Windows TCO: MuddyWater, Ransomware, Windows Zero-Day
-
The Register UK ☛ Iran's MuddyWater phishes Israel with custom backdoor
One of the samples analyzed includes methods to help the malware evade detection by endpoint detection tools:
"First, the malware enables the MicrosoftSignedOnly flag of the ProcessSignaturePolicy structure to prevent the process from loading images that are not signed by Microsoft. This prevents other processes from injecting DLLs into the process."
-
Cyble Inc ☛ EU And Ukraine Forge Stronger Cybersecurity Partnership
Recognizing the evolving threat landscape, the EU and Ukraine will work together to harmonize their cybersecurity frameworks. Ukraine will align its legislation with the EU’s Network and Information Security (NIS) 2 Directive, strengthening critical infrastructure and supply chain resilience. This harmonization, however, goes beyond technicalities. It fosters a unified approach to cyber defense, making it harder for attackers to exploit vulnerabilities across borders.
The dialogue wasn’t merely theoretical. The EU and Ukraine agreed to enhance information sharing on cyber threats, risks, and crisis management. This improved situational awareness will aid in understanding the cyber landscape in real-time and be crucial in countering ongoing and future Russian cyberattacks.
-
Cyble Inc ☛ Iranian Group MuddyWater Switches To MuddyRot Malware
Researchers from Sekoia observed that the new MuddyRot malware is distributed through malicious PDF files and relies on public exploits to compromise [Internet]-exposed servers, such as Exchange or SharePoint servers, moving laterally within the entire network after successful compromise.
-
The Record ☛ Furniture giant shuts down manufacturing facilities after ransomware attack
Unlike many of the 8-K filings companies have submitted to the SEC following cyberattacks, Bassett Furniture admitted that the attack “has had and is reasonably likely to continue to have a material impact on the Company’s business operations until recovery efforts are completed.”
-
Security Week ☛ APT Exploits Windows Zero-Day to Execute Code via Disabled Internet Explorer
The vulnerability, tracked as CVE-2024-38112 (CVSS score of 7.5), was addressed with the July 2024 Patch Tuesday updates, roughly two months after Trend Micro discovered it in the wild and reported it to Microsoft.