 17 to January 24
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 17 and Jan. 24. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for January 10 to January 17
blogs_talos·2020-01-17
Threat Roundup for January 10 to January 17
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 10 and Jan. 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for January 10 to January 17
blogs_talos·2020-01-17
Threat Roundup for January 10 to January 17
## Threat Roundup for January 10 to January 17
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 10 and Jan. 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Tenable
Microsoft’s January 2020 Patch Tuesday Kicks Off the New Year with 49 New CVEs
blogs_tenable·2020-01-14
Microsoft’s January 2020 Patch Tuesday Kicks Off the New Year with 49 New CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Roundup for January 3 to January 10
blogs_talos·2020-01-10
Threat Roundup for January 3 to January 10
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 3 and Jan. 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for January 3 to January 10
blogs_talos·2020-01-10
Threat Roundup for January 3 to January 10
## Threat Roundup for January 3 to January 10
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 3 and Jan. 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Qualys
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
blogs_qualys·2019-12-27·CVSS 8.8
[HIGH] Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
A recent report identified 19+ vulnerabilities that should be mitigated by end of year 2019. These are a range of top vulnerabilities attacked and leveraged by Advance Persistent Threat (APT) actors from all parts of the world.
The list below shows those top 19 vulnerabilities, and it should be no surprise that you can easily track and remediate them via a dashboard within Qualys. Import the dashboard into your subscription for easy insight into what assets and vulnerabilities in your organization are at risk.
No.
CVE
Products Affected by CVE
CVSS Score (NVD)
Examples of Threat Actors
1
CVE-2017-11882
Microsoft Office
7.8
APT32 (Vietnam), APT34 (Iran), APT40 (China), APT-C-35 (India), Cobalt Group (Spain, Ukraine), Silent Group (Russia), Lotus Blossom (China), FIN7 (Russia)
2
Qualys
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking | Qualys
blogs_qualys·2019-12-27·CVSS 8.8
[HIGH] Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking | Qualys
A recent report identified 19+ vulnerabilities that should be mitigated by end of year 2019. These are a range of top vulnerabilities attacked and leveraged by Advance Persistent Threat (APT) actors from all parts of the world.
The list below shows those top 19 vulnerabilities, and it should be no surprise that you can easily track and remediate them via a dashboard within Qualys. Import the dashboard into your subscription for easy insight into what assets and vulnerabilities in your organization are at risk.
No.
CVE
Products Affected by CVE
CVSS Score (NVD)
Examples of Threat Actors
1
CVE-2017-11882
Microsoft Office
7.8
APT32 (Vietnam), APT34 (Iran), APT40 (China), APT-C-35 (India), Cobalt Group (Spain, Ukraine), Silent Group (Russia), Lotus Blossom (China), FIN7 (Russia)
2
CVE-2018-
Fortinet
Introducing BIOLOAD: FIN7 BOOSTWRITE’s Lost Twin
blogs_fortinet·2019-12-26
Introducing BIOLOAD: FIN7 BOOSTWRITE’s Lost Twin
FORTIGUARD LABS THREAT RESEARCH
Introducing BIOLOAD: FIN7 BOOSTWRITE’s Lost Twin
By Omri Misgav | December 26, 2019
Acouple of months ago, enSilo’s endpoint protection platform blocked malicious payloads running in legitimate Microsoft Windows processes. A deeper look uncovered that the attacker abused the DLL search order to load their own malicious DLL. Some of the samples in the environment matched ones described in a recent publication by FireEye about FIN7’s new tools and techniques, specifically BOOSTWRITE. Comparing the rest of the samples to BOOSTWRITE revealed they have a common codebase and carry the Carbanak backdoor.
The Abused Target
Windows OS uses a common method to look for required DLLs to load into a program. Adversaries may use this behavior to cause the program to l
Qualys
Blue is a color we love but can’t Keep! | Qualys
blogs_qualys·2019-12-20·CVSS 9.8
[CRITICAL] Blue is a color we love but can’t Keep! | Qualys
Recent reports this year revealed nearly 1 million computer systems are still vulnerable and exposed to BlueKeep in the wild. These systems are still easy targets for an unauthenticated attacker (or malware) to execute code leveraging this patchable vulnerability. Because so many systems are still vulnerable, Qualys has added its BlueKeep dashboard directly into the product, so you can more easily track and remediate this vulnerability.
### Why is BlueKeep So Critical?
The BlueKeep vulnerability announced earlier in 2019 allows attackers to run arbitrary program code on victims’ computers. The vulnerability is found in Remote Desktop Services – formerly known as Terminal Services – which affects some older versions of Windows. The Remote Desktop Protocol (RDP) itself is not vulnerable. T
Talos
Threat Roundup for December 13 to December 20
blogs_talos·2019-12-20
Threat Roundup for December 13 to December 20
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 13 and Dec. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Qualys
Blue is a color we love but can’t Keep!
blogs_qualys·2019-12-20·CVSS 9.8
[CRITICAL] Blue is a color we love but can’t Keep!
Recent reports this year revealed nearly 1 million computer systems are still vulnerable and exposed to BlueKeep in the wild. These systems are still easy targets for an unauthenticated attacker (or malware) to execute code leveraging this patchable vulnerability. Because so many systems are still vulnerable, Qualys has added its BlueKeep dashboard directly into the product, so you can more easily track and remediate this vulnerability.
## Why is BlueKeep So Critical?
The BlueKeep vulnerability announced earlier in 2019 allows attackers to run arbitrary program code on victims’ computers. The vulnerability is found in Remote Desktop Services – formerly known as Terminal Services – which affects some older versions of Windows. The Remote Desktop Protocol (RDP) itself is not vulnerable. Th
Talos
Threat Roundup for December 13 to December 20
blogs_talos·2019-12-20
Threat Roundup for December 13 to December 20
## Threat Roundup for December 13 to December 20
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 13 and Dec. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threat
Tenable
Objects in Mirror Are Closer Than They Appear: Reflecting on the Cybersecurity Threats from 2019
blogs_tenable·2019-12-16
Objects in Mirror Are Closer Than They Appear: Reflecting on the Cybersecurity Threats from 2019
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Roundup for December 6 to December 13
blogs_talos·2019-12-13
Threat Roundup for December 6 to December 13
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 6 and Dec. 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for December 6 to December 13
blogs_talos·2019-12-13
Threat Roundup for December 6 to December 13
## Threat Roundup for December 6 to December 13
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 6 and Dec. 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Unit42
Unit 42 Presents New Research at BlueHat Seattle on Three New Windows RDP Vulnerability Exploit Methods
blogs_unit42·2019-12-12·CVSS 9.8
[CRITICAL] Unit 42 Presents New Research at BlueHat Seattle on Three New Windows RDP Vulnerability Exploit Methods
Threat Research Center
Threat Research
Vulnerabilities
## Unit 42 Presents New Research at BlueHat Seattle on Three New Windows RDP Vulnerability Exploit Methods
John Harrison
Published: December 12, 2019
Threat Research
Vulnerabilities
BlueHat
BlueHat Seattle
Pool Fengshui
Vulnerability Exploitation
Windows RDP
## Overview
The Unit 42 threat intelligence team recently shared its latest findings at Microsoft’s invitation-only security conference, BlueHat Seattle 2019, on three new Windows Remote Desktop Protocol (RDP) vulnerability exploitation methods for Pool Feng Shui techniques. Pool Feng Shui is an advanced vulnerability exploitation technique that manipulates the kernel pool layout and state finely to facilitate arbitrary code execution.
The report, titled “Pool Fe
Unit42
Unit 42 Presents New Research at BlueHat Seattle on Three New Windows RDP Vulnerability Exploit Methods
blogs_unit42·2019-12-12·CVSS 9.8
[CRITICAL] Unit 42 Presents New Research at BlueHat Seattle on Three New Windows RDP Vulnerability Exploit Methods
## Overview
The Unit 42 threat intelligence team recently shared its latest findings at Microsoft’s invitation-only security conference, BlueHat Seattle 2019, on three new Windows Remote Desktop Protocol (RDP) vulnerability exploitation methods for Pool Feng Shui techniques. Pool Feng Shui is an advanced vulnerability exploitation technique that manipulates the kernel pool layout and state finely to facilitate arbitrary code execution.
The report, titled “Pool Fengshui in Windows RDP Vulnerability Exploitation,” is authored by Tao Yan and Jin Chen, shared three new Windows RDP vulnerability exploitation methods for Pool Feng Shui techniques. Yan not only showed how Bitmap Cache PDU, Refresh Rect PDU and RDPDR Client Name Request PDU can be used for Pool Feng Shui in the Windows RDP vulne
Talos
Threat Roundup for November 29 to December 6
blogs_talos·2019-12-06
Threat Roundup for November 29 to December 6
## Threat Roundup for November 29 to December 6
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 29 and Dec. 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for November 29 to December 6
blogs_talos·2019-12-06
Threat Roundup for November 29 to December 6
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 29 and Dec. 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Fortinet
Dissecting Tor Bridges and Pluggable Transport – Part II: How Obfs4 Bridges Defeats Censorship
blogs_fortinet·2019-12-06
Dissecting Tor Bridges and Pluggable Transport – Part II: How Obfs4 Bridges Defeats Censorship
FORTIGUARD LABS THREAT RESEARCH
Dissecting Tor Bridges and Pluggable Transport – Part II: How Obfs4 Bridges Defeats Censorship
By Xiaopeng Zhang | December 06, 2019
AFortiGuard Labs Threat Research Report
Background
This is the second half of my two-part series on “Dissecting Tor Bridges and Pluggable Transport”. In the first blog, I went into great detail in explaining how the Tor browser’s built-in bridges were passed through three processes (“firefox.exe”, “tor.exe,” and “obfs4proxy.exe”), how Tor Browser communicates with the Obfs4 Bridge client, as well as the relationship between those three processes. In this blog, I will continue to explain how Tor uses Obfs4 Bridge to circumvent censorship.
Traffic Flow When Using Tor – With and Without Obfs4 Bridge
Before talking about Obfs
Talos
Threat Roundup for November 15 to November 22
blogs_talos·2019-11-22
Threat Roundup for November 15 to November 22
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 15 and Nov. 22. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for November 15 to November 22
blogs_talos·2019-11-22
Threat Roundup for November 15 to November 22
## Threat Roundup for November 15 to November 22
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 15 and Nov. 22. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threat
Fortinet
Packers: What’s in the Box?
blogs_fortinet·2019-11-19
Packers: What’s in the Box?
FORTIGUARD LABS THREAT RESEARCH
Packers: What’s in the Box?
By FortiGuard SE Team | November 19, 2019
Threat identification has historically been plagued with challenges such as being able to quickly understand a threat, successfully associating it with a threat family, and attributing it to a specific cybercriminal or criminal organization. Malicious threat actors often compound this challenge by putting a large roadblock right at the very beginning of any analysis process.
They do this by boxing their payloads into neat little packages before releasing them out into the vast corners of the Internet. They also utilize a plethora of packers, ranging from custom-written tools all the way to well-established professional packers (such as Themida and VMProtect) to delay the reverse enginee
Fortinet
Double Trouble: RevengeRAT and WSHRAT
blogs_fortinet·2019-11-13
Double Trouble: RevengeRAT and WSHRAT
FORTIGUARD LABS THREAT RESEARCH
Double Trouble: RevengeRAT and WSHRAT
By Chris Navarrete and Xiaopeng Zhang | November 13, 2019
AFortiGuard Labs Threat Analysis Report
As part of our continuous malware monitoring, the FortiGuard Labs team recently captured a sample file that our EagleSight Malware Analysis System flagged as suspicious. We also noticed that this malware had a low detection rate on VirusTotal. Only 8 out of 57 security vendors detected it at that time when we started the analysis. As a result, we decided to perform a manual analysis on it, and we discovered that the file was designed to drop malware. We then found it dropping both RevengeRAT and WSHRAT.
First Stage – Launcher/Dropper
When opening the sample file, which contained JavaScript code in a text editor, we coul
Talos
Threat Roundup for November 1 to November 8
blogs_talos·2019-11-08
Threat Roundup for November 1 to November 8
## Threat Roundup for November 1 to November 8
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 1 and Nov. 8. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. Additionally, please keep in mind that IOC searching is only one part of
Fortinet
FortiGuard Labs Weekly Threat Update – November 8, 2019
blogs_fortinet·2019-11-08·CVSS 9.8
CVE-2019-0708 [CRITICAL] FortiGuard Labs Weekly Threat Update – November 8, 2019
FORTIGUARD LABS THREAT RESEARCH
FortiGuard Labs Weekly Threat Update – November 8, 2019
By Jeannette Jarvis | November 08, 2019
Each week, FortiGuard Labs publishes a Threat Brief to subscribers that profiles notable hot topics and threats that were discovered or discussed during the week. Here is a recap of what we are covering in this week’s Threat Brief:
A public exploit module for the BlueKeep vulnerability (CVE-2019-0708) was added to the open-source Metasploit penetration testing framework in September. We are now seeing hackers deploying the exploit and then installing a cryptocurrency miner. The BlueKeep vulnerability has the potential to turn into a wormable event that could spread from one machine to another. Fortunately, this first hacking operation did not turn out to includ
Talos
Threat Roundup for November 1 to November 8
blogs_talos·2019-11-08
Threat Roundup for November 1 to November 8
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 1 and Nov. 8. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not n
Fortinet
Anatomy of Scalable Vector Graphics (SVG) Attack Surface on the Web
blogs_fortinet·2019-11-07
Anatomy of Scalable Vector Graphics (SVG) Attack Surface on the Web
FORTIGUARD LABS THREAT RESEARCH
Anatomy of Scalable Vector Graphics (SVG) Attack Surface on the Web
By Thanh Nguyen Nguyen | November 07, 2019
Introduction
Over the past few weeks, Fortinet's FortiGuard Labs has been assessing web applications with embedded SVG images. As a result, we found a number of common issues in the web applications that we have examined. In this blog post, we will briefly talk about the nature of SVG and the common attack surfaces for SVG images that we have seen so far.
The following list is a summary of the common SVG attack vectors that we have observed over time:
Cross-Site Scripting
HTML Injection
XML Entity Processing – Billion Laughs Attack
Denial of Service – The New SVG Billion Laughs Attack
SVG on the Web
SVG, which stands for Scalable Vector Graphi
Fortinet
BlueKeep RDP Attacks are Starting – Patch CVE-2019-0708 Now
blogs_fortinet·2019-11-05·CVSS 9.8
CVE-2019-0708 [CRITICAL] BlueKeep RDP Attacks are Starting – Patch CVE-2019-0708 Now
FORTIGUARD LABS THREAT RESEARCH
BlueKeep RDP Attacks are Starting – Patch CVE-2019-0708 Now
By FortiGuard SE Team | November 05, 2019
Microsoft patched a critical Remote Desktop Services Remote Code Execution Vulnerability this past May, 2019. Identified as CVE-2019-0708, and also known as BlueKeep, this remote code execution vulnerability can be exploited when an unauthenticated attacker connects to a target system using RDP and then sends specially crafted requests. This vulnerability exists pre-authentication and requires no user interaction. An attacker who successfully exploits this vulnerability could then execute arbitrary code on the target system.
Microsoft considered this vulnerability so serious that they even released patches for non-supported operating systems. BlueKeep has
Qualys
BlueKeep Attacks Observed Months after Initial Release | Qualys
blogs_qualys·2019-11-04·CVSS 9.8
[CRITICAL] BlueKeep Attacks Observed Months after Initial Release | Qualys
The BlueKeep vulnerability, initially released in May 2019, is currently being exploited in the wild. Cybersecurity researchers have spotted initial attacks of Bluekeep RDP vulnerability. Here’s a reminder about BlueKeep and instructions for using Qualys to identify attacks and remediate this vulnerability.
### About BlueKeep Attacks
BlueKeep allows an unauthenticated attacker to connect to the target system using Microsoft’s RDP protocol to execute code on the vulnerable system. It is wormable remote code execution vulnerability, as it can propagate itself from one vulnerable computer to another without any victim interaction.
Recently, BlueKeep exploitation activity was seen by security researcher Kevin Beaumont, who has been running a worldwide honeypot network named BluePot to spot
Talos
The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue
blogs_talos·2019-11-04·CVSS 9.8
CVE-2019-0708 [CRITICAL] The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue
## The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue
Update (11/04/2019): There have been several public reports of active exploitation of CVE-2019-0708 , commonly referred to as “BlueKeep.” Preliminary reports indicate that the vulnerability is being exploited by adversaries who are leveraging access to compromised systems to install cryptocurrency mining malware. At this time, there has been no evidence to suggest that the exploitation is due to the emergence of a new worm, and it is likely being done as part of a mass exploitation campaign, similar to what we have seen in previous instances of mass exploitation campaigns. Existing coverage for BlueKeep continues to be an effective way to mitigate possible exploitation attempts. F
Checkpoint
4th November – Threat Intelligence Bulletin
blogs_checkpoint·2019-11-04
CVE-2019-16662 4th November – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 4th November – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 4th November 2019, please download our Threat Intelligence Bulletin .
Top attacks AND breaches
India’s nuclear power plant has been hit by a cyber-attack after malware designed for data extraction was identified in one of its systems. The malware, linked by experts to the North-Korean group Lazarus, infected a computer in the plant’s external network, rather than the operational one.
Check Point SandBlast p
Tenable
CVE-2019-0708: BlueKeep Exploited in the Wild to Deliver Cryptocurrency Miner
blogs_tenable·2019-11-04·CVSS 9.8
[CRITICAL] CVE-2019-0708: BlueKeep Exploited in the Wild to Deliver Cryptocurrency Miner
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue
blogs_talos·2019-11-04·CVSS 9.8
CVE-2019-0708 [CRITICAL] The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue
Update (11/04/2019):
There have been several public reports of active exploitation of CVE-2019-0708, commonly referred to as “BlueKeep.” Preliminary reportsindicate that the vulnerability is being exploited by adversaries who are leveraging access to compromised systems to install cryptocurrency mining malware. At this time, there has been no evidence to suggest that the exploitation is due to the emergence of a new worm, and it is likely being done as part of a mass exploitation campaign, similar to what we have seen in previous instances of mass exploitation campaigns. Existing coverage for BlueKeep continues to be an effective way to mitigate possible exploitation attempts. For additional information related to protecting against attacks leveraging BlueKeep, please refer to the blog pos
Qualys
BlueKeep Attacks Observed Months after Initial Release
blogs_qualys·2019-11-04·CVSS 9.8
[CRITICAL] BlueKeep Attacks Observed Months after Initial Release
The BlueKeep vulnerability, initially released in May 2019, is currently being exploited in the wild. Cybersecurity researchers have spotted initial attacks of Bluekeep RDP vulnerability. Here’s a reminder about BlueKeep and instructions for using Qualys to identify attacks and remediate this vulnerability.
## About BlueKeep Attacks
BlueKeep allows an unauthenticated attacker to connect to the target system using Microsoft’s RDP protocol to execute code on the vulnerable system. It is wormable remote code execution vulnerability, as it can propagate itself from one vulnerable computer to another without any victim interaction.
Recently, BlueKeep exploitation activity was seen by security researcher Kevin Beaumont, who has been running a worldwide honeypot network named BluePot to spot e
Talos
Threat Roundup for October 25 to November 1
blogs_talos·2019-11-01
Threat Roundup for October 25 to November 1
## Threat Roundup for October 25 to November 1
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 25 and Nov. 1. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats i
Talos
Threat Roundup for October 25 to November 1
blogs_talos·2019-11-01
Threat Roundup for October 25 to November 1
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 25 and Nov. 1. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for October 18 to October 25
blogs_talos·2019-10-25
Threat Roundup for October 18 to October 25
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 18 and Oct. 25. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for October 18 to October 25
blogs_talos·2019-10-25
Threat Roundup for October 18 to October 25
## Threat Roundup for October 18 to October 25
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 18 and Oct. 25. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Fortinet
BlackHat 2019 Arsenal & BLACKPHENIX Framework
blogs_fortinet·2019-10-23
BlackHat 2019 Arsenal & BLACKPHENIX Framework
FORTIGUARD LABS THREAT RESEARCH
BlackHat 2019 Arsenal & BLACKPHENIX Framework
By Chris Navarrete | October 23, 2019
This year I attended BlackHat 2019 and presented a framework at the Arsenal that I have been working with in the lab for some time called “BLACKPHENIX – Malware Analysis + Automation Framework.” I had a great time meeting new people and answering interesting questions from attendees. I would like to extend my gratitude to the BlackHat staff for such a great experience.
Here are some pictures taken during my presentation:
What is BLACKPHENIX?
BLACKPHENIX is an open-source malware analysis automation framework composed of services, scripts, plug-ins, and tools based on a Command-and-Control (C&C) architecture. It relies on virtual machine software to operate and scripts to
Talos
Threat Roundup for October 11 to October 18
blogs_talos·2019-10-18
Threat Roundup for October 11 to October 18
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 11 and Oct. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for October 11 to October 18
blogs_talos·2019-10-18
Threat Roundup for October 11 to October 18
## Threat Roundup for October 11 to October 18
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 11 and Oct. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for October 4 to October 11
blogs_talos·2019-10-11
Threat Roundup for October 4 to October 11
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 4 and Oct. 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for October 4 to October 11
blogs_talos·2019-10-11
Threat Roundup for October 4 to October 11
## Threat Roundup for October 4 to October 11
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 4 and Oct. 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Fortinet
Exploring a Recent Magnitude Exploit Kit Sample | FortiGuard Labs
blogs_fortinet·2019-10-09·CVSS 7.5
[HIGH] Exploring a Recent Magnitude Exploit Kit Sample | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Exploring a Recent Magnitude Exploit Kit Sample
By Jessie Leung | October 09, 2019
As Internet Explorer's (IE) share of the browser pie continues to shrink, exploit kits — frameworks hosted by malicious actors to target browser vulnerabilities, particularly for IE — are much less active than before. However, some of them now target geographic regions where IE owns a more sizable part of the market. Magnitude Exploit Kit is one that continues to target South Korea.
Examining a Magnitude Exploit Kit Sample
At FortiGuard Labs, we discovered a sample of the Magnitude Exploit Kit that was using a specific technique with VBScript to load the .NET assembly from memory.
The flow for this sample was as follows:
Ad network 302 redirection
Magnitude EK 'gate' co
Talos
Threat Roundup for September 27 to October 4
blogs_talos·2019-10-04
Threat Roundup for September 27 to October 4
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 27 and Oct. 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for September 27 to October 4
blogs_talos·2019-10-04
Threat Roundup for September 27 to October 4
## Threat Roundup for September 27 to October 4
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 27 and Oct. 4. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for September 20 to September 27
blogs_talos·2019-09-27
Threat Roundup for September 20 to September 27
## Threat Roundup for September 20 to September 27
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 20 and Sept. 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following th
Talos
Threat Roundup for September 20 to September 27
blogs_talos·2019-09-27
Threat Roundup for September 20 to September 27
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 20 and Sept. 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional thre
Fortinet
VMware ESXi Command Injection Vulnerability
blogs_fortinet·2019-09-26·CVSS 8.8
[HIGH] VMware ESXi Command Injection Vulnerability
FORTIGUARD LABS THREAT RESEARCH
VMware ESXi Command Injection Vulnerability
By Zhouyuan Yang | September 26, 2019
Overview
VMware is the market leader in cloud infrastructure software, with over 41% market share. The VMware ESXi solution is a bare metal hypervisor that installs directly onto your physical server and partitions it into multiple virtual machines.
The FortiGuard Labs team recently discovered a command injection vulnerability in VMware ESXi. This vulnerability is identified as CVE-2017-16544. This command injection vulnerability is caused by the built-in BusyBox. A local attacker could create or upload a file with a crafted filename, allowing the attacker to execute arbitrary commands using the victim’s permission when the victim tries to access, modify, or delete this file
Talos
Threat Roundup for September 13 to September 20
blogs_talos·2019-09-20
Threat Roundup for September 13 to September 20
## Threat Roundup for September 13 to September 20
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 13 and Sept. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following th
Talos
Threat Roundup for September 13 to September 20
blogs_talos·2019-09-20
Threat Roundup for September 13 to September 20
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 13 and Sept. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional thre
Sentinelone
CVE-2019-0708: Background, Vulnerable Hosts, and Protection Strategies
blogs_sentinelone·2019-09-16·CVSS 9.8
[CRITICAL] CVE-2019-0708: Background, Vulnerable Hosts, and Protection Strategies
Following the recent Metasploit exploit community release we’ve been busy this weekend in the lab testing the exploit against our vulnerable sandpit. You can see from the below screenshot that we were able to load the new module and successfully gain shell access on a vulnerable host in our test environment.
Following successful exploitation of the vulnerable machine (unpatched, with RDP enabled through windows firewall) we then proceeded to deploy SentinelOne .
## Live Wild Exploitation
We have observed in-the-wild attempts to both identify as well as exploit vulnerable hosts. When you couple this with the various ‘commercial’ options available (MSF, Immunity CANVAS) it becomes that much more critical that organizations continue to take action to protect themselves against this attack
Sentinelone
CVE-2019-0708: Background, Vulnerable Hosts, and Protection Strategies
blogs_sentinelone·2019-09-16·CVSS 9.8
CVE-2019-0708 [CRITICAL] CVE-2019-0708: Background, Vulnerable Hosts, and Protection Strategies
Following the recent Metasploit exploit community release we’ve been busy this weekend in the lab testing the exploit against our vulnerable sandpit. You can see from the below screenshot that we were able to load the new module and successfully gain shell access on a vulnerable host in our test environment.
Following successful exploitation of the vulnerable machine (unpatched, with RDP enabled through windows firewall) we then proceeded to deploy SentinelOne.
## Live Wild Exploitation
We have observed in-the-wild attempts to both identify as well as exploit vulnerable hosts. When you couple this with the various ‘commercial’ options available (MSF, Immunity CANVAS) it becomes that much more critical that organizations continue to take action to protect themselves against this attack v
Talos
Threat Roundup for September 6 to September 13
blogs_talos·2019-09-13
Threat Roundup for September 6 to September 13
## Threat Roundup for September 6 to September 13
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 6 and Sept. 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following thre
Talos
Threat Roundup for September 6 to September 13
blogs_talos·2019-09-13
Threat Roundup for September 6 to September 13
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 6 and Sept. 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threa
Fortinet
WordPress (Core) Stored XSS Vulnerability: An Analysis | FortiGuard Labs
blogs_fortinet·2019-09-12·CVSS 6.1
[MEDIUM] WordPress (Core) Stored XSS Vulnerability: An Analysis | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
WordPress (Core) Stored XSS Vulnerability: An Analysis
By Zhouyuan Yang | September 12, 2019
WordPress is the world’s most popular Content Management System (CMS). It has 60.4% of the global CMS market share, which is far higher than the second-place CMS, Joomla!, which only has 5.2% of the market share. As a result, over a third of all of the websites on the Internet were built using WordPress.
The FortiGuard Labs team recently discovered a stored Cross-Site Scripting (XSS) zero-day vulnerability in WordPress. This XSS vulnerability is caused by the new built-in editor Gutenberg found in WordPress 5.0. The editor fails to filter the JavaScript/HTML code in the Shortcode error message. This allows a remote attacker with Contributor or higher permission to
Fortinet
Another Local Privilege Escalation Vulnerability Using Process Creation Impersonation
blogs_fortinet·2019-09-10
Another Local Privilege Escalation Vulnerability Using Process Creation Impersonation
FORTIGUARD LABS THREAT RESEARCH
Another Local Privilege Escalation (LPE) Vulnerability Using Process Creation Impersonation
By Wayne Chin Yick Low | September 10, 2019
Introduction
Over the past few months, FortiGuard Labs has been working closely with the Microsoft Security Response Centre (MSRC) to address multiple local privilege escalation (LPE) vulnerabilities that we discovered on the Windows platform. One of the most notable LPE vulnerabilities we reported to MSRC was found on the Windows Network Connectivity Assistant (NCA), which is only enabled on the Enterprise or Education versions of Microsoft Windows 10. The nature of this LPE vulnerability had previously been reported to MSRC as proof-of-concept (POC) by James Forshaw, an author and security researcher in Google's Project
Checkpoint
9th September – Threat Intelligence Bulletin
blogs_checkpoint·2019-09-09
CVE-2019-0708 9th September – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 9th September – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 9th September 2019, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Attackers have convinced the CEO of an energy company to send $243,000 to a fake supplier using AI to create a deep fake voice impersonation of a chief executive.
“Joker”, an Android spyware first spotted in June 2019, has been found on 24 different applications on Google Play store. Designed to steal SMS messag
Talos
Threat Roundup for August 30 to September 6
blogs_talos·2019-09-06
Threat Roundup for August 30 to September 6
## Threat Roundup for August 30 to September 6
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 30 and Sept. 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats
Talos
Threat Roundup for August 30 to September 6
blogs_talos·2019-09-06
Threat Roundup for August 30 to September 6
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 30 and Sept. 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Talos
Threat Roundup for August 23 to August 30
blogs_talos·2019-08-30
Threat Roundup for August 23 to August 30
## Threat Roundup for August 23 to August 30
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 23 and Aug. 30. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for August 23 to August 30
blogs_talos·2019-08-30
Threat Roundup for August 23 to August 30
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 23 and Aug. 30. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Unit42
Exploitation of Windows CVE-2019-0708 (BlueKeep): Three Ways to Write Data into Kernel with RDP PDU
blogs_unit42·2019-08-29·CVSS 9.8
CVE-2019-0708 [CRITICAL] Exploitation of Windows CVE-2019-0708 (BlueKeep): Three Ways to Write Data into Kernel with RDP PDU
Threat Research Center
Threat Research
Vulnerabilities
## Exploitation of Windows CVE-2019-0708 (BlueKeep): Three Ways to Write Data into Kernel with RDP PDU
Tao Yan
Jin Chen
Published: August 29, 2019
Threat Research
Vulnerabilities
Bluekeep
CVE-2019-0708
RDP
## Executive Summary
In May 2019, Microsoft released an out-of-band patch update for remote code execution vulnerability CVE-2019-0708 , which is also known as “BlueKeep” and resides in code to Remote Desktop Services (RDS). This vulnerability is pre-authentication and requires no user interaction, making it particularly dangerous as it has the unsettling potential to be weaponized into a destructive exploit. If successfully exploited, this vulnerability could execute arbitrary code with “system” privileges. The Micr
Unit42
Exploitation of Windows CVE-2019-0708 (BlueKeep): Three Ways to Write Data into Kernel with RDP PDU
blogs_unit42·2019-08-29·CVSS 9.8
CVE-2019-0708 [CRITICAL] Exploitation of Windows CVE-2019-0708 (BlueKeep): Three Ways to Write Data into Kernel with RDP PDU
## Executive Summary
In May 2019, Microsoft released an out-of-band patch update for remote code execution vulnerability CVE-2019-0708, which is also known as “BlueKeep” and resides in code to Remote Desktop Services (RDS). This vulnerability is pre-authentication and requires no user interaction, making it particularly dangerous as it has the unsettling potential to be weaponized into a destructive exploit. If successfully exploited, this vulnerability could execute arbitrary code with “system” privileges. The Microsoft Security Response Center advisory indicates this vulnerability may also be wormable, a behavior seen in attacks including Wannacry and EsteemAudit. Understanding the seriousness of this vulnerability and its potential impact to the public, Microsoft took the rare step of
Talos
Threat Roundup for August 16 to August 23
blogs_talos·2019-08-23
Threat Roundup for August 16 to August 23
## Threat Roundup for August 16 to August 23
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 16 and Aug. 23. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is
Talos
Threat Roundup for August 16 to August 23
blogs_talos·2019-08-23
Threat Roundup for August 16 to August 23
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 16 and Aug. 23. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Fortinet
The Gamaredon Group: A TTP Profile Analysis
blogs_fortinet·2019-08-21
The Gamaredon Group: A TTP Profile Analysis
FORTIGUARD LABS THREAT RESEARCH
The Gamaredon Group: A TTP Profile Analysis
By Evgeny Ananin and Artem Semenchenko | August 21, 2019
AFortiGuard Labs Threat Analysis
FortiGuard Labs recently discovered a fresh malicious campaign being run by the Gamaredon Group possibly targeting Ukrainian law enforcement and government agencies. We decided to provide an analysis of the current campaign, particularly focusing on the tools and methods used by these malicious actors to try to understand their methodologies and what resources are needed to launch these types of attacks.
The Gamaredon Group has been actively launching spear-phishing attacks against Ukrainian government and military departments from the mid-2013s. In one article published in the Kharkiv Observer – an independent Ukranian o
Sentinelone
What's New With Bluekeep? Are Your Devices Vulnerable?
blogs_sentinelone·2019-08-19·CVSS 9.8
CVE-2019-0708 [CRITICAL] What's New With Bluekeep? Are Your Devices Vulnerable?
On May 14th, Microsoft released its May 2019 Patch Tuesday. Among several security fixes, it also included a fix for a high-severity security flaw in Microsoft Windows’ RDP (Remote Desktop) component. The vulnerability, dubbed “Bluekeep” and cataloged as CVE-2019-0708 allows attackers to gain remote code execution on machines without being authenticated. The vulnerable versions of Windows are Windows XP, Windows Server 2003, Windows Server 2008 R2 and Windows 7.
The vulnerability is so severe that Microsoft has released exceptional patches for no-longer supported versions of the OS: Windows XP and Windows Server 2003.
## Are Your Devices Vulnerable To Bluekeep?
Recently, Shodan added a new dashboard for tracking Bluekeep, Eternalblue and HeartBleed per country. In the US alone, for exam
Sentinelone
What's New With Bluekeep? Are Your Devices Vulnerable?
blogs_sentinelone·2019-08-19·CVSS 9.8
CVE-2019-0708 [CRITICAL] What's New With Bluekeep? Are Your Devices Vulnerable?
On May 14th, Microsoft released its May 2019 Patch Tuesday. Among several security fixes, it also included a fix for a high-severity security flaw in Microsoft Windows’ RDP (Remote Desktop) component. The vulnerability, dubbed “Bluekeep” and cataloged as CVE-2019-0708 allows attackers to gain remote code execution on machines without being authenticated . The vulnerable versions of Windows are Windows XP, Windows Server 2003, Windows Server 2008 R2 and Windows 7.
The vulnerability is so severe that Microsoft has released exceptional patches for no-longer supported versions of the OS: Windows XP and Windows Server 2003.
## Are Your Devices Vulnerable To Bluekeep?
Recently, Shodan added a new dashboard for tracking Bluekeep, Eternalblue and HeartBleed per country. In the US alone, for exa
Talos
Threat Roundup for August 9 to August 16
blogs_talos·2019-08-16
Threat Roundup for August 9 to August 16
## Threat Roundup for August 9 to August 16
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 9 and Aug. 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is s
Talos
Threat Roundup for August 9 to August 16
blogs_talos·2019-08-16
Threat Roundup for August 9 to August 16
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 9 and Aug. 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat
Tenable
Tenable Roundup for Microsoft’s August 2019 Patch Tuesday: DejaBlue
blogs_tenable·2019-08-13
Tenable Roundup for Microsoft’s August 2019 Patch Tuesday: DejaBlue
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Roundup for August 2 to August 9
blogs_talos·2019-08-09
Threat Roundup for August 2 to August 9
## Threat Roundup for August 2 to August 9
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 2 and Aug. 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is sub
Talos
Threat Roundup for August 2 to August 9
blogs_talos·2019-08-09
Threat Roundup for August 2 to August 9
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Aug. 2 and Aug. 9. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat o
Talos
Threat Roundup for July 26 to Aug. 2
blogs_talos·2019-08-02
Threat Roundup for July 26 to Aug. 2
## Threat Roundup for July 26 to Aug. 2
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 26 and Aug. 2. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats. As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subjec
Talos
Threat Roundup for July 26 to Aug. 2
blogs_talos·2019-08-02
Threat Roundup for July 26 to Aug. 2
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 26 and Aug. 2. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat o
Securelist
APT trends report Q2 2019
blogs_securelist·2019-08-01
APT trends report Q2 2019
Table of Contents
- The most remarkable findings
- Russian-speaking activity
- Chinese-speaking activity
- Middle East
- Southeast Asia and Korean Peninsula
- Other interesting discoveries
- Final thoughts
Authors
- GReAT
For two years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports. They aim to highlight the significant events and findings that we feel people should be aware of.
This is our latest installment, focusing on activities that we observed during Q2 2019.
Readers who would like to learn more abou
Securelist
APT trends report Q2 2019
blogs_securelist·2019-08-01
APT trends report Q2 2019
Table of Contents
The most remarkable findings
Russian-speaking activity
Chinese-speaking activity
Middle East
Southeast Asia and Korean Peninsula
Other interesting discoveries
Final thoughts
Authors
GReAT
For two years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports. They aim to highlight the significant events and findings that we feel people should be aware of.
This is our latest installment, focusing on activities that we observed during Q2 2019.
Readers who would like to learn more about our intel
Tenable
CVE-2019-0708: BlueKeep Exploits Could Be Around the Corner
blogs_tenable·2019-08-01·CVSS 9.8
[CRITICAL] CVE-2019-0708: BlueKeep Exploits Could Be Around the Corner
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
What Capital One's Data Leak Tells Us About Firewall Exploits
blogs_sentinelone·2019-07-31
What Capital One's Data Leak Tells Us About Firewall Exploits
This week’s big security news involved a data breach at Capital One that, by the company’s own estimate , affected approximately 100 million individuals in the United States and approximately 6 million Canadians. Among the data leaked were 140,00 Social Security Numbers (SSNs) and 80,000 bank account numbers belonging to secured credit card customers. It has been claimed that the Capital One breach may be as far reaching as the Equifax breach of 2017, which affected an estimated 147 million consumers and cost the company at least $575 million in fines and up to $700 million in compensation.
So what exactly happened at Capital One, how did it happen and what lessons can we learn from yet another massive data breach ?
## What Happened At Capital One?
As has been well-documented since the
Tenable
WatchBog Malware Adds BlueKeep Scanner (CVE-2019-0708), New Exploits (CVE-2019-10149, CVE-2019-11581)
blogs_tenable·2019-07-25·CVSS 9.8
[CRITICAL] WatchBog Malware Adds BlueKeep Scanner (CVE-2019-0708), New Exploits (CVE-2019-10149, CVE-2019-11581)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Fortinet
“BlueKeep” Vulnerability (CVE-2019-0708) within Cloud/Datacenter Machines: How to Safeguard Yourself?
blogs_fortinet·2019-06-12·CVSS 9.8
CVE-2019-0708 [CRITICAL] “BlueKeep” Vulnerability (CVE-2019-0708) within Cloud/Datacenter Machines: How to Safeguard Yourself?
FORTIGUARD LABS THREAT RESEARCH
“BlueKeep” Vulnerability (CVE-2019-0708) within Cloud/Datacenter Machines: How to Safeguard Yourself?
By Kushal Arvind Shah | June 12, 2019
Afew weeks back, FortiGuard Labs heard of the BlueKeep RDP Wormable Vulnerability [CVE-2019-0708]. According to Microsoft, this vulnerability affects the Remote Desktop Protocol (RDP) service included in older versions of Windows OS, such as Windows XP, Windows Vista, Windows 7, Windows Server 2003, Windows Server 2008, and Windows Server 2008R2.
Recently, there was an article by Robert Graham of Errata Security saying that nearly 1 million machines are still vulnerable to this critical vulnerability. Microsoft and even the NSA have recently issued advisories asking users to patch their systems to avoid another attack
Checkpoint
3rd June – Threat Intelligence Bulletin
blogs_checkpoint·2019-06-03
CVE-2019-0708 3rd June – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd June – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 3rd June 2019, please download our Threat Intelligence Bulletin
TOP ATTACKS AND BREACHES
Around 855 million of insurance-related documents have been leaked online after the US real-estate insurance company First American Financial Corp. accidentally left the documents unsecured on their website. The leaked data, dated back to 2003, included bank account numbers, mortgage and tax records, social security numbers
Talos
Using Firepower to defend against encrypted RDP attacks like BlueKeep
blogs_talos·2019-05-31·CVSS 9.8
CVE-2019-0708 [CRITICAL] Using Firepower to defend against encrypted RDP attacks like BlueKeep
## Using Firepower to defend against encrypted RDP attacks like BlueKeep
This blog was authored by Brandon Stultz
Microsoft recently released fixes for a critical pre-authentication remote code execution vulnerability in Remote Desktop Protocol Services (RDP). Identified as CVE-2019-0708 in May's Patch Tuesday , the vulnerability caught the attention of researchers and the media due to the fact that it was "wormable," meaning an attack exploiting this vulnerability could easily spread from one machine to another. This was discussed at length in episode 54 of our 'Beers with Talos' podcast.
Cisco Talos started reverse-engineering work immediately to determine how exactly RDP was vulnerable. Talos wrote and released coverage as soon as we were able to determine the vulnerability condition
Talos
Using Firepower to defend against encrypted RDP attacks like BlueKeep
blogs_talos·2019-05-31·CVSS 9.8
CVE-2019-0708 [CRITICAL] Using Firepower to defend against encrypted RDP attacks like BlueKeep
This blog was authored by Brandon Stultz
Microsoft recently released fixes for a critical pre-authentication remote code execution vulnerability in Remote Desktop Protocol Services (RDP). Identified as CVE-2019-0708 in May's Patch Tuesday, the vulnerability caught the attention of researchers and the media due to the fact that it was "wormable," meaning an attack exploiting this vulnerability could easily spread from one machine to another. This was discussed at length in episode 54 of our 'Beers with Talos' podcast.
Cisco Talos started reverse-engineering work immediately to determine how exactly RDP was vulnerable. Talos wrote and released coverage as soon as we were able to determine the vulnerability condition. SID 50137 for SNORT® correctly blocks exploitation of CVE-2019-0708 and s
Trendmicro
CVE-2019-0725: An Analysis of Its Exploitability
blogs_trendmicro·2019-05-29·CVSS 9.8
CVE-2019-0725 [CRITICAL] CVE-2019-0725: An Analysis of Its Exploitability
Exploits & Vulnerabilities
# CVE-2019-0725: An Analysis of Its Exploitability
It’s worth noting that DHCP-related vulnerabilities are drawing more attention in Patch Tuesdays this year. An example is CVE-2019-0725, which doesn’t require user interaction, and affects all versions of Windows Server. How bad is it exactly?
By: John Simpson
May 29, 2019
Read time: ( words)
Save to Folio
May’s Patch Tuesday saw what is likely to be one of the most prominent vulnerabilities this year with the “wormable” Windows Terminal Services vulnerability (CVE-2019-0708). However, there’s another remote code execution (RCE) vulnerability that would be hard to ignore: CVE-2019-0725, an RCE vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. It’s worth noting that DHCP-related vul
Trendmicro
CVE-2019-0725: An Analysis of Its Exploitability
blogs_trendmicro·2019-05-29·CVSS 9.8
CVE-2019-0725 [CRITICAL] CVE-2019-0725: An Analysis of Its Exploitability
Exploits & Vulnerabilities
# CVE-2019-0725: An Analysis of Its Exploitability
It’s worth noting that DHCP-related vulnerabilities are drawing more attention in Patch Tuesdays this year. An example is CVE-2019-0725, which doesn’t require user interaction, and affects all versions of Windows Server. How bad is it exactly?
By: John Simpson
2019/05/29
Read time: ( words)
Save to Folio
May’s Patch Tuesday saw what is likely to be one of the most prominent vulnerabilities this year with the “wormable” Windows Terminal Services vulnerability (CVE-2019-0708). However, there’s another remote code execution (RCE) vulnerability that would be hard to ignore: CVE-2019-0725, an RCE vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. It’s worth noting that DHCP-related vulne
Trendmicro
CVE-2019-0725: An Analysis of Its Exploitability
blogs_trendmicro·2019-05-29·CVSS 9.8
CVE-2019-0725 [CRITICAL] CVE-2019-0725: An Analysis of Its Exploitability
Exploits & Vulnerabilities
## CVE-2019-0725: An Analysis of Its Exploitability
It’s worth noting that DHCP-related vulnerabilities are drawing more attention in Patch Tuesdays this year. An example is CVE-2019-0725, which doesn’t require user interaction, and affects all versions of Windows Server. How bad is it exactly?
By: John Simpson May 29, 2019 Read time: ( words)
Save to Folio
May’s Patch Tuesday saw what is likely to be one of the most prominent vulnerabilities this year with the “wormable” Windows Terminal Services vulnerability ( CVE-2019-0708 ). However, there’s another remote code execution (RCE) vulnerability that would be hard to ignore: CVE-2019-0725 , an RCE vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. It’s worth noting that DHCP-related
Trendmicro
CVE-2019-0725: An Analysis of Its Exploitability
blogs_trendmicro·2019-05-29·CVSS 9.8
CVE-2019-0725 [CRITICAL] CVE-2019-0725: An Analysis of Its Exploitability
Ausnutzung von Schwachstellen
## CVE-2019-0725: An Analysis of Its Exploitability
It’s worth noting that DHCP-related vulnerabilities are drawing more attention in Patch Tuesdays this year. An example is CVE-2019-0725, which doesn’t require user interaction, and affects all versions of Windows Server. How bad is it exactly?
By: John Simpson May 29, 2019 Read time: ( words)
Save to Folio
May’s Patch Tuesday saw what is likely to be one of the most prominent vulnerabilities this year with the “wormable” Windows Terminal Services vulnerability ( CVE-2019-0708 ). However, there’s another remote code execution (RCE) vulnerability that would be hard to ignore: CVE-2019-0725 , an RCE vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. It’s worth noting that DHCP-relat
Trendmicro
CVE-2019-0725: An Analysis of Its Exploitability
blogs_trendmicro·2019-05-29·CVSS 9.8
CVE-2019-0725 [CRITICAL] CVE-2019-0725: An Analysis of Its Exploitability
Exploits & Vulnerabilities
## CVE-2019-0725: An Analysis of Its Exploitability
It’s worth noting that DHCP-related vulnerabilities are drawing more attention in Patch Tuesdays this year. An example is CVE-2019-0725, which doesn’t require user interaction, and affects all versions of Windows Server. How bad is it exactly?
By: John Simpson 2019/05/29 Read time: ( words)
Save to Folio
May’s Patch Tuesday saw what is likely to be one of the most prominent vulnerabilities this year with the “wormable” Windows Terminal Services vulnerability ( CVE-2019-0708 ). However, there’s another remote code execution (RCE) vulnerability that would be hard to ignore: CVE-2019-0725 , an RCE vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. It’s worth noting that DHCP-related vu
Trendmicro
CVE-2019-0725: An Analysis of Its Exploitability
blogs_trendmicro·2019-05-29·CVSS 9.8
CVE-2019-0725 [CRITICAL] CVE-2019-0725: An Analysis of Its Exploitability
Sfruttamento vulnerabilità
## CVE-2019-0725: An Analysis of Its Exploitability
It’s worth noting that DHCP-related vulnerabilities are drawing more attention in Patch Tuesdays this year. An example is CVE-2019-0725, which doesn’t require user interaction, and affects all versions of Windows Server. How bad is it exactly?
By: John Simpson May 29, 2019 Read time: ( words)
Save to Folio
May’s Patch Tuesday saw what is likely to be one of the most prominent vulnerabilities this year with the “wormable” Windows Terminal Services vulnerability ( CVE-2019-0708 ). However, there’s another remote code execution (RCE) vulnerability that would be hard to ignore: CVE-2019-0725 , an RCE vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. It’s worth noting that DHCP-related
Trendmicro
CVE-2019-0725: An Analysis of Its Exploitability
blogs_trendmicro·2019-05-29·CVSS 9.8
CVE-2019-0725 [CRITICAL] CVE-2019-0725: An Analysis of Its Exploitability
Exploits y vulnerabilidades
## CVE-2019-0725: An Analysis of Its Exploitability
It’s worth noting that DHCP-related vulnerabilities are drawing more attention in Patch Tuesdays this year. An example is CVE-2019-0725, which doesn’t require user interaction, and affects all versions of Windows Server. How bad is it exactly?
By: John Simpson May 29, 2019 Read time: ( words)
Save to Folio
May’s Patch Tuesday saw what is likely to be one of the most prominent vulnerabilities this year with the “wormable” Windows Terminal Services vulnerability ( CVE-2019-0708 ). However, there’s another remote code execution (RCE) vulnerability that would be hard to ignore: CVE-2019-0725 , an RCE vulnerability in Windows Dynamic Host Configuration Protocol (DHCP) Server. It’s worth noting that DHCP-related
Fortinet
CVE-2019-0708 – Remote Desktop Protocol and Remote Code Execution #Bluekeep
blogs_fortinet·2019-05-23·CVSS 9.8
CVE-2019-0708 [CRITICAL] CVE-2019-0708 – Remote Desktop Protocol and Remote Code Execution #Bluekeep
FORTIGUARD LABS THREAT RESEARCH
CVE-2019-0708 – Remote Desktop Protocol and Remote Code Execution #Bluekeep
By FortiGuard SE Team | May 23, 2019
On May 14th, 2019, Microsoft released their usual set of updates, referred to within the industry as “Patch Tuesday.” At first glance, the inclusion of CVE-2019-0708 appeared to be similar to all the other updates released on that day—it included a writeup containing an overview of the update, including the Impact (Remote Code Execution), Severity (Critical), and Platforms (multiple) affected.
However, what piqued the curiosity of the security community was that the platforms listed as affected by this vulnerability were products considered to be no longer supported by Microsoft:
Windows XP SP3 x86, Windows XP Professional x64 Edition SP2, Win
Talos
Talos releases coverage for 'wormable' Microsoft vulnerability
blogs_talos·2019-05-21·CVSS 9.8
CVE-2019-0708 [CRITICAL] Talos releases coverage for 'wormable' Microsoft vulnerability
## Talos releases coverage for 'wormable' Microsoft vulnerability
Last night, Cisco Talos released the latest SNORT® rule update , which includes coverage for the critical Microsoft vulnerability CVE-2019-0708.
The company disclosed this vulnerability last week as part of its monthly security update . This particular bug exists in Remote Desktop Services — formerly known as Terminal Services.
The vulnerability requires no user interaction and is pre-authentication. Microsoft specifically warned against this bug because it is "wormable," meaning future malware that exploits this vulnerability could spread from system to system. One of the most infamous examples of a worm was the WannaCry malware , which disabled major services across the globe in May 2017. An attacker could exploit this
Talos
Talos releases coverage for 'wormable' Microsoft vulnerability
blogs_talos·2019-05-21·CVSS 9.8
CVE-2019-0708 [CRITICAL] Talos releases coverage for 'wormable' Microsoft vulnerability
Last night, Cisco Talos released the latest SNORT® rule update, which includes coverage for the critical Microsoft vulnerability CVE-2019-0708.
The company disclosed this vulnerability last week as part of its monthly security update. This particular bug exists in Remote Desktop Services — formerly known as Terminal Services.
The vulnerability requires no user interaction and is pre-authentication. Microsoft specifically warned against this bug because it is "wormable," meaning future malware that exploits this vulnerability could spread from system to system. One of the most infamous examples of a worm was the WannaCry malware, which disabled major services across the globe in May 2017. An attacker could exploit this vulnerability by sending a specially crafted request to the target sys
Qualys
Windows RDP Remote Code Execution Vulnerability (BlueKeep) - How to Detect and Patch | Qualys
blogs_qualys·2019-05-16·CVSS 9.8
CVE-2019-0708 [CRITICAL] Windows RDP Remote Code Execution Vulnerability (BlueKeep) - How to Detect and Patch | Qualys
#### Table of Contents
- Detecting CVE-2019-0708
- BlueKeep Unauthenticated check Update:
- Tracking Impact and Remediation
- Remediating with Qualys Patch Management
- Get Started Now
This month’s Microsoft Patch Tuesday included a very high-risk vulnerability (CVE-2019-0708, aka BlueKeep) in Remote Desktop that impacts Windows XP, Windows 7, Server 2003, Server 2008, and Server 2008 R2. This vulnerability allows an unauthenticated attacker (or malware) to execute code on the vulnerable system. It is very likely that PoC code will be published soon, and this may result in a WannaCry-style attack.
Microsoft has not only released patches for Windows 7, Server 2008 & R2, but also has taken the extra step to issue patches for Windows XP and Server 2003. Patch now!
UPDATE: Network Level Au
Qualys
Windows RDP Remote Code Execution Vulnerability (BlueKeep) – How to Detect and Patch
blogs_qualys·2019-05-16·CVSS 9.8
CVE-2019-0708 [CRITICAL] Windows RDP Remote Code Execution Vulnerability (BlueKeep) – How to Detect and Patch
## Table of Contents
Detecting CVE-2019-0708
BlueKeep Unauthenticated check Update:
Tracking Impact and Remediation
Remediating with Qualys Patch Management
Get Started Now
This month’s Microsoft Patch Tuesday included a very high-risk vulnerability (CVE-2019-0708, aka BlueKeep) in Remote Desktop that impacts Windows XP, Windows 7, Server 2003, Server 2008, and Server 2008 R2. This vulnerability allows an unauthenticated attacker (or malware) to execute code on the vulnerable system. It is very likely that PoC code will be published soon, and this may result in a WannaCry-style attack.
Microsoft has not only released patches for Windows 7, Server 2008 & R2, but also has taken the extra step to issue patches for Windows XP and Server 2003. Patch now!
UPDATE: Network Level Authentica
Trendmicro
Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
blogs_trendmicro·2019-05-15·CVSS 9.8
CVE-2019-0708 [CRITICAL] Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Sfruttamento vulnerabilità
## Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003.
By: Trend Micro Research May 15, 2019 Read time: ( words)
Save to Folio
Update as of 5/17/2019 10:15AM PHT: Added rules for CVE-2019-0708 in Trend Micro Deep Security and Tipping Point.
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003 not included in the mainstream customer support notification. Of the security vulnerabilities fixed in this releas
Trendmicro
Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
blogs_trendmicro·2019-05-15·CVSS 9.8
CVE-2019-0708 [CRITICAL] Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Exploits & Vulnerabilities
# Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003.
By: Trend Micro Research
2019/05/15
Read time: ( words)
Save to Folio
Update as of 5/17/2019 10:15AM PHT: Added rules for CVE-2019-0708 in Trend Micro Deep Security and Tipping Point.
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003 not included in the mainstream customer support notification. Of the security vulnerabilities fixed in this release,
Dragos
ICS Impact from Microsoft RDP Vulnerability
blogs_dragos·2019-05-15·CVSS 9.8
[CRITICAL] ICS Impact from Microsoft RDP Vulnerability
Microsoft released a security advisory on May 14 for a vulnerability it says could enable a wormable malware attack similar to WannaCry . The WannaCry ransomware attack had disastrous effects and impacted businesses worldwide, including industrial control system (ICS) entities like automotive manufacturers, rail service providers, and some U.S. utilities. So, Microsoft’s warning greatly concerns ICS asset owners-operators.
The vulnerability lies in Remote Desktop Services used worldwide by many industrial environments to enable remote operators and engineers to access control system environments. Specifically, an adversary can attack a computer running this service allowing them to delete files, make changes to data, or create accounts with administrative privileges, or launch a malware a
Trendmicro
Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
blogs_trendmicro·2019-05-15·CVSS 9.8
CVE-2019-0708 [CRITICAL] Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Exploits & Vulnerabilities
## Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003.
By: Trend Micro Research May 15, 2019 Read time: ( words)
Save to Folio
Update as of 5/17/2019 10:15AM PHT: Added rules for CVE-2019-0708 in Trend Micro Deep Security and Tipping Point.
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003 not included in the mainstream customer support notification. Of the security vulnerabilities fixed in this releas
Trendmicro
Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
blogs_trendmicro·2019-05-15·CVSS 9.8
CVE-2019-0708 [CRITICAL] Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Exploits & Vulnerabilities
## Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003.
By: Trend Micro Research 2019/05/15 Read time: ( words)
Save to Folio
Update as of 5/17/2019 10:15AM PHT: Added rules for CVE-2019-0708 in Trend Micro Deep Security and Tipping Point.
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003 not included in the mainstream customer support notification. Of the security vulnerabilities fixed in this release,
Trendmicro
Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
blogs_trendmicro·2019-05-15·CVSS 9.8
CVE-2019-0708 [CRITICAL] Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Exploits & Vulnerabilities
# Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003.
By: Trend Micro Research
May 15, 2019
Read time: ( words)
Save to Folio
Update as of 5/17/2019 10:15AM PHT: Added rules for CVE-2019-0708 in Trend Micro Deep Security and Tipping Point.
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003 not included in the mainstream customer support notification. Of the security vulnerabilities fixed in this releas
Trendmicro
Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
blogs_trendmicro·2019-05-15·CVSS 9.8
CVE-2019-0708 [CRITICAL] Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Ausnutzung von Schwachstellen
## Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003.
By: Trend Micro Research May 15, 2019 Read time: ( words)
Save to Folio
Update as of 5/17/2019 10:15AM PHT: Added rules for CVE-2019-0708 in Trend Micro Deep Security and Tipping Point.
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003 not included in the mainstream customer support notification. Of the security vulnerabilities fixed in this rel
Dragos
ICS Impact from Microsoft RDP Vulnerability
blogs_dragos·2019-05-15·CVSS 9.8
[CRITICAL] ICS Impact from Microsoft RDP Vulnerability
Blog
# ICS Impact from Microsoft RDP Vulnerability
May 15, 2019 05:49 PM4 min readReid Wightman
Microsoft released a security advisory on May 14 for a vulnerability it says could enable a wormable malware attack similar to WannaCry. The WannaCry ransomware attack had disastrous effects and impacted businesses worldwide, including industrial control system (ICS) entities like automotive manufacturers, rail service providers, and some U.S. utilities. So, Microsoft’s warning greatly concerns ICS asset owners-operators.
The vulnerability lies in Remote Desktop Services used worldwide by many industrial environments to enable remote operators and engineers to access control system environments. Specifically, an adversary can attack a computer running this service allowing them to delete fil
Trendmicro
Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
blogs_trendmicro·2019-05-15·CVSS 9.8
CVE-2019-0708 [CRITICAL] Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Exploits y vulnerabilidades
## Patch Tuesday: Fixes for 'Wormable' Flaw, Zero-Day
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003.
By: Trend Micro Research May 15, 2019 Read time: ( words)
Save to Folio
Update as of 5/17/2019 10:15AM PHT: Added rules for CVE-2019-0708 in Trend Micro Deep Security and Tipping Point.
Microsoft’s May security release includes updates for 80 vulnerabilities for a number of Microsoft products, including a security update for unsupported operating systems such as Windows XP and Server 2003 not included in the mainstream customer support notification. Of the security vulnerabilities fixed in this relea
Krebs
Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003
blogs_krebs·2019-05-14·CVSS 9.8
CVE-2019-0708 [CRITICAL] Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003
Microsoft today is taking the unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003 , citing the discovery of a “wormable” flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of 2017.
The May 2017 global malware epidemic WannaCry affected some 200,000 Windows systems in 150 countries. Source: Wikipedia.
The vulnerability ( CVE-2019-0708 ) resides in the “remote desktop services” component built into supported versions of Windows, including Windows 7 , Windows Server 2008 R2 , and Windows Server 2008 . It also is present in computers powered by Windows XP and Windows 2003, operating systems for which Microsoft long ago stopped shipping security updat
Qualys
May 2019 Patch Tuesday - 79 Vulns, 22 Critical, RDP RCE, MDS Attacks, Adobe Vulns | Qualys
blogs_qualys·2019-05-14·CVSS 9.8
[CRITICAL] May 2019 Patch Tuesday - 79 Vulns, 22 Critical, RDP RCE, MDS Attacks, Adobe Vulns | Qualys
This month’s Microsoft Patch Tuesday addresses 79 vulnerabilities with 22 of them labeled as Critical. Of the 22 Critical vulns, 18 are for scripting engines and browsers. The remaining 4 are remote code execution (RCE) in Remote Desktop, DHCP Server, GDI+, and Word. Microsoft also released guidance on the recently disclosed Microarchitectural Data Sampling (MDS) techniques, known as ZombieLoad, Fallout, and RIDL. Adobe’s Patch Tuesday includes patches for vulnerabilities in Flash, Acrobat/Reader (83 vulnerabilities!) and Media Encoder.
UPDATE May 15: Microsoft has also issued Remote Desktop patches for Windows XP and Server 2003.
### Workstation Patches
Scripting Engine, Browser, GDI+, and Word patches should be prioritized for workstation-type devices, meaning any system that is used
Qualys
May 2019 Patch Tuesday – 79 Vulns, 22 Critical, RDP RCE, MDS Attacks, Adobe Vulns
blogs_qualys·2019-05-14·CVSS 9.8
[CRITICAL] May 2019 Patch Tuesday – 79 Vulns, 22 Critical, RDP RCE, MDS Attacks, Adobe Vulns
This month’s Microsoft Patch Tuesday addresses 79 vulnerabilities with 22 of them labeled as Critical. Of the 22 Critical vulns, 18 are for scripting engines and browsers. The remaining 4 are remote code execution (RCE) in Remote Desktop, DHCP Server, GDI+, and Word. Microsoft also released guidance on the recently disclosed Microarchitectural Data Sampling (MDS) techniques, known as ZombieLoad, Fallout, and RIDL. Adobe’s Patch Tuesday includes patches for vulnerabilities in Flash, Acrobat/Reader (83 vulnerabilities!) and Media Encoder.
UPDATE May 15 : Microsoft has also issued Remote Desktop patches for Windows XP and Server 2003.
## Workstation Patches
Scripting Engine, Browser, GDI+, and Word patches should be prioritized for workstation-type devices, meaning any system that is used
Krebs
Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003
blogs_krebs·2019-05-14·CVSS 9.8
CVE-2019-0708 [CRITICAL] Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003
Microsoft today is taking the unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003, citing the discovery of a “wormable” flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of 2017.
The vulnerability (CVE-2019-0708) resides in the “remote desktop services” component built into supported versions of Windows, including Windows 7, Windows Server 2008 R2, and Windows Server 2008. It also is present in computers powered by Windows XP and Windows 2003, operating systems for which Microsoft long ago stopped shipping security updates.
Microsoft said the company has not yet observed any evidence of attacks against the dangerous security flaw, but that it is
Zscaler
Critical Vulnerability in MS Windows Desktop | Zscaler Blog
blogs_zscaler·2019-05-14·CVSS 9.8
[CRITICAL] Critical Vulnerability in MS Windows Desktop | Zscaler Blog
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Tenable
Critical 'BlueKeep' Vulnerability CVE-2019-0708 Addressed in Patch Tuesday Updates
blogs_tenable·2019-05-14·CVSS 9.8
[CRITICAL] Critical 'BlueKeep' Vulnerability CVE-2019-0708 Addressed in Patch Tuesday Updates
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
RobinHood Ransomware “CoolMaker” Functions Not So Cool
blogs_sentinelone·2019-05-09·CVSS 9.8
[CRITICAL] RobinHood Ransomware “CoolMaker” Functions Not So Cool
## RobinHood Ransomware “CoolMaker” Functions Not So Cool
main_CoolMaker
## Overview of RobinHood Ransomware
RobinHood is a malware that encrypts the victim’s hard drive with the RSA+AES cryptographical combination and instructs the victim to reach out to them via Onion Tor website. The RobinHood ransomware drops the victim notification file on the desktop detailing the demands and how to make contact.
Once contact is made, the attackers claim they will make a decryption tool available, thereby allowing the victim to recover their precious files, in return for payments made in bitcoin.
psexec
Update (July 26): Since this analysis, others have claimed that Robinhood was leveraging EternalBlue as a means to propagate. Those claims are incorrect, and it has now been confirmed by the Cit
Sentinelone
RobinHood Ransomware “CoolMaker” Functions Not So Cool - SentinelLabs
blogs_sentinelone·2019-05-09·CVSS 9.8
[CRITICAL] RobinHood Ransomware “CoolMaker” Functions Not So Cool - SentinelLabs
RobinHood ransomware is one of the more interesting Golang ransomware variants to have appeared on the ransomware landscape recently. The ransomware was previously used in the high-profile infection encrypting computers in the City of Greenville and most recently in the City of Baltimore. It was originally coded in the Go programming language and compiled to a 32-bit executable. In this technical analysis, we will explore the `main_CoolMaker` functions meant to disable the machine and interrupt backup and other PC vital services.
## Overview of RobinHood Ransomware
RobinHood is a malware that encrypts the victim’s hard drive with the RSA+AES cryptographical combination and instructs the victim to reach out to them via Onion Tor website. The RobinHood ransomware drops the victim notificat
Fortinet
WordPress WooCommerce XSS Vulnerability – Hijacking a Customer Account with a Crafted Image
blogs_fortinet·2019-03-04·CVSS 6.1
[MEDIUM] WordPress WooCommerce XSS Vulnerability – Hijacking a Customer Account with a Crafted Image
FORTIGUARD LABS THREAT RESEARCH
WordPress WooCommerce XSS Vulnerability – Hijacking a Customer Account with a Crafted Image
By Zhouyuan Yang | March 04, 2019
Overview
The FortiGuard Labs team recently discovered a Cross-Site Scripting (XSS) vulnerability in WooCommerce. WooCommerce is an open-source eCommerce platform built on WordPress. According to BuiltWith statistics, WooCommerce is the No. 1 eCommerce platform, owning 22% of global market share in 2018.
This XSS vulnerability (CVE-2019-9168) exists in the zoom display of the Photoswipe function, where WooCommerce failed to sterilize an image’s title and caption data This vulnerability may allow an attacker to inject arbitrary code into a WooCommerce-powered website. When a victim visits the webpage with the attack code inserted, th
Fortinet
VirtualBox Exploit: Oracle Network DoS Vulnerability | Fortinet Blog
blogs_fortinet·2019-01-31·CVSS 6.5
CVE-2019-2527 [MEDIUM] VirtualBox Exploit: Oracle Network DoS Vulnerability | Fortinet Blog
FORTIGUARD LABS THREAT RESEARCH
VirtualBox Exploit: Oracle Network DoS Vulnerability
By Zhouyuan Yang | January 31, 2019
Oracle VirtualBox is the world’s most popular cross-platform virtualization product. The FortiGuard Labs team recently discovered on (December 6, 2018) a network Denial of Service (DoS) vulnerability in Oracle VirtualBox (CVE-2019-2527). This DoS vulnerability is caused by a crafted TCP session sent from a virtual machine (VM) that causes the NAT process on the host machine to crash and all the VMs in the same NAT network to lose their network connectivity.
This DoS vulnerability affects VirtualBox versions prior to 5.2.26 and 6.0.4.
DoS Vulnerability and the Effect On NAT Networks
In VirtualBox, users can create their own NAT network in the settings and assign it
Fortinet
RPC Bug Hunting Case Studies – Part 1
blogs_fortinet·2018-12-05
RPC Bug Hunting Case Studies – Part 1
FORTIGUARD LABS THREAT RESEARCH
RPC Bug Hunting Case Studies – Part 1
By Wayne Chin Yick Low | December 05, 2018
FortiGuard Labs How-To Guide for Threat Researchers
In late August of 2018, a Windows local privilege escalation zero-day exploit was released by a researcher who goes with the Internet moniker SandboxEscaper. In less than two weeks from the time the zero-day was published on Internet, the exploit was picked up by malware authors. as stated by ESET, and caused a bit of chaos in the InfoSec community. This incident also raised FortiGuard Labs’ awareness.
FortiGuard Labs believes that understanding how this attack works will significantly help other researchers find vulnerabilities similar to the bug that SandboxEscaper found in the Windows Task Scheduler. In this blog post,
Fortinet
Exploiting an RCE bug in the UDP Protocol implemented in FreeRTOS
blogs_fortinet·2018-12-04·CVSS 8.1
CVE-2018-16525 [HIGH] Exploiting an RCE bug in the UDP Protocol implemented in FreeRTOS
FORTIGUARD LABS THREAT RESEARCH
Exploiting an RCE bug in the UDP Protocol implemented in FreeRTOS
By Amir Zali | December 04, 2018
Recently, I saw a report about several bugs that were found on FreeRTOS. Curiosity got the best of me, and I started to take a look to see what can be done from the IPS side to protect our customers because of importance of IoT devices and the popularity of this operating system. (Since the initial report more details have been made available here, CVE-2018-16525.)
In this post I will just elaborate on a single RCE bug that I have managed to exploit in the UDP protocol which is implemented in FreeRTOS+TCP.
RTOS, Real Time Operating System, is a type of operating system that provides deterministic execution. AWS FreeRTOS is a class of RTOS from Amazon Web Se
Fortinet
An Analysis of Microsoft Edge Chakra JavascriptArray TypeId Handling Memory Corruption (CVE-2018-8467)
blogs_fortinet·2018-10-19·CVSS 7.5
CVE-2018-8467 [HIGH] An Analysis of Microsoft Edge Chakra JavascriptArray TypeId Handling Memory Corruption (CVE-2018-8467)
FORTIGUARD LABS THREAT RESEARCH
An Analysis of Microsoft Edge Chakra JavascriptArray TypeId Handling Memory Corruption (CVE-2018-8467)
By Dehui Yin | October 19, 2018
The Javascript Type Confusion bug is a critical vulnerability that exists in many popular browsers. It causes memory corruption and can possibly be exploited to execute arbitrary code when a vulnerable system browses a malicious web page. A growing number of these type of confusion bugs in the Microsoft Chakra Engine have been disclosed and fixed by over the past recent months.
CVE-2018-8467 is one of the classic ‘Type Confusion’ bugs in the Microsoft Edge Chakra Engine that was fixed by Microsoft several weeks ago. In this post, the team at FortiGuard Labs looks deeply into the Microsoft Edge Chakra Engine assembly codes
Fortinet
Microsoft JET Database Engine Code Execution Vulnerability
blogs_fortinet·2018-09-14·CVSS 7.8
CVE-2018-8392 [HIGH] Microsoft JET Database Engine Code Execution Vulnerability
FORTIGUARD LABS THREAT RESEARCH
Microsoft JET Database Engine Code Execution Vulnerability
By Honggang Ren | September 14, 2018
This June, FortiGuard Labs researcher Honggang Ren discovered a code execution vulnerability in the Windows JET Database Engine and reported it to Microsoft using the responsible disclosure process. On the patch Tuesday of September 2018, Microsoft released a Security Advisory that contains the fix for this vulnerability, identifying it as CVE-2018-8392.
The Microsoft JET Database Engine is a database engine on which several Microsoft products have been built. A database engine is the underlying component of a database, a collection of information stored on a computer in a systematic way.
The vulnerable DLL msexcl40.dll identified by FortiGuard Labs is a comp
Fortinet
Thrip ATP Attack Update
blogs_fortinet·2018-06-19
Thrip ATP Attack Update
FORTIGUARD LABS THREAT RESEARCH
Thrip ATP Attack Update
By FortiGuard SE Team | June 19, 2018
In conjunction with the Cyber Threat Alliance, Symantec today released their blog post on an APT (advanced persistent threat) group codenamed "Thrip.” As part of our membership with the Cyber Threat Alliance (CTA), we have received these indicators ahead of publication to ensure that FortiGuard customers are protected from this latest disclosure.
Evidence suggests that the Thrip campaigns’ objective was cyberespionage, with a focus on South East Asia and the United States. According to these latest findings, three computers in China have been identified as being used as a launchpad for these attacks. Targeted industries include defense, telecom, and satellite sectors, specifically the geospatia
Fortinet
Buffer Overflow Attack Targeting Microsoft IIS 6.0 Returns
blogs_fortinet·2018-05-23·CVSS 9.8
CVE-2017-7269 [CRITICAL] Buffer Overflow Attack Targeting Microsoft IIS 6.0 Returns
FORTIGUARD LABS THREAT RESEARCH
Buffer Overflow Attack Targeting Microsoft IIS 6.0 Returns
By Bing Liu | May 23, 2018
There is a buffer overflow vulnerability in the WebDAV service in Microsoft IIS 6.0 identified as CVE-2017-7269 that allows remote attackers to execute arbitrary code via a long HTTP header. This vulnerability was reportedly first exploited in July or August of 2016, and the PoC was publicly disclosed in March 2017 on GitHub. Over the past month, however, FortiGuard Labs has been documenting a spike in new attacks targeting this vulnerability, peaking on Apr 13, 2018 when we logged over 4 million triggers.
Fortinet released an IPS signature for this vulnerability in March of 2017 named MS.IIS.WebDAV.PROPFIND.ScStoragePathFromUrl.Buffer.Overflow. The daily trigger rate of
Fortinet
Microsoft Windows JET Database Engine Heap Overflow Vulnerability
blogs_fortinet·2018-04-11·CVSS 7.8
CVE-2018-1003 [HIGH] Microsoft Windows JET Database Engine Heap Overflow Vulnerability
FORTIGUARD LABS THREAT RESEARCH
Microsoft Windows JET Database Engine Heap Overflow Vulnerability
By Honggang Ren | April 11, 2018
At the end of 2017, the FortiGuard Labs team discovered a heap overflow vulnerability in Microsoft Windows JET Database Engine and reported it to Microsoft following Fortinet’s responsible disclosure process. On April 10, 2018, Microsoft released an advisory that contains the fix for this vulnerability and identifies it as CVE-2018-1003.
This heap overflow vulnerability exists in the Microsoft JET Database Engine’s dynamic link library “msexcl40.dll”, which has a long history. It was first introduced in Windows 2000, and is a component of all supported Windows versions from Windows 7 to Windows 10.
The vulnerability I discovered can be triggered with a craf
Fortinet
Fortinet at Insomni'hack 2018
blogs_fortinet·2018-03-28
Fortinet at Insomni'hack 2018
FORTIGUARD LABS THREAT RESEARCH
Fortinet at Insomni'hack 2018
By Axelle Apvrille | March 28, 2018
This year, Fortinet was again present at Insomni'hack in Geneva, Switzerland. I am particularly proud of Fortinet's Swiss Sales & SE team, which made a great effort to adjust to a hacking conference.
A Hacker's Booth
Fortinet's booth was equipped with a flipper and a retro-gaming recalbox console. There were attractive prizes to win: an iPad and a drone. Given the crowd around Fortinet's booth, I believe this was successful at attracting hackers, and hopefully at getting interesting leads.
The retro-gaming console was actually my own, unplugged from home for the event. It was hosted on a Raspberry Pi 3, and running Recalbox, a special RPi3 distribution for retro-gaming. It is easy to inst
Fortinet
Cybercriminals Exploiting Microsoft’s Vulnerable Dynamic Data Exchange Protocol
blogs_fortinet·2017-11-17·CVSS 8.8
[HIGH] Cybercriminals Exploiting Microsoft’s Vulnerable Dynamic Data Exchange Protocol
FORTIGUARD LABS THREAT RESEARCH
Cybercriminals Exploiting Microsoft’s Vulnerable Dynamic Data Exchange Protocol
By FortiGuard SE Team | November 17, 2017
Visa Payment Systems Intelligence recently announced that cybercriminals are threatening the payments ecosystem by leveraging a vulnerable Microsoft Dynamic Data Exchange protocol in phishing campaigns. This phishing attack relies on the Dynamic Data Exchange (DDE) protocol for infection instead of the usual malicious macros or an exploit kit.
This exploit is related to the Microsoft Security Advisory 4053440 issued on November 8, 2017. It provides guidance on securing Microsoft applications when processing Dynamic Data Exchange (DDE) fields. The DDE protocol enables messages to be sent between Microsoft applications and uses shared da
Fortinet
Deep Analysis of Esteemaudit
blogs_fortinet·2017-05-11
Deep Analysis of Esteemaudit
FORTIGUARD LABS THREAT RESEARCH
Deep Analysis of Esteemaudit
By Dehui Yin | May 11, 2017
A Windows 2003 RDP Zero Day Exploit
In this blog, the FortiGuard team takes a look at Esteemaudit, which is an exploit that was included in the set of cybertools leaked by the hacker group known as "Shadow Brokers." They claim that they collected this set of cybertools from the compromised data of "Equation Group," a threat actor alleged to be tied to the United States National Security Agency (NSA).
Esteemaudit is a Remote Desktop Protocol (RDP) exploit that targets Microsoft Windows Server 2003 / Windows XP. The vulnerability this RDP exploit targets will not be patched since Microsoft has stopped supporting these two products. By exploiting this vulnerability, a threat actor can target a remote R
Fortinet
Threat Landscape Perspectives: TeamViewer Attack – Spy vs. Spy Misdirection?
blogs_fortinet·2016-06-02
Threat Landscape Perspectives: TeamViewer Attack – Spy vs. Spy Misdirection?
INDUSTRY TRENDS & INSIGHTS
Threat Landscape Perspectives: TeamViewer Attack – Spy vs. Spy Misdirection?
By John Welton | June 02, 2016
The recent TeamViewer news is yet another example of the changing dynamics and increasingly sophisticated threats we are seeing in cybersecurity today. Fortinet’s Aamir Lakhani offers some perspective.
Why is the TeamViewer news important to consider?
The TeamViewer attack appears to be an organized and sophisticated attack. We have seen criminal organizations spend a great deal of money and efforts increasing their skills in order for them to conduct cybercrime. Ransomware is a good example or why criminal organizations do this. It is both extremely valuable and profitable. Likewise, a remote access and management tool like TeamViewer is potentially a
Zscaler
Zscaler found Multiple Security Vulnerabilities | 05-15-2019
blogs_zscaler·CVSS 6.5
[MEDIUM] Zscaler found Multiple Security Vulnerabilities | 05-15-2019
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Huntress
CVE-2019-0708 Vulnerability: Analysis, Impact, Mitigation | Huntress
blogs_huntress·CVSS 9.8
CVE-2019-0708 [CRITICAL] CVE-2019-0708 Vulnerability: Analysis, Impact, Mitigation | Huntress
## CVE-2019-0708 Vulnerability
Published: 11/21/2025
Written by: Lizzie Danielson
## What is CVE-2019-0708 vulnerability?
CVE-2019-0708, also known as "BlueKeep," is a critical remote code execution (RCE) vulnerability affecting Microsoft Remote Desktop Services (RDS). It allows unauthenticated attackers to execute arbitrary code on unpatched systems, potentially spreading malware within networks. This vulnerability gained attention due to its wormable nature and its impact on systems running older versions of Windows—including Windows 7, Windows XP, and Windows Server 2003.
## When was it discovered?
CVE-2019-0708 was discovered by Microsoft researchers and publicly disclosed on May 14, 2019. Microsoft quickly released patches for supported systems, alongside extraordinary patches f
arXiv
A Comprehensive Evaluation and Practice of System Penetration Testing
arxiv_fulltext·2026-01-30
A Comprehensive Evaluation and Practice of System Penetration Testing
*
[1]Chunyi Zhang and Jin Zeng contributed equally to this work.
[2]Authors' Contact Information: Chunyi Zhang, Hainan University, Haikou, China; Jin Zeng, Hainan University, Haikou, China; Xiaoqi Li, [email protected], Hainan University, Haikou, China.
## Abstract
With the rapid advancement of information technology, the complexity of applications continues to increase, and the cybersecurity challenges we face are also escalating. This paper aims to investigate the methods and practices of system security penetration testing, exploring how to enhance system security through systematic penetration testing processes and technical approaches. It also examines existing penetration tools, analyzing their strengths, weaknesses, and applicable domains to guide penetration testers in tool select
arXiv
Enterprise Security Incident Analysis and Countermeasures Based on the T-Mobile Data Breach
arxiv_fulltext·2025-07-17
Enterprise Security Incident Analysis and Countermeasures Based on the T-Mobile Data Breach
## Abstract
This paper presents a comprehensive analysis of T-Mobile’s critical data breaches in 2021 and 2023, alongside a full-spectrum security audit targeting its systems, infrastructure, and publicly exposed endpoints. By combining case-based vulnerability assessments with active ethical hacking techniques—including Shodan reconnaissance, API misuse simulations, VNC brute-forcing, firmware reverse engineering, and web application scans—we uncover structural weaknesses persisting beyond the initial breach events. Building on these findings, we propose a multi-layered defensive strategy encompassing Zero Trust Architecture, granular role-based access control, network segmentation, firmware encryption using AES with integrity checks, and API rate limiting and token lifecycle control. Fi
arXiv
Automating Function-Level TARA for Automotive Full-Lifecycle Security
arxiv_fulltext·2025-04-25
Automating Function-Level TARA for Automotive Full-Lifecycle Security
Automating Function-Level TARA for Automotive Full-Lifecycle Security
Yuqiao Yang#
UESTC
[email protected]
Yongzhao Zhang#
UESTC
[email protected]
Wenhao Liu
GoGoByte Technology
[email protected]
Jun Li
GoGoByte Technology
[email protected]
Pengtao Shi
GoGoByte Technology
[email protected]
DingYu Zhong
UESTC
[email protected]
Jie Yang*
UESTC
[email protected]
Ting Chen*
UESTC
[email protected]
Sheng Cao
UESTC
[email protected]
Yuntao Ren
Chengdu Anheng Information
Technology Co., LTD
[email protected]
Yongyue Wu
Anheng Vision(Chengdu) Information
Technology Co., LTD
[email protected]
Xiaosong Zhang
UESTC
[email protected]
#1
[1] red#1
[1] blue#1
[1] brown#1
DefenseWeaver
## Abstract
As modern vehicles evolve
arXiv
Do Chase Your Tail! Missing Key Aspects Augmentation in Textual Vulnerability Descriptions of Long-tail Software through Feature Inference
arxiv_fulltext·2024-12-15
Do Chase Your Tail! Missing Key Aspects Augmentation in Textual Vulnerability Descriptions of Long-tail Software through Feature Inference
Do Chase Your Tail! Missing Key Aspects Augmentation in Textual Vulnerability Descriptions of Long-tail Software through Feature Inference
Linyi Han, Shidong Pan, Zhenchang Xing, Jiamou Sun, Sofonias Yitagesu, Xiaowang Zhang, Zhiyong Feng
Manuscript received XXX XXX, 20XX. (Corresponding author: Xiaowang Zhang)
Linyi Han, Sofonias Yitagesu, Xiaowang Zhang, and Zhiyong Feng are with the College of Intelligence and Computing, Tianjin University, Tianjin, China. e-mail: \hanly2, xiaowangzhang, zyfeng\@tju.edu.cn and [email protected].
Shidong Pan, Zhenchang Xing, and Jiamou Sun are with the CSIRO's Data61, Canberra, Australia. e-mail: \Shidong.Pan, Zhenchang.Xing, Frank.Sun\@data61.csiro.au
Linyi Han is also the Center of National Railway Intelligent Transportation System Engineeri
arXiv
Dead Man's PLC: Towards Viable Cyber Extortion for Operational Technology
arxiv_fulltext·2023-07-18
Dead Man's PLC: Towards Viable Cyber Extortion for Operational Technology
Dead Man's PLC: Towards Viable Cyber Extortion for Operational Technology
Richard Derbyshirea,b, Benjamin Greenb, Charl van der Walta, David Hutchisonb
a \ric.derbyshire, charl.vanderwalt\@orangecyberdefense.com
b \r.derbyshire1, b.green2, d.hutchison\@lancaster.ac.uk
Richard Derbyshire
Security Research Center
Orange Cyberdefense
London, UK
[email protected]
Benjamin Green
Computing and Communications
Lancaster University
Lancaster, UK
[email protected]
*1mm
Charl van der Walt
Security Research Center
Orange Cyberdefense
London, UK
[email protected]
David Hutchison
Computing and Communications
Lancaster University
Lancaster, UK
[email protected]
## Abstract
For decades, operational technology (OT) has enjoyed th
arXiv
Beyond the Surface: Investigating Malicious CVE Proof of Concept Exploits on GitHub
arxiv_fulltext·2023-06-07
Beyond the Surface: Investigating Malicious CVE Proof of Concept Exploits on GitHub
Beyond the Surface: Investigating Malicious CVE Proof of Concept Exploits on GitHub
Soufian El Yadmani, Robin The, Olga Gadyatskaya
Leiden Institute of Advanced Computer Science, Leiden University
## Abstract
\
Exploit proof-of-concepts (PoCs) for known vulnerabilities are widely shared in the security community. They help security analysts to learn from each other and they facilitate security assessments and red teaming tasks. In the recent years, PoCs have been widely distributed, e.g., via dedicated websites and platforms, and public code repositories such as GitHub. However, there is no guarantee that PoCs in public code repositories come from trustworthy sources or even that they do what they are supposed to do.
In this work we investigate GitHub-hosted PoCs for known vulnerabili
arXiv
Ontology-based Attack Graph Enrichment
arxiv_fulltext·2022-02-08
Ontology-based Attack Graph Enrichment
Abstract: Attack graphs provide a representation of possible actions that adversaries can perpetrate to attack a system. They are used by cybersecurity experts to make decisions, e.g., to decide
remediation and recovery plans. Different approaches can be used to build such graphs. We focus on logical attack graphs, based on predicate logic, to define the causality of adversarial actions. Since networks and vulnerabilities are constantly changing (e.g., new applications get installed on system devices, updated services get publicly exposed, etc.), we propose to enrich the attack graph generation approach with a semantic augmentation post-processing of the predicates. Graphs are now mapped to monitoring alerts confirming successful attack actions and updated according to network and vulnerab
arXiv
Technical Report -- Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits
arxiv_fulltext·2022-02-03
Technical Report -- Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits
Octavian Suciu,
Connor Nelson ,
Zhuoer Lyu ,
Tiffany Bao ,
Tudor Dumitras
University of Maryland, College Park
State University
comment
\@IEEEpubidpullup6.5
Network and Distributed Systems Security (NDSS) Symposium 2020
23-26 February 2020, San Diego, CA, USA
ISBN 1-891562-61-4
https://dx.doi.org/10.14722/ndss.2020.23xxx
www.ndss-symposium.org
[ ]
comment
empty
## Abstract
Assessing the exploitability of software vulnerabilities at the time of disclosure is difficult and error-prone, as features extracted via technical analysis by existing metrics are poor predictors for exploit development.
Moreover, exploitability assessments suffer from a class bias because ``not exploitable'' labels could be inaccurate.
To overcome these challenges, we propose a new metric, called Expecte
Bugzilla
CVE-2019-5789 chromium-browser: Use after free in WebMIDI
bugzilla·2019-03-13·CVSS 8.8
CVE-2019-5789 [HIGH] CVE-2019-5789 chromium-browser: Use after free in WebMIDI
CVE-2019-5789 chromium-browser: Use after free in WebMIDI
An use after free flaw was found in the WebMIDI component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=921581
External References:
https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html
Discussion:
Created chromium tracking bugs for this issue:
Affects: epel-7 [bug 1688209]
Affects: fedora-all [bug 1688208]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Supplementary
Via RHSA-2019:0708 https://access.redhat.com/errata/RHSA-2019:0708
http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.htmlhttp://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.htmlhttp://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.htmlhttp://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.htmlhttp://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.htmlhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-enhttp://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-enhttps://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdfhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.htmlhttp://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.htmlhttp://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.htmlhttp://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.htmlhttp://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.htmlhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-enhttp://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-enhttps://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdfhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0708
2019-05-16
Published
2021-11-03
Added to CISA KEV
Exploited in the wild