Windows TCO Leftovers

posted by Roy Schestowitz on Jun 13, 2024

• Microsoft’s Brad Smith should prepare for ‘ritual punishment’ before House hearing

  When he appears before the House Homeland Security Committee on Thursday to answer questions about a string of security failures at his company, Microsoft President Brad Smith can expect to feel the full fury of a panel of irate lawmakers. But if he is able to endure that, cybersecurity experts believe the hearing is unlikely to result in meaningful change.

• Microsoft Patches Zero-Click Outlook Vulnerability That Could Soon Be Exploited

  Tracked as CVE-2024-30103 (CVSS score of 8.8), the security defect allows attackers to bypass Outlook registry block lists and create malicious DLL files, Microsoft says in its advisory.

• Black Basta ransomware gang may have exploited Windows flaw before it was patched

  The group operating the notorious Black Basta ransomware may have exploited a recently patched Windows vulnerability as a zero-day, researchers have found.

  In March, a high-severity flaw — tracked as CVE-2024-26169 — was discovered in the Windows Error Reporting Service, a feature in Windows that helps Microsoft identify and fix problems with the operating system and other software.

• Monti Ransomware Sold! New Owners Hint Future Plans

  The change in ownership and a shift in focus towards Western countries highlights a new approach towards ransomware. According to recent statements, the project has been acquired, with new owners expressing their intentions to revamp its infrastructure for future endeavors.

• Toronto school board reports ransomware attack on test environment

  It is the latest Toronto institution to be targeted by ransomware gangs after the city itself had data stolen last year. The city’s library system spent weeks last fall struggling to recover from an incident that devastated services, and Toronto’s zoo, transportation system and largest children’s hospital all faced shutdowns due to ransomware attacks.

• Ransomware Group May Have Exploited Windows Vulnerability as Zero-Day

  The flaw in question, tracked as CVE-2024-26169 and classified as ‘important’, has been described as a Windows error reporting service privilege escalation vulnerability that can allow an attacker to obtain System privileges.

• Black Basta Ransomware Possibly Exploited Windows Bug As 0-Day

  Symantec researchers have revealed details that the Black Basta ransomware group linked to the Cardinal cybercriminal syndicate (also known as Storm-1811 or UNC4393) may have exploited a flaw in the Windows error reporting service as a zero-day prior to its March Patch Tuesday fix.

• MEDUSA Ransomware Group Demands Millions In Ransom

  Like many of its earlier attacks, the group has not disclosed crucial details, such as the type of compromised data. It has, however, demanded a bounty of US $900,000 from GEMCO and $100,000 each from Dynamo and Farnell Packaging to stop leaking its internal data.

• City Of Wichita Cyberattack Update: Water Services Restored

  The City of Wichita has made significant progress in recovering from a cyberattack that disrupted many city services early last month. More than a month later, the City of Wichita cyberattack update has come up stating that most public-facing systems are back online, although some services are still being restored.

• Medical-Targeted Ransomware Is Breaking Records After Change Healthcare’s $22M Payout

  When Change Healthcare paid $22 million in March to a ransomware gang that had crippled the company along with hundreds of hospitals, medical practices, and pharmacies across the US, the cybersecurity industry warned that Change's extortion payment would only fuel a vicious cycle: Rewarding hackers who had carried out a ruthless act of sabotage against the US health care system nationwide with one of the largest ransomware payments in history, it seemed, was bound to incentivize a new wave of attacks on similarly sensitive victims. Now that wave has arrived.