Security Leftovers
-
Security updates for Wednesday [LWN.net]
Security updates have been issued by Debian (vim, webkit2gtk, and wpewebkit), Fedora (mingw-python3, vim, webkit2gtk3, webkitgtk, and xen), Mageia (389-ds-base, bluez, ffmpeg, libtasn1, libtiff, libxml2, and mbedtls), Red Hat (kpatch-patch and linux-firmware), SUSE (conmon, containerized data importer, exim, expat, ganglia-web, gstreamer-0_10-plugins-base, gstreamer-0_10-plugins-good, gstreamer-plugins-base, gstreamer-plugins-good, kernel, kubevirt, protobuf, sendmail, and vsftpd), and Ubuntu (libzstd, openjdk-8, openjdk-lts, openjdk-17, openjdk-19, php7.2, php7.4, php8.1, and pixman).
-
New IceXLoader Malware Loader Variant Infected Thousands of Victims Worldwide [Ed: Microsoft Windows TCO]
IceXLoader is traditionally distributed through phishing campaigns, with emails containing ZIP archives functioning as a trigger to deploy the malware. Infection chains have leveraged IceXLoader to deliver DarkCrystal RAT and cryptocurrency miners.
-
Experts Warn of Browser Extensions Spying On Users via Cloud9 Chrome Botnet Network
Called Cloud9 by security firm Zimperium, the malicious browser add-on comes with a wide range of features that enables it to siphon cookies, log keystrokes, inject arbitrary JavaScript code, mine crypto, and even enlist the host to carry out DDoS attacks.
-
Several Cyber Attacks Observed Leveraging IPFS Decentralized Network [Ed: This foolishly blames the media instead of the attacks; many terror attacks rely on roads; ban roads?
In one malspam delivery chain detailed by Talos, an email purporting to be from a Turkish financial institution urged the recipient to open a ZIP file attachment that, when launched, worked as a downloader to retrieve an obfuscated version of Agent Tesla hosted within the IPFS network.
-
Defeating Phishing-Resistant Multifactor Authentication
CISA is now pushing phishing-resistant multifactor authentication.
-
Feature to Compromise European Diplomatic Entity Network [Ed: Microsoft Windows TCO]
The Russia-linked APT29 nation-state actor has been found leveraging a "lesser-known" Windows feature called Credential Roaming as part of its attack against an unnamed European diplomatic entity.
"The diplomatic-centric targeting is consistent with Russian strategic priorities as well as historic APT29 targeting," Mandiant researcher Thibault Van Geluwe de Berlaere said in a technical write-up.