Found 308 bookmarks
Custom sorting
New Star Blizzard spear-phishing campaign targets WhatsApp accounts | Microsoft Security Blog
New Star Blizzard spear-phishing campaign targets WhatsApp accounts | Microsoft Security Blog
In mid-November 2024, Microsoft Threat Intelligence observed the Russian threat actor we track as Star Blizzard sending their typical targets spear-phishing messages, this time offering the supposed opportunity to join a WhatsApp group. This is the first time we have identified a shift in Star Blizzard’s longstanding tactics, techniques, and procedures (TTPs) to leverage a […]
#microsoft#Threat#Intelligence#Star-Blizzard#WhatsApp#spear-phishing#campaign#research
·microsoft.com·
New Star Blizzard spear-phishing campaign targets WhatsApp accounts | Microsoft Security Blog
Microsoft moves to disrupt hacking-as-a-service scheme that’s bypassing AI safety measures
Microsoft moves to disrupt hacking-as-a-service scheme that’s bypassing AI safety measures
The defendants used stolen API keys to gain access to devices and accounts with Microsoft’s Azure OpenAI service, which they then used to generate “thousands” of images that violated content restrictions.
#cyberscoop#EN#2025#Microsoft#hacking-as-a-service#stolen#API#keys#images#Azure#OpenAI
·cyberscoop.com·
Microsoft moves to disrupt hacking-as-a-service scheme that’s bypassing AI safety measures
What We Know About CVE-2024-49112 and CVE-2024-49113
What We Know About CVE-2024-49112 and CVE-2024-49113
In December 2024, two Windows Lightweight Directory Access Protocol (LDAP) vulnerabilities were identified by independent security researcher Yuki Chen: CVE-2024-49112, a remote code execution (RCE) flaw with a 9.8 CVSS score, and CVE-2024-49113, a denial-of-service (DoS) flaw with a 7.5 CVSS score.
#trendmicro#EN#2024#CVE-2024-49112#CVE-2024-49113#LDAPNightmare#Microsoft#LDAP#RCE
·trendmicro.com·
What We Know About CVE-2024-49112 and CVE-2024-49113
Teaching an Old Framework New Tricks: The Dangers of Windows UI Automation | Akamai
Teaching an Old Framework New Tricks: The Dangers of Windows UI Automation | Akamai
  • Akamai security researcher Tomer Peled explored new ways to use and abuse Microsoft's UI Automation framework and discovered an attack technique that evades endpoint detection and response (EDR). To exploit this technique, a user must be convinced to run a program that uses UI Automation. This can lead to stealthy command execution, which can harvest sensitive data, redirect browsers to phishing websites, and more. Detection of this technique is challenging in several ways, including for EDR. All EDR technologies we have tested against this technique were unable to find any malicious activity. This technique can be used on every Windows endpoint with operating system XP and above. In this blog post, we provide a full write-up on how to (ab)use the UI Automation framework (including possible attacks that could leverage it) and we present a proof of concept (PoC) for each abuse vector we discuss. We also provide detection and mitigation options.
#akamai#EN#2024#Microsoft#abuse#automation-framework#UIAutomation#technique
·akamai.com·
Teaching an Old Framework New Tricks: The Dangers of Windows UI Automation | Akamai
Oasis Security Research Team Discovers Microsoft Azure MFA Bypass
Oasis Security Research Team Discovers Microsoft Azure MFA Bypass
Oasis Security's research team uncovered a critical vulnerability in Microsoft's Multi-Factor Authentication (MFA) implementation, allowing attackers to bypass it and gain unauthorized access to the user’s account, including Outlook emails, OneDrive files, Teams chats, Azure Cloud, and more. Microsoft has more than 400 million paid Office 365 seats, making the consequences of this vulnerability far-reaching. The bypass was simple: it took around an hour to execute, required no user interaction and did not generate any notification or provide the account holder with any indication of trouble.
#oasis.security#EN#2024#research#MFA#Microsoft#MFA-bypass
·oasis.security·
Oasis Security Research Team Discovers Microsoft Azure MFA Bypass
Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON | Microsoft Security Blog
Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON | Microsoft Security Blog
At CYBERWARCON 2024, Microsoft Threat Intelligence analysts will share research and insights on North Korean and Chinese threat actors representing years of threat actor tracking, infrastructure monitoring and disruption, and their attack tooling.
#microsoft#EN#2024#CYBERWARCON#DPRK#North-Korea#China#analysis#intlligence
·microsoft.com·
Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON | Microsoft Security Blog
Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
Since August 2023, Microsoft has observed intrusion activity targeting and successfully stealing credentials from multiple Microsoft customers that is enabled by highly evasive password spray attacks. Microsoft has linked the source of these password spray attacks to a network of compromised devices we track as CovertNetwork-1658, also known as xlogin and Quad7 (7777). Microsoft is […]
#microsoft#EN#2024#Storm-0940#Quad7#CovertNetwork-1658#analysis
·microsoft.com·
Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
Since October 22, 2024, Microsoft Threat Intelligence has observed Russian threat actor Midnight Blizzard sending a series of highly targeted spear-phishing emails to individuals in government, academia, defense, non-governmental organizations, and other sectors. This activity is ongoing, and Microsoft will continue to investigate and provide updates as available. Based on our investigation of previous Midnight […]
#microsoft#EN#2024#APT29#MidnightBlizzard#rdp#spear-phishing
·microsoft.com·
Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
Microsoft creates fake Azure tenants to pull phishers into honeypots
Microsoft creates fake Azure tenants to pull phishers into honeypots
Microsoft is using deceptive tactics against phishing actors by spawning realistic-looking honeypot tenants with access to Azure and lure cybercriminals in to collect intelligence about them. #Accounts #Computer #Fake #Honeypot #InfoSec #Microsoft #Phishing #Security
#InfoSec#Accounts#Computer#Phishing#Honeypot#Security#Microsoft#Fake
·bleepingcomputer.com·
Microsoft creates fake Azure tenants to pull phishers into honeypots
Microsoft deprecates PPTP and L2TP VPN protocols in Windows Server
Microsoft deprecates PPTP and L2TP VPN protocols in Windows Server
Microsoft has officially deprecated the Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP) in future versions of Windows Server, recommending admins switch to different protocols that offer increased security. #Deprecated #L2TP #Microsoft #PPTP #Server #VPN #Windows
#bleepingcomputer#EN#2024#Windows#Microsoft#PPTP#L2TP#Server#VPN#Deprecated
·bleepingcomputer.com·
Microsoft deprecates PPTP and L2TP VPN protocols in Windows Server
File hosting services misused for identity phishing
File hosting services misused for identity phishing
Since mid-April 2024, Microsoft has observed an increase in defense evasion tactics used in campaigns abusing file hosting services like SharePoint, OneDrive, and Dropbox. These campaigns use sophisticated techniques to perform social engineering, evade detection, and compromise identities, and include business email compromise (BEC) attacks.
#microsoft#EN#2024#File#hosting#SharePoint#OneDrive#Dropbox#social-engineering#identity#phishing#research
·microsoft.com·
File hosting services misused for identity phishing
Storm-0501: Ransomware attacks expanding to hybrid cloud environments
Storm-0501: Ransomware attacks expanding to hybrid cloud environments
Microsoft has observed the threat actor tracked as Storm-0501 launching a multi-staged attack where they compromised hybrid cloud environments and performed lateral movement from on-premises to cloud environment, leading to data exfiltration, credential theft, tampering, persistent backdoor access, and ransomware deployment. The said attack targeted multiple sectors in the United States, including government, manufacturing, transportation, and law enforcement. Storm-0501 is a financially motivated cybercriminal group that uses commodity and open-source tools to conduct ransomware operations.
#microsoft#EN#2024#Storm-0501#Embargo#hybrid-cloud#cloud#Ransomware
·microsoft.com·
Storm-0501: Ransomware attacks expanding to hybrid cloud environments
Microsoft Copilot Studio Vulnerability Led to Information Disclosure
Microsoft Copilot Studio Vulnerability Led to Information Disclosure
A vulnerability in Microsoft Copilot Studio could be exploited to access sensitive information on the internal infrastructure used by the service, Tenable reports. The flaw, tracked as CVE-2024-38206 (CVSS score of 8.5) and described as a ‘critical’ information disclosure bug, has been fully mitigated, Microsoft said in an August 6 advisory.
#securityweek#EN#2024#Microsoft#Copilot#Studio#Vulnerability#information#disclosure#bug#CVE-2024-38206
·securityweek.com·
Microsoft Copilot Studio Vulnerability Led to Information Disclosure
Windows driver zero-day exploited by Lazarus hackers to install rootkit
Windows driver zero-day exploited by Lazarus hackers to install rootkit
The notorious North Korean Lazarus hacking group exploited a zero-day flaw in the Windows AFD.sys driver to elevate privileges and install the FUDModule rootkit on targeted systems. #BYOVD #Bring #CVE-2024-38193 #Driver #Group #Lazarus #Microsoft #Own #Vulnerability #Your #Zero-Day
#bleepingcomputer#EN#2024#Your#Lazarus#Own#BYOVD#Driver#Zero-Day#Vulnerability#Bring#CVE-2024-38193#Group#Microsoft
·bleepingcomputer.com·
Windows driver zero-day exploited by Lazarus hackers to install rootkit
Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE | Microsoft Security Blog
Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE | Microsoft Security Blog
Microsoft researchers found multiple vulnerabilities in OpenVPN that could lead to an attack chain allowing remote code execution and local privilege escalation. This attack chain could enable attackers to gain full control over targeted endpoints, potentially resulting in data breaches, system compromise, and unauthorized access to sensitive information.
#microsoft#EN#2024#OpenVPN#vulnerabilities#discovered#RCE#CVE-2024-27459#CVE-2024-27903
·microsoft.com·
Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE | Microsoft Security Blog
'Error' in Microsoft's DDoS defenses amplified Azure outage
'Error' in Microsoft's DDoS defenses amplified Azure outage
o you have problems configuring Microsoft's Defender? You might not be alone: Microsoft admitted that whatever it's using for its defensive implementation exacerbated yesterday's Azure instability. No one has blamed the actual product named "Windows Defender," we must note. According to Microsoft, the initial trigger event for yesterday's outage, which took out great swathes of the web, was a distributed denial-of-service (DDoS) attack. Such attacks are hardly unheard of, and an industry has sprung up around warding them off.
#theregister#EN#2024#Microsoft#DDoS#Azure#outage
·theregister.com·
'Error' in Microsoft's DDoS defenses amplified Azure outage
Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption | Microsoft Security Blog
Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption | Microsoft Security Blog
Microsoft researchers have uncovered a vulnerability in ESXi hypervisors being exploited by several ransomware operators to obtain full administrative permissions on domain-joined ESXi hypervisors. ESXi is a bare-metal hypervisor that is installed directly onto a physical server and provides direct access and control of underlying resources. ESXi hypervisors host virtual machines that may include critical servers in a network. In a ransomware attack, having full administrative permission on an ESXi hypervisor can mean that the threat actor can encrypt the file system, which may affect the ability of the hosted servers to run and function. It also allows the threat actor to access hosted VMs and possibly to exfiltrate data or move laterally within the network.
#microsoft#EN#2024#ESXi#hypervisors#Ransomware#encrypt#CVE-2024-37085#Storm-0506#Storm-1175#OctoTempest
·microsoft.com·
Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption | Microsoft Security Blog
Windows Security best practices for integrating and managing security tools
Windows Security best practices for integrating and managing security tools
In this blog post, we examine the recent CrowdStrike outage and provide a technical overview of the root cause. We also explain why security products use kernel-mode drivers today and the safety measures Windows provides for third-party solutions. In addition, we share how customers and security vendors can better leverage the integrated security capabilities of Windows for increased security and reliability. Lastly, we provide a look into how Windows will enhance extensibility for future security products.
#microsoft#EN#2024#CrowdStrike#outage#incident#technical-overview
·microsoft.com·
Windows Security best practices for integrating and managing security tools