Stantinko Botnet Now Targeting Linux Servers to Hide Behind Proxies
An adware and coin-miner botnet targeting Russia, Ukraine, Belarus, and Kazakhstan at least since 2012 has now set its sights on Linux servers to fly under the radar.
Critical Unpatched VMware Flaw Affects Multiple Corporates Products
VMware has released temporary workarounds to address a critical vulnerability in its products that could be exploited by an attacker to take control of an affected system.
Microsoft Releases Windows Security Updates For Critical Flaws
Microsoft formally released fixes for 112 newly discovered security vulnerabilities as part of its November 2020 Patch Tuesday, including an actively exploited zero-day.
Researcher Discloses Critical RCE Flaws In Cisco Security Manager
Cisco has published multiple security advisories concerning critical flaws in Cisco Security Manager (CSM) a week after the networking equipment maker quietly released patches with version 4.22 of the platform.
Cisco warns of actively exploited IOS XR zero-days
Cisco warned on Saturday about two zero-day vulnerability impacting the Internetwork Operating System (IOS) that ships with its networking equipment.
New Chrome 0-day Under Active Attacks – Update Your Browser Now
Attention readers, if you are using Google Chrome browser on your Windows, Mac, or Linux computers, you need to update your web browsing software immediately to the latest version Google released earlier today.
Google Warns of Zero-Click Bluetooth Flaws in Linux-based Devices
Google security researchers are warning of a new set of zero-click vulnerabilities in the Linux Bluetooth software stack that can allow a nearby unauthenticated, remote attacker to execute arbitrary code with kernel privileges on vulnerable devices.
India Witnessed Spike in Cyber Attacks Amidst Covid-19 - Here's Why?
The COVID-19 outreach is turning out to be not only health, social, and economic hazard but also a cybersecurity crisis. The pandemic has presented new challenges for businesses in the areas of remote collaboration and business continuity.
FIN11 Hackers Spotted Using New Techniques In Ransomware Attacks
A financially-motivated threat actor known for its malware distribution campaigns has evolved its tactics to focus on ransomware and extortion. "Recent FIN11 intrusions have most commonly led to data theft, extortion and the disruption of victim networks via the distribution of CLOP ransomware".
Microsoft Releases Patches For Critical Windows TCP/IP and Other Bugs
Microsoft on Tuesday issued fixes for 87 newly discovered security vulnerabilities as part of its October 2020 Patch Tuesday, including two critical remote code execution (RCE) flaws in Windows TCP/IP stack and Microsoft Outlook.
New Android Malware Steals Banking Passwords, Private Data and Keystrokes
NA new type of mobile banking malware has been discovered abusing Android's accessibility features to exfiltrate sensitive data from financial applications, read user SMS messages, and hijack SMS-based two-factor authentication codes.
Called "EventBot" by Cybereason researchers, the malware is capable of targeting over 200 different financial apps, including banking, money transfer services, and crypto-currency wallets such as Paypal Business, Revolut, Barclays, CapitalOne, HSBC, Santander, TransferWise, and Coinbase.
"EventBot is particularly interesting because it is in such early stages," the researchers said. "This brand new malware has real potential to become the next big mobile malware, as it is under constant iterative improvements, abuses a critical operating system feature, and targets financial applications."ew Android Malware Steals Banking Passwords, Private Data and Keystrokes
The campaign, first identified in March 2020, masks its malicious intent by posing as legitimate applications (e.g., Adobe Flash, Microsoft Word) on rogue APK stores and other shady websites, which, when installed, requests extensive permissions on the device.
The permissions include access to accessibility settings, the ability to read from external storage, send and receive SMS messages, run in the background, and launch itself after system boot.
If a user grants access, EventBot operates as a keylogger and can "retrieve notifications about other installed applications and content of open windows," in addition to exploiting Android's accessibility services to grab lockscreen PIN and transmit all the collected data in an encrypted format to an attacker-controlled server.
The ability to parse SMS messages also makes the banking trojan a useful tool to bypass SMS-based two-factor authentication, thereby giving the adversaries easy access to a victim's cryptocurrency wallets and steal funds from bank accounts.
This is not the first time mobile malware has targeted financial services. Last month, IBM X-Force researchers detailed a new TrickBot campaign, called TrickMo, that was found exclusively targeting German users with malware that misused accessibility features to intercept one-time passwords (OTP), mobile TAN (mTAN), and pushTAN authentication codes.
"Giving attacker access to a mobile device can have severe business consequences, especially if the end-user is using their mobile device to discuss sensitive business topics or access enterprise financial information," Cybereason researchers concluded. "This can result in brand degradation, loss of individual reputation, or loss of consumer trust."
EventBot's family of malicious apps may not be active on the Google Play Store, but it's yet another reminder of why users should stick to official app stores and avoid sideloading apps from untrusted sources. Keeping the software up-to-date and turning on Google Play Protect can also go a long way towards protecting devices from malware.