Remove Accountability Remove Blog Remove Information Security Remove Security Intelligence
article thumbnail

Microsoft warns of attacks targeting MSSQL servers using the tool sqlps

Security Affairs

pic.twitter.com/Tro0NfMD0j — Microsoft Security Intelligence (@MsftSecIntel) May 17, 2022. The attackers also use sqlps.exe to create a new account that they add to the sysadmin role, enabling them to take full control of the SQL server. — Microsoft Security Intelligence (@MsftSecIntel) May 17, 2022.

article thumbnail

Microsoft blocked Polonium attacks against Israeli organizations

Security Affairs

Threat actors were observed abusing OneDrive, for this reason, the IT giant has suspended more than 20 malicious OneDrive applications created by POLONIUM actors, notified affected organizations, and deployed a series of security intelligence updates that will quarantine malicious tools developed by the attackers. Pierluigi Paganini.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Microsoft disrupts SEABORGIUM ’s ongoing phishing operations

Security Affairs

More details + TTPs in this MSTIC blog: [link] — Microsoft Security Intelligence (@MsftSecIntel) August 15, 2022. The phishing messages used PDF attachments and in some cases, they included links to file or document hosting services, or to OneDrive accounts hosting the PDF documents.

article thumbnail

Iran-linked APT groups continue to evolve

Security Affairs

Over the past year, Microsoft Threat Intelligence Center (MSTIC) has observed an evolution of the tools, techniques, and procedures employed by Iranian nation-state actors. Learn more from this blog summarizing these trends, as presented at #CyberWarCon : [link] — Microsoft Security Intelligence (@MsftSecIntel) November 16, 2021.

VPN 100
article thumbnail

UK NCSC warns of spear-phishing attacks from Russia-linked and Iran-linked groups

Security Affairs

Microsoft has disrupted activity by SEABORGIUM, a Russia-based actor launching persistent phishing, credential and data theft, intrusions, and hack-and-leak campaigns tied to espionage.

article thumbnail

5 Components of the Kubernetes Control Plane that Demand Special Attention in Your Security Strategy

Security Affairs

To answer that question, this blog post will discuss five components within the Kubernetes control plane that require special attention within organizations’ security strategy. For information on how to secure that part of a Kubernetes cluster, click here. cloud-controller-manager. What is it?

article thumbnail

Why Focusing on Container Runtimes Is the Most Critical Piece of Security for EKS Workloads?

Security Affairs

In particular, they might consider limiting their use of ClusterRoles and ClusterRoleBindings, as these assignments could enable an attacker to move to other cluster resources if they compromise a single user account. For more information about other aspects of Amazon EKS security, click here.