TheNde
Sicurezza· · 2 min

Microsoft's Flaw Fixes and Exploits.

Cybersecurity remains front and center today, with major vulnerabilities being patched and new threats like banking trojans and supply chain attacks making headlines. Microsoft and CISA are taking significant actions to secure systems, while innovative cybercriminals evolve their tactics.

In breve
  1. Microsoft's Flaw Fixes and Exploits
  2. Banking Trojans on the Rise
  3. Emerging Malware in Unexpected Places
01 · Sicurezza

Microsoft's Flaw Fixes and Exploits

Microsoft's latest security patch tackles severe vulnerabilities.
Microsoft's latest security patch tackles severe vulnerabilities.

Microsoft just patched several critical vulnerabilities in its Entra ID, Azure Arc, and Exchange Online. These flaws allowed attackers to execute code and escalate privileges with minimal effort. Users are advised to stay updated but don't need to take immediate action—yet.

02 · Sicurezza

Banking Trojans on the Rise

Banking trojans are becoming increasingly sophisticated.
Banking trojans are becoming increasingly sophisticated.

New banking trojans like Manic and Grandoreiro are targeting users worldwide, stealing credentials and sensitive data. Manic, in particular, merges malware and spyware, making it a formidable threat in Europe and beyond. Cybersecurity firms are on high alert as these trojans evolve.

03 · Sicurezza

Emerging Malware in Unexpected Places

New malware targets car infotainment systems.
New malware targets car infotainment systems.

Hackers are exploiting Android car head units to create a proxy botnet, marking a novel attack vector. Using legitimate update apps, this malware can facilitate ad fraud and data exfiltration. It's a reminder that cybersecurity threats can come from the most unexpected sources.

04 · Sicurezza

CISA Takes Action on Critical Vulnerabilities

CISA is pushing for urgent patches on critical vulnerabilities.
CISA is pushing for urgent patches on critical vulnerabilities.

CISA has ordered federal agencies to patch critical flaws in the TrueConf Server, allowing remote code execution without authentication. This move emphasizes the importance of timely updates in safeguarding sensitive communications. Meanwhile, hundreds of leaked AWS keys are still valid, raising alarms about corporate security.

Numeri chiave
9,300

The number of leaked AWS access keys still active and valid.

Fonte
817

The count of leaked AWS keys linked to companies, including critical root keys.

Fonte
2

The number of critical vulnerabilities in TrueConf Server that CISA has mandated to fix.

Fonte
In primo piano
BleepingComputer

Hundreds of Leaked AWS Keys Expose Corporate Accounts

Over 9,300 AWS access keys have been leaked, with 817 linked to companies, including root keys granting full access. This incident highlights the ongoing risks of poor credential management in cloud environments.

BleepingComputer

CISA Orders Feds to Patch TrueConf Server Flaws

CISA has mandated that federal agencies fix critical vulnerabilities in the TrueConf Server, which can allow unauthorized access and execution of arbitrary scripts. This emphasizes the agency's focus on protecting federal communications.

Link rapidi
  1. Microsoft Blames Windows Gaming Issues on RGB DevicesMicrosoft suggests RGB lighting devices may be causing gaming issues in Windows after recent updates. — BleepingComputer
  2. New SynkLoader Malware in Microsoft Teams PhishingA new malware, SynkLoader, is being distributed in phishing campaigns to steal credentials via fake lock screens. — BleepingComputer
  3. Rust Supply Chain Attack Linked to North Korean HackersNorth Korean hackers executed a supply chain attack on the popular Rust ecosystem, compromising a widely used crate. — SecurityWeek
  4. AI Is Learning to Write Genetic CodeAI's advancements now include generating viable genetic code, raising ethical concerns. — Schneier
  5. New Phishing Toolkit Uses Passkeys to Maintain AccessThe iAuthFlow V2 toolkit allows attackers to maintain access even after victims reset their passwords. — SecurityWeek
  6. Named Pipes Under Attack: Securing Windows CommunicationNamed pipes in Windows environments are under threat, with security implications for local communication. — BleepingComputer