Author: xopero_blogger

Great thefts stir the imagination like no others. The famous D B Cooper’s case, the United California Bank robbery, or the Great Train Robbery from 1963. Do “electronic” thefts stir the same amount of emotions? It’s hard to say, but when over 600 million dollars disappears from one of the financial platforms, it will bring a lot of hype. But let’s keep our feet on the ground and ask really important questions. Namely, how does it happened, was there a way to prevent the theft, is there any chance to get the money back, and what about the victims – BinanceChain, Ethereum, and Polygon miners?

Critical VMware vulnerabilities are not the only problem faced by this virtualization software vendor last week. Do you remember the BlackMatter group that proclaimed itself to be the successor of REvil we warned you against in the last issue? It already has an encryption program targeting VMware ESXi. Today we also describe a unique business model of the new LockBit 2.0. and a cyberespionage campaign targeting the largest telecoms. For the sake of balance, we are describing a new project from Microsoft – with “Super Duper Secure Mode” the company wants to change the landscape of exploits and increase the cost of attacks.

Last week, the industry media reported on spectacular debuts or rebirths in the cybercriminal world. Do you remember our news from two weeks ago about the end of REvil? Well, we advised you to hold on with popping the champagne … The celebration was interrupted by the news about the emergence of two ransomware groups on the market – BlackMatter and Haron, which may turn out to be successors of REvil and Avaddon. And it’s not the end of big returns – Oscorp Android malware stealing data and funds from banking apps came back even stronger in a form of UBEL botnet. 

What else? If Apple calls for urgent updating of most devices just one week after a series of patches, know something is happening. In addition – a critical Hyper-V vulnerability, which received the infamous rating of 9.9 on a ten-grade threat scale!

Today’s Security Center edition will make the temperature rise not only outside the window … but also among the owners of hundreds of millions of printers. A 16-year-old security bug found in HP, Xerox, and Samsung printers driver allows attackers to gain admin rights. But that’s not the end of the privilege escalation bugs. Other news should be of interest to Linux and Windows users, including all those waiting for the release of Windows 11 – this system has also been found vulnerable to a bug called Sequoia. What else? MosaicLoader malware and SEO poisoning attacks, and some interesting facts about ChromePass credential theft.

There are a few disturbing “returns” in this Security Center release. Let’s start with Joker malware that has appeared again in Google Play. So far, 1,800 malicious applications have been removed from the marketplace. The new variant much more effectively avoids various types of security mechanisms – built into the device and Play Protect scanners as well. So be careful when installing new applications. Another interesting news … Media all over the world are wondering if this is the end of REvil. In recent days, the world’s largest ransomware gang has mysteriously disappeared from the web. The next weeks will show if it’s for good. As it turns out, the Windows Print Spooler problem is still up to date – this time with even worse repercussions. A new vulnerability – which Microsoft is warning about – could be exploited to perform unauthorized actions on the system. You can find the details below.

The PrintNightmare case definitely dominated the media during the last few days. There was a heated discussion as to whether the patch (released by Microsoft) solves the problem at all. Why such different opinions? The patch turned out to work against all known exploits, but it was not without its flaws. So if you are wondering if it is worth updating – yes, and do it as soon as possible. If there will be another patch release, you can definitely read about it in the Security Center.

Detailed information about the emergency security update – and other IT news – can be found below. Let’s start then.

Welcome to the Xopero Security Center. Do you remember Dell’s and WD My Book NAS’ stories from last week? Can today’s topics beat them? Let’s find out. There is a new and disturbing trend in the cybercriminal world. More and more hacker groups are migrating towards ESXi virtual machines. Now also REvil operators have prepared a Linux encryptor that is able to encrypt virtual resources. A new PoC exploit also made its (accidentally) debut on the internet. PrintNightmare, the new critical Windows RCE, runs at the highest privilege level. This means that it is capable to dynamically load third-party binaries. As you can see, the problem is quite serious. There has also been a discussion about the critical vulnerabilities in NETGEAR routers which could be reliably abused as a jumping-off point to compromise a network’s security and gain unfettered access. We also have some bad news for LinkedIn users – a new database with 700 million records has just hit the black market. Details can be found below.