Microsoft Windows Failures and Windows TCO
-
Microsoft Signing Key Stolen by Chinese
Actually, two things went badly wrong here. The first is that Azure accepted an expired signing key, implying a vulnerability in whatever is supposed to check key validity. The second is that this key was supposed to remain in the the system’s Hardware Security Module—and not be in software. This implies a really serious breach of good security practice. The fact that Microsoft has not been forthcoming about the details of what happened tell me that the details are really bad.
-
[Repeat] Pt: SESARAM confirms cyberattack [sic] on region’s health service, suspends non-urgent activity Monday
They are not calling it a ransomware attack, and they are not naming the threat actors that have claimed responsibility at this time, but they note that there was no ransom demand.
-
Report: New ransomware gang emerges in Vietnam
Targeting victims in English-speaking countries, as well as Bulgaria, China, and Vietnam, the gang uses a Yashma ransomware variant that downloads a ransomware note from an account dubbed “nguyenvietphat” on the code sharing platform Github, evading some endpoint detection and antivirus software, Cisco’s report finds.
-
Techie's quick cure for a curious conflict caused a huge headache
We have a response to that sort of thing: "Somebody must've messed that up."
It transpired that the corporate disk image, on which every single PC in the company was based, had Microsoft's IIS web server enabled. That's a bad idea and it wasn't Bruce's fault that it was running.
-
[Repeat] HC3: Sector Alert: Rhysida Ransomware
Rhysida is a new ransomware-as-a-service (RaaS) group that has emerged since May 2023. The group drops an eponymous ransomware via phishing attacks and Cobalt Strike to breach targets’ networks and deploy their payloads. [...]
-
Rhysida Ransomware
Rhysida is a 64-bit Portable Executable (PE) Windows cryptographic ransomware application compiled using MINGW/GCC. In each sample analyzed, the application’s program name is set to Rhysida-0.1, suggesting the tool is in early stages of development. A notable characteristic of the tool is its plain-text strings revealing registry modification commands.
-
[Repeat] Jefferson County Health Center notifies patients about May cyberattack [sic]
DataBreaches called both entities when the listing appeared and emailed them again recently to ask whether they had been hit by Karakurt. Neither entity responded or posted anything on their respective websites about any breach.