NetSpi Technical

MARCH 11, 2024

In 2023 NetSPI discovered that Microsoft Outlook was vulnerable to authenticated remote code execution (RCE) via synced form objects. Over the next couple of years Etienne (SensePost) and Nick dual discovered two additional sets of vectors which were eventually patched by Microsoft, including the abuse of Outlook Forms.

Authentication 145

Authentication Penetration Testing Technology Phishing 145

Security Affairs

SEPTEMBER 8, 2023

The attacks that took place in the past weeks were detected by researchers at Google’s Threat Analysis Group (TAG). “Recently, TAG became aware of a new campaign likely from the same actors based on similarities with the previous campaign. ” reads the advisory published by Google TAG.

Cybersecurity 114

Cybersecurity Media Accountability Software 114

Bleeping Computer

NOVEMBER 30, 2021

Microsoft Defender for Endpoint is currently blocking Office documents from being opened and some executables from launching due to a false positive tagging the files as potentially bundling an Emotet malware payload. [.].

Malware 145

Malware 145

Bleeping Computer

NOVEMBER 30, 2022

Google's Threat Analysis Group (TAG) has linked an exploit framework that targets now-patched vulnerabilities in the Chrome and Firefox web browsers and the Microsoft Defender security app to a Spanish software company. [.].

Spyware 113

Spyware Software 113

Bleeping Computer

JANUARY 13, 2022

A privilege escalation vulnerability impacting all Windows versions that can let threat actors gain domain admin privileges through an NTLM relay attack has received unofficial patches after Microsoft tagged it as "won't fix." [.].

134

134

Bleeping Computer

NOVEMBER 22, 2022

Microsoft has tagged Windows 10, version 22H2 (aka the Windows 10 2022 Update) for broad deployment, thus making it available to everyone via Windows Update. [.].

98

98

Security Affairs

NOVEMBER 30, 2022

Google’s Threat Analysis Group (TAG) linked three exploitation frameworks to a Spanish surveillance spyware vendor named Variston. While tracking the activities of commercial spyware vendors, Threat Analysis Group (TAG) spotted an exploitation framework likely linked Variston IT, a Spanish firm. ” TAG concludes.

Spyware 104

Spyware Surveillance Risk Internet 104

The Hacker News

DECEMBER 7, 2023

The Microsoft Threat Intelligence team is tracking under the cluster as Star Blizzard (formerly SEABORGIUM). It's also called Blue Callisto, BlueCharlie (or TAG-53),

77

77

Bleeping Computer

FEBRUARY 3, 2021

Microsoft Defender for Endpoint is currently detecting at least two Chrome updates as malware, tagging the Slovenian localization file bundled with the Google Chrome installer as a malicious file. [.].

Malware 145

Malware 145

Security Boulevard

JULY 19, 2023

Would you like to get the last version of Microsoft Office or Adobe Photoshop? Well, in this case it comes with a hefty hidden price tag. We all love a good deal, right? And what's better than free? And what about some games like Age of Empires IV or Sniper Elite 4? All for free!

Software 96

Software Malware 96

Security Affairs

DECEMBER 8, 2022

Our policy is to quickly report vulnerabilities to vendors, and within a few hours of discovering this 0-day, we reported it to Microsoft and patches were released to protect users from these attacks.” ” reads the post published by TAG. Google TAG shared indicators of compromise (IOCs) for this campaign.

Internet 99

Internet Internet Engineering Malware 99

Bleeping Computer

APRIL 20, 2022

Microsoft Defender for Endpoint has been tagging Google Chrome updates delivered via Google Update as suspicious activity due to a false positive issue. [.].

99

99

Bleeping Computer

JANUARY 31, 2022

Microsoft is working on updating Microsoft Defender for Office 365 with differentiated protection for enterprise accounts tagged as critical for an organization (i.e., accounts of high-profile employees including executive-level managers, the ones most often targeted by attackers). [.].

Accountability 98

Accountability 98

Bleeping Computer

MAY 10, 2021

Microsoft is working on addressing an Office 365 issue that has resulted in legitimate emails sent from multiple domains (including Google and LinkedIn) getting tagged as malicious and quarantined. [.].

126

126

Bleeping Computer

MAY 7, 2022

Trend Micro antivirus has fixed a false positive affecting its Apex One endpoint security solution that caused Microsoft Edge updates to be tagged as malware and the Windows registry to be incorrectly modified. [.].

Antivirus 98

Antivirus Malware Technology 98

Heimadal Security

JANUARY 14, 2022

An unofficial patch was released for a privilege escalation vulnerability that has an impact on all versions of Windows after Microsoft tagged its status as “won’t fix”. The flaw is located in the Windows RPC Protocol and was dubbed RemotePotato0 by security researchers.

Cybersecurity 131

Cybersecurity 131

Malwarebytes

JANUARY 22, 2024

Researchers at Google’s Threat Analysis Group (TAG) have published their findings about a group they have dubbed Coldriver. Recently, TAG has noticed that the group uses “lure documents” to install a backdoor on the target’s system. TAG has created a YARA rule that cab help find the Spica backdoor.

Social Engineering 100

Social Engineering Government Media DNS 100

Krebs on Security

AUGUST 9, 2022

Microsoft today released updates to fix a record 141 security vulnerabilities in its Windows operating systems and related software. Once again, Microsoft is patching a zero-day vulnerability in the Microsoft Support Diagnostics Tool (MSDT), a service built into Windows. The CVSS for this vulnerability is 8.8.”

Authentication 241

Authentication Internet Internet Cyber threats 241

Krebs on Security

DECEMBER 14, 2022

Microsoft has released its final monthly batch of security updates for 2022, fixing more than four dozen security holes in its various Windows operating systems and related software. The security updates include patches for Azure , Microsoft Edge, Office , SharePoint Server , SysInternals , and the.NET framework.

Social Engineering 191

Social Engineering Ransomware Software Engineering 191

The Hacker News

DECEMBER 7, 2022

A state-sponsored hacking group with links to Russia has been linked to attack infrastructure that spoofs the Microsoft login page of Global Ordnance, a legitimate U.S.-based based military weapons and hardware supplier.

Hacking 90

Hacking Cybersecurity 90

The Hacker News

MARCH 18, 2022

Google's Threat Analysis Group (TAG) took the wraps off a new initial access broker that it said is closely affiliated to a Russian cyber crime gang notorious for its Conti and Diavol ransomware operations.

Ransomware 110

Ransomware 110

The Hacker News

AUGUST 23, 2022

and Microsoft Outlook accounts. Dubbed HYPERSCRAPE by Google Threat Analysis Group (TAG), the actively in-development malicious software is said to have been used against less than two dozen accounts in Iran, with the oldest known

Accountability 98

Accountability Government Malware Software 98

Security Affairs

DECEMBER 14, 2022

Microsoft released December 2022 Patch Tuesday security updates that fix 52 vulnerabilities across its products. Microsoft December 2022 Patch Tuesday security updates fixed two zero-day vulnerabilities; one of the new issues addressed this month is listed as publicly known at the time of release, and one is actively exploited. .

Hacking 113

Hacking Information Security 113

Bleeping Computer

AUGUST 23, 2021

The US Cybersecurity and Infrastructure Security Agency (CISA) issued its first alert tagged as "urgent," warning admins to patch on-premises Microsoft Exchange servers against actively exploited ProxyShell vulnerabilities. [.].

Cybersecurity 98

Cybersecurity 98

Krebs on Security

JUNE 8, 2021

Microsoft today released another round of security updates for Windows operating systems and supported software, including fixes for six zero-day bugs that malicious hackers already are exploiting in active attacks. – CVE-2021-33739 , an elevation of privilege flaw in the Microsoft Desktop Window Manager.

Backups 298

Backups Cyber threats Ransomware Phishing 298

CyberSecurity Insiders

OCTOBER 18, 2021

Ajax Bash, the Security Engineer of Google Threat Analysis Group (TAG) endorsed the statement and attributed a large global campaign to a group of threat actors belonging to Kremlin based Fancy Bear (APT28).

Cyber Attacks 131

Cyber Attacks Cyber threats Accountability Engineering 131

Troy Hunt

AUGUST 5, 2023

Case in point: read my pain from last night about converting thousands of words of lawyer speak T&Cs from Microsoft Word to HTML. I settled for dumping stuff in a <pre> tag for now and will invest the time in doing it right later on.)

Passwords 179

Passwords 179

Security Affairs

FEBRUARY 25, 2024

Iran Crisis Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign U.S. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

Spyware 105

Spyware Cyber Insurance Hacking Advertising 105

The Last Watchdog

AUGUST 8, 2023

8, 2023 – DigiCert today announced the expansion of its certificate management platform, DigiCert Trust Lifecycle Manager, to provide full lifecycle support for multiple CAs including Microsoft CA and AWS Private CA, as well as integration with ServiceNow to support existing IT service workflows. Lehi, Utah, Aug.

Authentication 100

Authentication Technology VPN Software 100

eSecurity Planet

JUNE 1, 2023

To avoid issues, we need to understand the DMARC record tags in detail. DMARC Record Tags in Detail To understand the DMARC record, we start with an example record and then explore the detailed options for each tag. Tags are separated by semicolons ( ; ) with no extra spaces.

DNS 98

DNS Authentication Marketing eCommerce 98

Security Affairs

MARCH 19, 2022

Google’s Threat Analysis Group (TAG) uncovered a new initial access broker, named Exotic Lily, that is closely affiliated with the Conti ransomware gang. Google’s Threat Analysis Group (TAG) researchers linked a new initial access broker, named Exotic Lily, to the Conti ransomware operation.

Cybercrime 92

Cybercrime Social Engineering Ransomware Engineering 92

Security Boulevard

JANUARY 9, 2024

SAP HotNews Security Note #3411067 , tagged with a CVSS score of 9.1, SAP Security Note #3413475 , tagged with a CVSS score of 9.1, SAP Security Note #3412456 , tagged with a CVSS score of 9.1, The HotPriority Notes in Detail SAP Security Note #3411869 , tagged with a CVSS score of 8.4, HTTP/1 is not affected.

Internet 52

Internet Internet Marketing Technology 52

Security Affairs

JANUARY 11, 2023

US CISA added Microsoft Exchange elevation of privileges bug CVE-2022-41080 to its Known Exploited Vulnerabilities Catalog. The first issue, tracked as CVE-2022-41080 , is a Microsoft Exchange server privilege escalation vulnerability. The new exploit chain bypasses Microsoft’s mitigations for ProxyNotShell vulnerabilities.

Ransomware 97

Ransomware Hacking Government Risk 97

eSecurity Planet

MARCH 16, 2023

Microsoft’s Patch Tuesday for March 2023 includes patches for more than 70 vulnerabilities, including zero-day flaws in Outlook and in Windows SmartScreen. “Microsoft’s public bulletin doesn’t say exactly what type of file (images? . Office documents? all of them?)

Energy and Utilities 98

Energy and Utilities Authentication Firewall Engineering 98

Krebs on Security

DECEMBER 11, 2018

Adobe and Microsoft each released updates today to tackle critical security weaknesses in their software. Microsoft’s December patch batch is relatively light, addressing more than three dozen vulnerabilities in Windows and related applications.

Software 164

Software Internet Internet Malware 164

Security Affairs

MARCH 14, 2023

Microsoft Patch Tuesday updates for March 2023 addressed 74 vulnerabilities, including a Windows zero-day exploited in ransomware attacks. The CVE-2023-23397 flaw is a Microsoft Outlook spoofing vulnerability that can lead to an authentication bypass. ” reads the advisory published by Microsoft. ” states Microsoft.

Authentication 84

Authentication Ransomware Hacking Malware 84

NetSpi Technical

MARCH 11, 2024

In 2023 NetSPI discovered that Microsoft Outlook was vulnerable to authenticated remote code execution (RCE) via synced form objects. Over the next couple of years Etienne (SensePost) and Nick dual discovered two additional sets of vectors which were eventually patched by Microsoft, including the abuse of Outlook Forms.

Authentication 52

Authentication Penetration Testing Technology Phishing 52