Threat Intelligence Bulletin: 03/18/2022 - 03/24/2022
|by Alpha Team
Profile of Lapsus$
TLP: AMBER
In the following profile, ZeroFox Intelligence provides an overview on the Lapsus$ threat actor group.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
Lapsus$ is an extortion collective. After compromising a network, Lapsus$ typically, though not exclusively, exfiltrates data that can be leveraged in ransom demands. The group was identified operating in its current form as early as December 2021 following an attack on websites owned by Brazil’s Ministry of Health; however, there is some evidence to suggest entities within the collective may have been operating since as early as July 2021. The group appears to be financially motivated.
Russia-Ukraine Conflict: Supply Chain Updates
TLP: WHITE
In this briefing, ZeroFox Intelligence provides a supply chain update on the Russian-Ukraine conflict.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
The U.S. Federal Reserve signaling it will raise interest rates to almost three percent before the end of 2022 indicates that inflation is something the US is very concerned about—more so than the Russian invasion of Ukraine from an economic standpoint. If the two economic concerns were equal, the U.S. Federal Reserve would likely have not raised interest rates, as the invasion would be assumed to depress the economy enough on its own. For supply chains, this signals the United States is seeking to slow down the pace of buying, which will impact businesses that sell big-ticket items like homes, technology, and machinery. The slow pace of interest rate hikes means this process should be gradual, but the war in Ukraine could cause food and energy commodities to become so expensive that the drop in demand will occur much faster. This scenario will likely lead to global social unrest, which is likely to begin across the developing world.
Profile of Everest
TLP: AMBER
In the following profile, ZeroFox Intelligence provides an overview on the Everest ransomware group.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
Everest is a Russian-language ransomware collective that has historically targeted organizations by encrypting and exfiltrating data to be used in ransom demands or to sell to third parties. Everest is believed to have been developed from the Everbe ransomware strain—active between late 2018 to 2020—which has also included Embrace, EvilLocker, Hyena Locker, and PainLocker. However, it is not clear if Everest is a rebrand or just utilizes similar code and tactics. Everest, in its current guise, was identified as early as 2020 but raised its profile significantly in June 2021 after conducting a series of attacks against French companies across multiple industries.1 This was followed by an uptick in activity with an expanded scope of targets. Everest claims that it has breached several organizations and entities globally towards the end of 2021 and into early 2022, including departments of the UK and U.S. governments. ZeroFox has been unable to confirm the veracity of some of Everest’s claims.
Russia-Ukraine Conflict: Situational Updates
TLP: WHITE
In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
NATO leaders met in Brussels on March 24, 2022, to coordinate their response to the ongoing Russia-Ukraine conflict. The United States and NATO have recently expressed growing concern that Russia could use chemical weapons and have stated that they would respond in such a scenario. Ukrainian President Volodymyr Zelensky’s pleas for a no-fly zone and Russian gas embargoes have gone unheeded, but he has had success pressuring Western businesses to suspend their Russian operations. Mariupol will likely fall to Russian forces in the coming weeks, but an encirclement of Kyiv appears unlikely to succeed.
Breaking News: 2022-03-18 - 2022-03-24
New Vulnerability in CRI-O Engine Lets Attackers Escape Kubernetes Containers
A newly disclosed security vulnerability (CVE-2022-0811; CVSS score: 8.8) in the Kubernetes container engine CRI-O could be exploited by an attacker to break out of containers and obtain root access to the host. It affects CRI-O versions 1.19 and later, and has been patched in version 1.23.2.
See the full report here: https://thehackernews.com/2022/03/new-vulnerability-in-cri-o-engine-lets.html
DirtyMoe Botnet Gains New Exploits in Wormable Module to Spread Rapidly
Security researchers have discovered that the DirtyMoe malware has gained new worm-like propagation capabilities that allow it to expand its reach without requiring any user interaction. The module targets older well-known vulnerabilities, such as EternalBlue and Hot Potato Windows privilege escalation. The DirtyMoe botnet is used for carrying out cryptojacking and distributed denial-of-service (DDoS) attack.
See the full report here: https://thehackernews.com/2022/03/dirtymoe-botnet-gains-new-exploits-in.html
Dev Sabotages Popular NPM Package to Protest Russian Invasion
The developer behind the npm package “node-ipc” has released sabotaged versions of the library in protest against the Russian attack on Ukraine., where the malicious code (“protestware”) targets users with IP addresses located in Russia or Belarus and overwrites their files with a heart emoji. The node-ipc library is downloaded over a million times per week.
See the full report here: https://threatpost.com/dev-sabotages-popular-npm-package-protest-russian-invasion/178972/
Google exposes tactics of a Conti ransomware access broker - BleepingComputer
Google's Threat Analysis Group has exposed the operations of a threat actor group "EXOTIC LILY," an initial access broker linked to the Conti and Diavol ransomware operations. It uses large-scale phishing campaigns to breach targeted corporate networks and then sells access to those networks to ransomware gangs.
See the full report here: https://www.bleepingcomputer.com/news/security/google-exposes-tactics-of-a-conti-ransomware-access-broker/
New Unix rootkit used to steal ATM banking data - BleepingComputer
The hacker group LightBasin is using a previously unknown Unix rootkit to steal ATM banking data and conduct fraudulent transactions. LightBasin's new rootkit is a Unix kernel module named "Caketap", whose goal is to intercept banking card and PIN verification data from breached ATM switch servers and then use the stolen data to facilitate unauthorized transactions.
See the full report here: https://www.bleepingcomputer.com/news/security/new-unix-rootkit-used-to-steal-atm-banking-data/
CISA, FBI warn US critical orgs of threats to SATCOM networks - BleepingComputer
The CISA and the FBI have warned Americans of possible threats to satellite communication (SATCOM) networks in the U.S. and worldwide. The agencies advised critical infrastructure organizations and SATCOM network providers to implement appropriate mitigation measures.
See the full report here: https://www.bleepingcomputer.com/news/security/cisa-fbi-warn-us-critical-orgs-of-threats-to-satcom-networks/
New Variant of Russian Cyclops Blink Botnet Targeting ASUS Routers
Security researhed have observed that the nascent botnet Cyclops Blink (attributed to the Russian state-sponsored actor Sandworm, aka Voodoo Bear) is targeting ASUS routers. ASUS is currently working on an update to address any potential exploitation.
See the full report here: https://thehackernews.com/2022/03/new-variant-of-russian-cyclops-blink.html
Google: Chinese state hackers target Ukraine’s government - BleepingComputer
Google's Threat Analysis Group (TAG) says the Chinese People's Liberation Army (PLA) and other Chinese intelligence agencies are trying to get more info on the ongoing Russian war in Ukraine. Google TAG Security Engineer Billy Leonard says Google notified Ukrainian government organizations targeted by a Chinese-sponsored hacking group.
See the full report here: https://www.bleepingcomputer.com/news/security/google-chinese-state-hackers-target-ukraine-s-government/
DarkHotel APT Targets Wynn, Macao Hotels to Rip Off Guest Data
An advanced persistent threat (APT) group has been targeting luxury hotels in Macao, China with a spear-phishing campaign aimed at breaching their networks and stealing the sensitive data of high-profile guests staying at resorts, including the Grand Coloane Resort and Wynn Palace. A threat research report from Trellix “cautiously” identified the South Korean DarkHotel APT group as the culprit behind the attacks.
See the full report here: https://threatpost.com/darkhotel-apt-wynn-macao-hotels/178989/
Free decryptor released for TrickBot gang's Diavol ransomware - BleepingComputer
Cybersecurity firm Emsisoft has released a free decryption tool to help Diavol ransomware victims recover their files without paying a ransom. The decryptor requires access to a file pair consisting of one encrypted file and the original, unencrypted version of the encrypted file to reconstruct the encryption keys needed to decrypt the rest of your data.
See the full report here: https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-trickbot-gangs-diavol-ransomware/
Windows 11 adds a BitLocker exclusion policy for USB drives - BleepingComputer
Microsoft has released a new Windows 11 build with a long list of changes, improvements, and fixes for known issues, available for all Windows Insiders that will install the Windows 11 Insider Preview Build 22579 pushed to the Dev Channel. The build's highlight, however, is a new policy for Windows admins who want to exclude USB removable drives from BitLocker encryption.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-11-adds-a-bitlocker-exclusion-policy-for-usb-drives/
Telegram banned by Brazilian Supreme Court over missed emails - BleepingComputer
Brazilian Supreme Federal Court Justice Alexandre de Moraes banned Telegram on Friday from operating in the country and asked the National Telecommunications Agency to notify internet providers to block the messaging app within five days. This follows a request from the Brazilian Federal Police claiming that Telegram is notoriously known for its stance of not cooperating with judicial and police authorities in several countries.
See the full report here: https://www.bleepingcomputer.com/news/technology/telegram-banned-by-brazilian-supreme-court-over-missed-emails/
Code-Sabotage Incident in Protest of Ukraine War Exposed Open Source Risks
The maintainer of a widely-used open source module for Windows, Linux, and Mac environments recently sabotaged its functionality to protest the war in Ukraine and the process focused attention once again on the potentially serious security issues tied to code dependencies in software. A JavaScript module for interprocess communication that millions of developers use when building software, recently inserted code into the software for deleting all files on developer systems geolocated in Russia and Belarus.
See the full report here: https://www.darkreading.com/application-security/recent-code-sabotage-incident-latest-to-highlight-code-dependency-risks
Agencies Warn on Satellite Hacks & GPS Jamming Affecting Airplanes, Critical Infrastructure
In a warning to aviation authorities and air operators on Thursday, the European Union Aviation Safety Agency (EASA) warned of satellite jamming and spoofing attacks across a broad swath of Eastern Europe that could affect air navigation systems. The warning came in tandem with a separate alert from the FBI and the U.S. Cybersecurity Infrastructure and Security Agency (CISA) that hackers could be targeting satellite communications networks in general.
See the full report here: https://threatpost.com/agencies-satellite-hacks-gps-jamming-airplanes-critical-infrastructure/178993/
Avoslocker ransomware gang targets US critical infrastructure
The Federal Bureau of Investigation published a joint cybersecurity advisory warning that AvosLocker ransomware is being used in attacks targeting US critical infrastructure. AvosLocker is a Ransomware as a Service (RaaS) affiliate-based group that has targeted victims across multiple critical infrastructure sectors in the United States. The joint advisory includes indicators of compromise (IOCs) that network defenders can use to detect and block the threat along with the list of mitigation measures to increase the resilience of company networks. In some cases, AvosLocker negotiators also threaten and launch distributed denial-of-service (DDoS) attacks during negotiations, likely when the victims are not cooperating, to convince them to comply with their demands.
See the full report here: https://securityaffairs.co/wordpress/129232/cyber-crime/avoslocker-ransomware-us-critical-infrastructure.html
New Phishing toolkit lets anyone create fake Chrome browser windows
A phishing kit has been released that allows attackers to create effective single sign-on phishing login forms using fake Chrome browser windows. When clicking the Login in Google or App buttons, a single-sign-on (SSO) browser window will be displayed, prompting you to enter your credentials and login with the account. Threat actors have attempted to create the fake SSO windows to steal 2FA keys during phishing attacks. A new "Browser in the Browser (BitB) Attack" comes into play which creates fake browser windows within real browser windows to create convincing phishing attacks.
See the full report here: https://www.bleepingcomputer.com/news/security/new-phishing-toolkit-lets-anyone-create-fake-chrome-browser-windows/
AirDrop process of ApeCoin cryptocurrency found vulnerable, led to theft of millions of dollars in NFTs
The Bored Ape Yacht Club NFT collection advertised this week that any of their members holds a Bored Ape Yacht Club or Mutant Ape Yacht Club NFT in their wallet, they can claim a certain amount of free tokens, later they either sell for a profit or hold their tokens. This announcement caught the attention of many threat actors and hackers. Meanwhile, threat actors are being able to claim the airdrop, using NFTs that they did not initially own. Hackers used this airdrop to claim a large number of tokens by using a flash loan attack, and by using this attack method they were able to gain quick millions of USD.
See the full report here: https://research.checkpoint.com/2022/airdrop-process-of-apecoin-cryptocurrency-found-vulnerable-led-to-theft-of-millions-of-dollars-in-nfts/
Crooks claims to have stolen 4TB of data from TransUnion South Africa
TransUnion South Africa discloses a data breach, that threat actors compromised a company server using stolen credentials and demanded a ransom. As a precautionary measure, the company temporarily took part of its infrastructure offline and has declared that it will not pay the ransom and hired cybersecurity and forensic experts to investigate the extent of the security breach. The company believes the security breach only impacted an isolated server holding limited data. BleepingComputer reported that the Brazilian cybercrime group “N4ughtysecTU” has claimed responsibility for the attack and allegedly stolen 4TB of data. The attackers claim to have hacked a poorly secured TransUnion SFTP server through a brute force attack on it and stolen data related to 54 million customers.
See the full report here: https://securityaffairs.co/wordpress/129224/data-breach/transunion-south-africa-data-breach.html
NRA finally admits it was hacked by a ransomware group in 2021 - Mashable
The National Rifle Association (NRA) has just accepted that the organization was indeed treaded on when it became victim of a massive hack last year. A ransomware group known as Grief targeted the NRA and boasted about the data it had stolen from the gun organization. Grief, which has ties to the Russia-based cybercriminal ring Evil Corp., allegedly stole tax, grant, and investor information from the NRA and posted the stolen information on its website. Grief later released more sensitive personal and financial data, such as bank accounts numbers.
See the full report here: https://mashable.com/article/nra-admits-ransomware-hack
Newer Conti ransomware source code leaked out of revenge - BleepingComputer
The account "Conti Leaks" (@ContiLeaks on Twitter) uploaded the source code for Conti version 3 to VirusTotal and posted a link on Twitter. This source code is much newer than the previously released version, with the last modified date being January 25, 2021.
See the full report here: https://www.bleepingcomputer.com/news/security/newer-conti-ransomware-source-code-leaked-out-of-revenge/
Western Digital app bug gives elevated privileges in Windows, macOS - BleepingComputer
Security researchers have discovered a directory traversal bug (CVE-2022-22998; CVSS v3 score: 9.1) in Western Digital's EdgeRover desktop app. EdgeRover is a centralized content management solution for Western Digital and SanDisk products. Users should update their EdgeRover desktop applications to version 1.5.1-594 or later to guard against this bug.
See the full report here: https://www.bleepingcomputer.com/news/security/western-digital-app-bug-gives-elevated-privileges-in-windows-macos/
CySecurity News - Latest Information Security and Hacking Incidents: Multiple Similarities Identified in BlackMatter And BlackCat Ransomware
Researchers from Cisco Talos have discovered similarities in the tactics, methods, and procedures (TTPs) used by BlackCat and BlackMatter, indicating a close link between the two ransomware gangs. BlackCat initially appeared on the ransomware-as-a-service (RaaS) market in November 2021, according to Cisco Talos data, and has since attacked multiple firms by exploiting vulnerabilities in the Windows system.
See the full report here: https://www.cysecurity.news/2022/03/multiple-similarities-identified-in.html
BitRAT malware now spreading as a Windows 10 license activator - BleepingComputer
BitRAT is a powerful remote access trojan sold on cybercrime forums and dark web markets for as low as $20 (lifetime access) to any cybercriminal who wants it. A new BitRAT virus distribution effort is underway, targeting people who want to utilize unauthorized Microsoft license activators to activate unlicensed Windows OS versions for free.
See the full report here: https://www.bleepingcomputer.com/news/security/bitrat-malware-now-spreading-as-a-windows-10-license-activator/
Android password-stealing malware infects 100,000 Google Play users - BleepingComputer
The Google Play Store has seen over 100,000 downloads of malicious Android software that steals Facebook credentials, and the app is still accessible for download. The Android malware is disguised as a cartoonifier app called 'Craftsart Cartoon Photo Tools,' allowing users to upload an image and convert it into a cartoon rendering.
See the full report here: https://www.bleepingcomputer.com/news/security/android-password-stealing-malware-infects-100-000-google-play-users/
Barclays and Lloyds under fire over banking breaches - Your Money
According to the regulator, Barclays and Lloyds provided false information on interest rates, branch numbers, and opening hours, as well as fees and ATMs available to customers. The Competition and Markets Authority (CMA) has accused banks of breaking a series of regulations governing product and service information as part of the open banking – or data-sharing – program.
See the full report here: https://www.yourmoney.com/saving-banking/barclays-and-lloyds-under-fire-over-banking-breaches/
Vulnerabilities discovered in Veeam backup solutions - IT Brief New Zealand
Veeam Backup & Replication is a proprietary backup app developed by Veeam for virtual environments built on VMware vSphere, Nutanix AHV, and Microsoft Hyper-V hypervisors. Positive Technologies uncovered three serious vulnerabilities in Veeam backup solutions, with the potential for ransomware, data theft, and denial of service attacks.
See the full report here: https://itbrief.co.nz/story/vulnerabilities-discovered-in-veeam-backup-solutions
Ukraine warns of InvisiMole attacks tied to state-sponsored Russian hackers
The hacking group InvisiMole is reportedly targeting Ukraininan organizations via phishing attacks. The hacking group is suspected to have ties to the Russian advanced persistent threat (APT) group Gamaredon, and was linked to attacks against high-profile military and diplomatic organizations in Eastern Europe.
See the full report here: https://www.zdnet.com/article/ukraine-warns-of-invisimole-attacks-tied-to-state-sponsored-russian-hackers/
Serpent malware campaign abuses Chocolatey Windows package manager - BleepingComputer
Threat actors are abusing the popular Chocolatey Windows package manager to install the "Serpent" backdoor malware, via a phishing attack on French government agencies and construction firms. The attack starts with a phishing email impersonating the European Union's General Data Protection Regulations agency (GDPR).
See the full report here: https://www.bleepingcomputer.com/news/security/serpent-malware-campaign-abuses-chocolatey-windows-package-manager/
Windows zero-day flaw giving admin rights gets unofficial patch, again - BleepingComputer
The 0patch team has released a fix for a Windows local privilege escalation zero-day vulnerability (CVE-2021-34484; CVSS v3 score of 7.8) that Microsoft has reportedly failed to fully address for several months now. 0patch has ported the fix to work with the March 2022 Patch Tuesday updates and made it available for free to all registered users.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-zero-day-flaw-giving-admin-rights-gets-unofficial-patch-again/
Hacker Manipulates a Smart Contract on Li Finance; Takes $600K - PYMNTS.com
The Li Finance swap aggregator experienced a smart contract attack, which led to around $600,000 lost from 29 users’ wallets. Of the 29 wallets hit in the attack, 25 had been reimbursed for their losses, but that only amounted to 13% of the total value lost. The attacker has been contacted and offered a bug bounty.
See the full report here: https://www.pymnts.com/news/security-and-risk/2022/hacker-manipulates-a-smart-contract-on-li-finance-takes-600k/
Authentication services firm Okta says it is investigating report of breach
Authentication services company Okta is investigating a report of a digital breach after the LAPSUS$ group of hackers claimed access to OKTA-related data. A hack at Okta could have major consequences because thousands of other companies rely on it to manage access to their own networks and applications.
See the full report here: https://www.reuters.com/technology/authentication-services-firm-okta-says-it-is-investigating-report-breach-2022-03-22/
Hundreds of HP printers vulnerable to remote code execution flaws - BleepingComputer
HP has issued security advisories for three major vulnerabilities that affect hundreds of LaserJet Pro, Pagewide Pro, OfficeJet, Enterprise, Large Format, and DeskJet printer models. HP has released firmware security updates for most of the affected products.
See the full report here: https://www.bleepingcomputer.com/news/security/hundreds-of-hp-printers-vulnerable-to-remote-code-execution-flaws/
Greece's public postal service offline due to ransomware attack - BleepingComputer
ELTA, Greece's state-owned postal service provider, has revealed a ransomware issue that was discovered on Sunday and is still keeping most of the organization's services unavailable. The organization has updated its customers about the extent of the service outages.
See the full report here: https://www.bleepingcomputer.com/news/security/greeces-public-postal-service-offline-due-to-ransomware-attack/
Custom macOS malware of Chinese hackers ‘Storm Cloud’ exposed - BleepingComputer
Researchers have discovered a previously unknown macOS malware variant called GIMMICK, which is believed to be a custom tool used by a Chinese espionage threat actor known as 'Storm Cloud.' GIMMICK is a multi-platform malware written in Objective C (macOS), or .NET and Delphi (Windows).
See the full report here: https://www.bleepingcomputer.com/news/security/custom-macos-malware-of-chinese-hackers-storm-cloud-exposed/
Windows 10 KB5011543 update released with Search highlights feature - BleepingComputer
Microsoft has released the optional KB5011543 Preview cumulative update for Windows 10 20H2, Windows 10 21H1, and Windows 10 21H2. This update includes numerous bug fixes and a new "Search highlights" feature for the Windows 10 Start Menu.
See the full report here: https://www.bleepingcomputer.com/news/microsoft/windows-10-kb5011543-update-released-with-search-highlights-feature/
Social engineering attacks to dominate Web3, the metaverse
According to analysts, a spike in social engineering attacks will dominate Web3 and the metaverse. Web3 is a concept that has been coined to describe what could be the internet's future face. 'Metaverse' – a 3D environment and virtual world for facilitating social connections, whether personal or for work.
See the full report here: https://www.zdnet.com/article/social-engineering-attacks-to-dominate-web3-metaverse-services/
Botnet of Thousands of MikroTik Routers Abused in Glupteba, TrickBot Campaigns
A botnet is exploiting a known bug (CVE-2018-14847) in thousands of vulnerable MikroTik routers, and using them to distribute malware. Users should update their routers with the latest security patches and set up a strong router password to guard against such attacks.
See the full report here: https://thehackernews.com/2022/03/over-200000-microtik-routers-worldwide.html
Chinese 'Mustang Panda' Hackers Spotted Deploying New 'Hodur' Malware
A China-based advanced persistent threat (APT) Mustang Panda is reportedly conducting a cyberespionage campaign using Hodur – a previously undocumented variant of the PlugX remote access trojan – on infected machines. The victims include research entities, internet service providers (ISPs), and European diplomatic missions mostly located in East and Southeast Asia.
See the full report here: https://thehackernews.com/2022/03/chinese-mustang-panda-hackers-spotted.html
DeadBolt Ransomware Resurfaces to Hit QNAP Again
Security researchers have observed a spike in Deadbolt infections on QNAP network attached storage (NAS) devices since March 16, 2022. Most of the targeted systems are running the QNAP QTS Linux kernel version 5.10.60. The attacks are similar to the wave of attacks that occured in January this year; only the BTC addresses for paying the ransom amounts have changed.
See the full report here: https://threatpost.com/deadbolt-ransomware-qnap-again/179057/
Hackers exploit new WPS Office flaw to breach betting firms - BleepingComputer
A sophisticated threat actor is leveraging a bug (CVE-2022-24934) in the WPS Office updater utility to target betting firms. Security researchers suspect the actor to be a Chinese APT (advanced persistent threat) with the goal to gather intelligence or achieve financial gains.
See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploit-new-wps-office-flaw-to-breach-betting-firms/
Nestlé says it leaked its own test data, not Anonymous
Nestlé has denied claims of a successful cyberattack against the company and a subsequent data leak. The hacker collective Anonymous had claimed to have obtained and leaked 10 GB of the company's records.
See the full report here: https://www.theregister.com/2022/03/23/nestle_russia_anonymous/
VMware fixes command injection, file upload flaws in Carbon Black security tool
VMware has patched two bugs (CVE-2022-22951 and CVE-2022-22952; both having a CVSS score of 9.1/10) in its Carbon Black App Control product. They can be exploited to execute arbitrary commands on the Windows host. The company hasn't specified whether the bugs are actively exploited.
See the full report here: https://www.theregister.com/2022/03/23/critical_bugs_vmware_carbon_black/
Microsoft confirms breach after hackers publish source code – TechCrunch
Microsoft has revealed that an employee’s account was compromised by the hacking group LAPSUS$, granting the attackers limited access to Microsoft’s systems and allowing the theft of the company’s source code. Microsoft added that no customer code or data was compromised.
See the full report here: https://techcrunch.com/2022/03/23/microsoft-lapsus-hack-source-code/
Tags: weekly bulletin, all industries, global