Category: Security Center

Last week, the industry media reported on spectacular debuts or rebirths in the cybercriminal world. Do you remember our news from two weeks ago about the end of REvil? Well, we advised you to hold on with popping the champagne … The celebration was interrupted by the news about the emergence of two ransomware groups on the market – BlackMatter and Haron, which may turn out to be successors of REvil and Avaddon. And it’s not the end of big returns – Oscorp Android malware stealing data and funds from banking apps came back even stronger in a form of UBEL botnet. 

What else? If Apple calls for urgent updating of most devices just one week after a series of patches, know something is happening. In addition – a critical Hyper-V vulnerability, which received the infamous rating of 9.9 on a ten-grade threat scale!

Today’s Security Center edition will make the temperature rise not only outside the window … but also among the owners of hundreds of millions of printers. A 16-year-old security bug found in HP, Xerox, and Samsung printers driver allows attackers to gain admin rights. But that’s not the end of the privilege escalation bugs. Other news should be of interest to Linux and Windows users, including all those waiting for the release of Windows 11 – this system has also been found vulnerable to a bug called Sequoia. What else? MosaicLoader malware and SEO poisoning attacks, and some interesting facts about ChromePass credential theft.

There are a few disturbing “returns” in this Security Center release. Let’s start with Joker malware that has appeared again in Google Play. So far, 1,800 malicious applications have been removed from the marketplace. The new variant much more effectively avoids various types of security mechanisms – built into the device and Play Protect scanners as well. So be careful when installing new applications. Another interesting news … Media all over the world are wondering if this is the end of REvil. In recent days, the world’s largest ransomware gang has mysteriously disappeared from the web. The next weeks will show if it’s for good. As it turns out, the Windows Print Spooler problem is still up to date – this time with even worse repercussions. A new vulnerability – which Microsoft is warning about – could be exploited to perform unauthorized actions on the system. You can find the details below.

The PrintNightmare case definitely dominated the media during the last few days. There was a heated discussion as to whether the patch (released by Microsoft) solves the problem at all. Why such different opinions? The patch turned out to work against all known exploits, but it was not without its flaws. So if you are wondering if it is worth updating – yes, and do it as soon as possible. If there will be another patch release, you can definitely read about it in the Security Center.

Detailed information about the emergency security update – and other IT news – can be found below. Let’s start then.

Welcome to the Xopero Security Center. Do you remember Dell’s and WD My Book NAS’ stories from last week? Can today’s topics beat them? Let’s find out. There is a new and disturbing trend in the cybercriminal world. More and more hacker groups are migrating towards ESXi virtual machines. Now also REvil operators have prepared a Linux encryptor that is able to encrypt virtual resources. A new PoC exploit also made its (accidentally) debut on the internet. PrintNightmare, the new critical Windows RCE, runs at the highest privilege level. This means that it is capable to dynamically load third-party binaries. As you can see, the problem is quite serious. There has also been a discussion about the critical vulnerabilities in NETGEAR routers which could be reliably abused as a jumping-off point to compromise a network’s security and gain unfettered access. We also have some bad news for LinkedIn users – a new database with 700 million records has just hit the black market. Details can be found below.

Welcome to the Xopero Security Center! Another ransomware news? No, not this time. However, data can be lost in more ways than one. For example, as a result of an unplanned factory restore. No more than half a week ago WD My Book NAS users fell victim to such a massive “update” or rather some form of a cyberattack. As always, more information can be found below. In this review: Dell is having a serious problem. The pre-installed firmware updater available on their computers may expose almost 30 million users or if you like – 128 models of this manufacturer’s devices, to attack. Also: Microsoft tracks a new BazaCall malware campaign using a fake call center to trick you, and Linux Marketplace bugs allow wormable attacks. Let’s begin.

Welcome to the Xopero Security Center! It’s a strange, strange world we live in… There is a new malware primary designed to block victims from entering torrent sites and other services with pirated content. And it doesn’t look like some sophisticated anti-piracy operation – generally, specialists have no idea what is going on. Victims should prepare themselves for some future scam or 2nd attack. This news open today’s review but what else our team prepared for you? REvil Group is getting more active again – this time the ransomware has hit US nuclear weapons contractor. There is also a new SolarMarker campaign that uses SEO poisoning to infect targets with a remote access trojan. The last news reports malicious Minecraft modpacks that hit Google Play Store. Ready for more details? Then check the text below.

Welcome to the Xopero Security Center! This month’s patch harvest was an extremely big one. The IT world heated up the information about six new zero-days patched by Microsoft in recent days. No less serious update has got Android users. Google has released a fix for the critical RCE bug and other 90+ vulnerabilities … Let’s stop at Google for a little longer. Chrome also has got a series of urgent fixes – one of the bugs is currently being used in a series of attacks. Let’s not forget about the last data breaches and cyberattacks too. Electronic Arts, a game publisher that you probably associate with the FIFA series fell a victim to the hackers. They stole – among other things – Frostbite engine and FIFA 21 source codes. Details, as usual, can be found below.

Welcome to the Xopero Security Center! What technological news has captured the imagination of IT specialists and geeks around the world? There were quite a few of them, but we have selected four (plus 10 extra) most interesting. Today’s release opens the new strain of Barebones ransomware called Epsilon Red. Marvel’s comic book fans will probably be familiar with this name. What makes this “villain” different from other threats? Namely, the fact that it is basing the attack chain on PowerShell scripts. Another topic concerns vulnerabilities in Microsoft PatchGuard. The newly detected bug allows attackers to load malicious code directly into the Windows kernel. We also describe the changes that took place inside the Necro Python bot. The latest update brings a number of fresh features as well as exploits for 10 applications – including VMware. The last article is about malicious ads visible on the Google network that can be delivered to your computers by the info stealer.

Enough small talk it’s time to check the whole post.

Last week turned out to be extremely unfavorable for Apple. First, the world heard about a new 0-day vulnerability that allows attackers to secretly perform print screens. Yes, let’s forget about any privacy… And then just a few days later, news about M1RACLES has come to our attention too. What is all the hype about? The bug is a result of a flaw in the M1 design. And what is even worse… That information you will find below. In this issue, we also describe a new variant of the Rowhammer attack. Half-Double – this is the name it got – allows bypassing all current defenses. However, today’s Security Center opens the news about a new critical bug detected in VMware vCenter. Given the scale of the threat (9.8/10 CVSS!), exploiting the vulnerability is trivial. Hence the pressure from security experts and the vendor itself to urgently update vulnerable systems.