Xopero Blog

Critical VMware vulnerabilities are not the only problem faced by this virtualization software vendor last week. Do you remember the BlackMatter group that proclaimed itself to be the successor of REvil we warned you against in the last issue? It already has an encryption program targeting VMware ESXi. Today we also describe a unique business model of the new LockBit 2.0. and a cyberespionage campaign targeting the largest telecoms. For the sake of balance, we are describing a new project from Microsoft – with “Super Duper Secure Mode” the company wants to change the landscape of exploits and increase the cost of attacks.

Last week, the industry media reported on spectacular debuts or rebirths in the cybercriminal world. Do you remember our news from two weeks ago about the end of REvil? Well, we advised you to hold on with popping the champagne … The celebration was interrupted by the news about the emergence of two ransomware groups on the market – BlackMatter and Haron, which may turn out to be successors of REvil and Avaddon. And it’s not the end of big returns – Oscorp Android malware stealing data and funds from banking apps came back even stronger in a form of UBEL botnet. 

What else? If Apple calls for urgent updating of most devices just one week after a series of patches, know something is happening. In addition – a critical Hyper-V vulnerability, which received the infamous rating of 9.9 on a ten-grade threat scale!

Today’s Security Center edition will make the temperature rise not only outside the window … but also among the owners of hundreds of millions of printers. A 16-year-old security bug found in HP, Xerox, and Samsung printers driver allows attackers to gain admin rights. But that’s not the end of the privilege escalation bugs. Other news should be of interest to Linux and Windows users, including all those waiting for the release of Windows 11 – this system has also been found vulnerable to a bug called Sequoia. What else? MosaicLoader malware and SEO poisoning attacks, and some interesting facts about ChromePass credential theft.

There are a few disturbing “returns” in this Security Center release. Let’s start with Joker malware that has appeared again in Google Play. So far, 1,800 malicious applications have been removed from the marketplace. The new variant much more effectively avoids various types of security mechanisms – built into the device and Play Protect scanners as well. So be careful when installing new applications. Another interesting news … Media all over the world are wondering if this is the end of REvil. In recent days, the world’s largest ransomware gang has mysteriously disappeared from the web. The next weeks will show if it’s for good. As it turns out, the Windows Print Spooler problem is still up to date – this time with even worse repercussions. A new vulnerability – which Microsoft is warning about – could be exploited to perform unauthorized actions on the system. You can find the details below.

The PrintNightmare case definitely dominated the media during the last few days. There was a heated discussion as to whether the patch (released by Microsoft) solves the problem at all. Why such different opinions? The patch turned out to work against all known exploits, but it was not without its flaws. So if you are wondering if it is worth updating – yes, and do it as soon as possible. If there will be another patch release, you can definitely read about it in the Security Center.

Detailed information about the emergency security update – and other IT news – can be found below. Let’s start then.