Threat Intelligence Bulletin: 04/08/2022

Microsoft Patch Tuesday 04/13/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Standing Intelligence Requirements

Vulnerability

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Highlights: Microsoft's Patch Tuesday update for April 2022 contained 117 vulnerabilities in total, with:

9 vulnerabilities rated as Critical
108 vulnerabilities rated as Important

The patched bugs include two zero-day vulnerabilities. One of these vulnerabilities, CVE-2022-26904, was previously tracked as CVE-2021-34484 and CVE-2022-21919, and patches for them were released; however, Microsoft was unsuccessful in completely patching these vulnerabilities.

Meanwhile, Microsoft recently revealed its plans for “AutoPatch” – which will allow enterprises to expedite applying security fixes. Autopatch will be available as a part of Windows Enterprise E3 in July 2022 and keep Windows and Office software on enrolled endpoints up-to-date automatically, at no additional cost. “The second Tuesday of every month will be 'just another Tuesday,’“ a Microsoft official stated.

Most notable vulnerabilities

Microsoft has listed two zero-day vulnerabilities (CVE-2022-26904 and CVE-2022-24521) among the bugs fixed in the April Patch Tuesday security update.

The products/services affected by the 10 critical vulnerabilities include LDAP - Lightweight Directory Access Protocol, Microsoft Dynamics, Windows Hyper-V, Windows Network File System, Windows Remote Procedure Call Runtime, and Windows Server Message Block (SMB).

CVE-2022-26904

CVE-2022-26904 (CVSS score: 7) is a privilege escalation vulnerability in the Windows User Profile Service. Because of this flaw, Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are affected:

Windows Server 2012 R2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems

CVE-2022-24521

CVE-2022-24521 (CVSS score: 7.8) is an elevation of privilege vulnerability in the Windows Common Log File System Drive. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to gain elevated privileges on the system and execute arbitrary code with higher privileges.

The following products are affected:

Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems

CVE-2022-26809

CVE-2022-26809 (CVSS score: 9.8) is a Remote Procedure Call (RPC) Runtime Library remote code execution vulnerability. By persuading a victim to open specially-crafted content, a remote attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2016 (Server Core installation)
Windows 11 for ARM64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 1809 for 32-bit Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows 8.1 for 32-bit systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 11 for x64-based Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019

CVE-2022-24491

CVE-2022-24491 (CVSS score: 9.8) is a remote code execution vulnerability in the Windows Network File System. Because of this bug, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system (after the attacker sends a specially-crafted request).

The following products are affected:

Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows RT 8.1
Windows 8.1 for x64-based systems
Windows 8.1 for 32-bit systems
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems

Russia-Ukraine Conflict: Situational Updates

TLP: WHITE

In this briefing, ZeroFox Intelligence provides a situational awareness update on the Russia-Ukraine conflict.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 2:00 PM (EDT) on April 14, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Russia is preparing an offensive in southeastern Ukraine with the goal of conquering the entirety of the Donetsk and Luhansk regions. Russian President Vladimir Putin will likely seek to showcase a significant military victory at the Victory Day celebrations on May 9, 2022. U.S. President Joseph Biden committed to a new USD 800 million military assistance package to Ukraine that includes the first deliveries of U.S. artillery and conventional weapons. Mariupol is close to falling to Russian forces, but widespread claims of a large Ukrainian surrender and the Russian use of chemical weapons are unverified.

Breaking News: 2022-04-08 - 2022-04-14

Researchers Uncover How Colibri Malware Stays Persistent on Hacked Systems

Security researchers have analyzed the working mechanism of the malware loader called Colibri, which has been observed deploying a Windows information stealer known as Vidar. Colibri is a malware-as-a-service (MaaS) platform that's engineered to drop additional payloads onto compromised systems.

See the full report here: https://thehackernews.com/2022/04/researchers-uncover-how-colibri-malware.html

Malicious web redirect service infects 16,500 sites to push malware - BleepingComputer

A new traffic direction system (TDS) called Parrot is being used in malicious campaigns to redirect potential victims (matching a specific profile) to online resources such as phishing and malware-dropping sites. It is currently being used for a campaign called FakeUpdate, which delivers remote access trojans (RATs) via fake browser update notices.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-web-redirect-service-infects-16-500-sites-to-push-malware/

New malware targets serverless AWS Lambda with cryptominers - BleepingComputer

Denonia – a Go-based wrapper designed to deploy a custom XMRig cryptominer – is reportedly the first malware specifically developed to target Amazon Web Services (AWS) Lambda cloud environments with cryptominers. AWS Lambda is a serverless computing platform for running code from hundreds of AWS services and software as a service (SaaS) apps without managing servers.

See the full report here: https://www.bleepingcomputer.com/news/security/new-malware-targets-serverless-aws-lambda-with-cryptominers/

Microsoft takes down APT28 domains used in attacks against Ukraine - BleepingComputer

Microsoft has taken down seven domains used as attack infrastructure by the hacking group Strontium (also known as Fancy Bear or APT28), which is linked to Russia's military intelligence service GRU. These domains were used to attack Ukrainian organizations as well as U.S. and E.U. government institutions and think tanks involved in foreign policy.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-takes-down-apt28-domains-used-in-attacks-against-ukraine/

FBI Shut Down Russia-linked "Cyclops Blink" Botnet That Infected Thousands of Devices

The U.S. Department of Justice (DoJ) has announced that it neutralized Cyclops Blink, a modular botnet controlled by a Russia-linked threat actor known as Sandworm. The botnet primarily targeted WatchGuard firewall appliances and ASUS routers.

See the full report here: https://thehackernews.com/2022/04/fbi-shut-down-russia-linked-cyclops.html

VMware warns of critical vulnerabilities in multiple products

VMWare has released patches for five critical vulnerabilities and other high- and medium-severity bugs. The company stated that it found no evidence of these bugs being exploited in the wild, till the time of the release.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-warns-of-critical-vulnerabilities-in-multiple-products/

New Octo Banking Trojan Spreading via Fake Apps on Google Play Store

The rental banking trojan Octo is being spread via malicious apps on Google Play Store. Octo can gain remote control over the devices by using the accessibility permissions as well as Android's MediaProjection API to capture screen contents in real-time. The overall target is the automatic initiation of fraudulent transactions.

See the full report here: https://thehackernews.com/2022/04/new-octo-banking-trojan-spreading-via.html

US eases sanctions that may lead to Russia's Internet isolation - BleepingComputer

The U.S. has announced exemptions on previously imposed sanctions on Russia related to telecommunications and internet-based communications. This likely aims to prevent further isolation of Russian people from Western news sources and social media. The updated sanctions still prevent companies from working with the Russian Central Bank, National Wealth Fund, and Ministry of Finance.

See the full report here: https://www.bleepingcomputer.com/news/technology/us-eases-sanctions-that-may-lead-to-russias-internet-isolation/

Snap-on discloses data breach claimed by Conti ransomware gang - BleepingComputer

Automotive tools manufacturer Snap-on discovered that threat actors stole personal data belonging to its employees between March 1 and March 3, 2022. The company stated in its disclosure report that associate and franchisee data, including names, Social Security Numbers, dates of birth, and employee identification numbers, was involved in the breach.

See the full report here: https://www.bleepingcomputer.com/news/security/snap-on-discloses-data-breach-claimed-by-conti-ransomware-gang/

Hackers use Conti's leaked ransomware to attack Russian companies - BleepingComputer

A hacking group, NB65, is targeting Russian organizations with ransomware attacks – using the Conti group's leaked ransomware source code to create their own ransomware. Conti's source code was leaked after it sided with Russia in the war against Ukraine.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/

New Meta information stealer distributed in malspam campaign - BleepingComputer

Security researchers have observed a spam campaign using META to steal passwords stored in Chrome, Edge, and Firefox, as well as cryptocurrency wallets. META is a novel info-stealers, whose operators wish to take advantage of Raccoon Stealer's exit from the market.

See the full report here: https://www.bleepingcomputer.com/news/security/new-meta-information-stealer-distributed-in-malspam-campaign/

Mirai malware now delivered using Spring4Shell exploits

Security researchers have observed a Mirai botnet variant successfully using CVE-2022-22965 ("Spring4Shell") to attack vulnerable web servers in Singapore. Administrators should upgrade to Spring Framework 5.3.18 and 5.2.20, and also Spring Boot 2.5.12 or later, to prevent such attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/mirai-malware-now-delivered-using-spring4shell-exploits/

Russia's space programme hit by western cyber attack

According to data obtained by security experts, hacker group Network Battalion 65 (NB65) used the encryption code of Russian ransom program Conti to hack the country’s space agency.

See the full report here: https://www.telegraph.co.uk/business/2022/04/11/russias-space-programme-hit-western-cyber-attack/

Panasonic’s Canadian operations hit by cyberattack – TechCrunch

Panasonic disclosed a “targeted cybersecurity attack” that happened in February that affected some of the systems, processes, and networks of its Canada operations.

See the full report here: https://techcrunch.com/2022/04/11/panasonic-canada-ransomware/

BlackCat ransomware group claims attack on Florida International University

After attacking the North Carolina A&T University, BlackCat (ALPHV) ransomware group claims Florida International University as their latest victim.

See the full report here: https://therecord.media/blackcat-ransomware-group-claims-attack-on-florida-international-university/

This Android Malware Can Hijack Phone Calls to Customer Support

Security researchers uncover a strain of Android malware, dubbed FakeCalls, which can secretly reroute the user's banking phone calls to cybercriminals in the guise of customer support.

See the full report here: https://www.pcmag.com/news/this-android-malware-can-hijack-phone-calls-to-customer-support

Luxury fashion house Zegna confirms August ransomware attack

Italian fashion house Zenga conceded that the "unauthorized access" it noted in its IT systems in August 2021 was a ransomware attack. No negotiations or payment happened, added the company.

See the full report here: https://www.bleepingcomputer.com/news/security/luxury-fashion-house-zegna-confirms-august-ransomware-attack/

CISA adds WatchGuard flaw to its Known Exploited Vulnerabilities Catalog

Eight actively exploited bugs have been added to the US Cybersecurity & Infrastructure Security Agency's catalog of known exploited vulnerabilities. The list include the flaws in WatchGuard Firebox and XTM appliances.

See the full report here: https://securityaffairs.co/wordpress/130112/security/cisa-watchguard-flaw-known-exploited-vulnerabilities-catalog.html

Critical LFI Vulnerability Reported in Hashnode Blogging Platform

Researchers have disclosed a previously undocumented local file inclusion (LFI) vulnerability in Hashnode, a developer-oriented blogging platform. The bug has been patched by Hashnode. Local file inclusion flaws occur when a web application is tricked into exposing or running unapproved files on a server.

See the full report here: https://thehackernews.com/2022/04/critical-lfi-vulnerability-reported-in.html

XSS vulnerability patched in Directus data engine platform

A cross-site scripting (XSS) vulnerability (CVE-2022-24814), which can lead to account compromise, has been patched in the Directus engine. Directus is an open source, modular content management system (CMS) that can be used to wrap SQL databases with GraphQL and REST APIs.

See the full report here: https://www.zdnet.com/article/xss-vulnerability-patched-in-directus-data-engine-platform/

NGINX Shares Mitigations for Zero-Day Bug Affecting LDAP Implementation

The maintainers of the NGINX web server project have issued mitigations to address security weaknesses in its Lightweight Directory Access Protocol (LDAP) Reference Implementation. NGINX Open Source and NGINX Plus are not themselves affected, but the reference implementation, which uses LDAP to authenticate users, is impacted under three specific conditions.

See the full report here: https://thehackernews.com/2022/04/nginx-shares-mitigations-for-zero-day.html

AWS fixes local file vuln on internal credential access for Relational Database Service

Amazon Web Services (AWS) has fixed a bug that could be exploited to allow an attacker to gain access to internal AWS credentials. While no in-the-wild attacks exploited the bug, AWS confirmed that it gave researchers access to internal credentials that were specific to their Aurora cluster.

See the full report here: https://www.theregister.com/2022/04/12/aws_rds_vuln/

Microsoft April 2022 Patch Tuesday fixes 119 flaws, 2 zero-days - BleepingComputer

Microsoft has fixed 119 bugs (of which 10 are marked Critical) in the April 2022 Patch Tuesday. The batch includes fixes for two zero-day vulnerabilities (CVE-2022-26904 and CVE-2022-24521).

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2022-patch-tuesday-fixes-119-flaws-2-zero-days/

Atlassian says ongoing outage might last two more weeks - BleepingComputer

Atlassian has estimated that it might take two more weeks to restore all customer instances impacted by a week-long ongoing outage affecting its cloud services. The company stated that it was able to restore functionality for more than 35% of all users directly hit by this ongoing outage, with no reported data loss.

See the full report here: https://www.bleepingcomputer.com/news/technology/atlassian-says-ongoing-outage-might-last-two-more-weeks/

Qbot malware switches to new Windows Installer infection vector - BleepingComputer

The Qbot botnet is attempting to deploy malware payloads via phishing emails with password-protected ZIP archive attachments containing malicious MSI Windows Installer packages. Security researchers suspect this move might be a reaction to Microsoft announcing plans to kill malware delivery via VBA Office macros.

See the full report here: https://www.bleepingcomputer.com/news/security/qbot-malware-switches-to-new-windows-installer-infection-vector/

Google Sues Scammer for Running 'Puppy Fraud Scheme' Website

Google has announced legal action against a scammer who used fraudulent websites and accounts to sell basset hound puppies – for indulging in "international non-delivery scams."

See the full report here: https://thehackernews.com/2022/04/google-sues-scammer-for-running-puppy.html

E.U. Officials Reportedly Targeted with Israeli Pegasus Spyware

At least five European Union officials were reportedly targeted with the NSO Group's Pegasus surveillance tool. The NSO Group denied the report, adding that the targeting could not have happened with NSO's tools.

See the full report here: https://thehackernews.com/2022/04/eu-officials-reportedly-targeted-with.html

Russian Group Sandworm Foiled in Attempt to Disrupt Ukraine Power Grid

The Sandworm group had tried to attack an energy company in Ukraine using a new, customized version of Industroyer – a malware tool that was used to cause a power outage in Kyiv in 2016. Following the foiled attack, CERT-UA (Ukraine's computer emergency response team) has distributed indicators of compromise and other attack artifacts to energy companies in Ukraine.

See the full report here: https://www.darkreading.com/attacks-breaches/-russian-group-sandworm-s-attempt-to-disrupt-ukraine-power-grid-foiled

RaidForums hacking forum seized by police, owner arrested

Law enforcement officials have shut down the RaidForums hacker forum, which offered for sale more than 10 billion unique records from hundreds of stolen databases. Three domains hosting RaidForums have also been seized.

See the full report here: https://www.bleepingcomputer.com/news/security/raidforums-hacking-forum-seized-by-police-owner-arrested/

Critical HP Teradici PCoIP flaws impact 15 million endpoints

HP has disclosed ten vulnerabilities, of which three are of critical severity (CVSS v3 score: 9.8), eight of high severity, and one medium. The bugs are associated with the Teradici PCoIP client and agent for Windows, Linux, and macOS and impact 15 million endpoints. Teradici PCoIP (PC over IP) is a proprietary remote desktop protocol licensed to many virtualization product vendors.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-hp-teradici-pcoip-flaws-impact-15-million-endpoints/

Microsoft: New malware uses Windows bug to hide scheduled tasks

The state-sponsored threat actor HAFNIUM is using unpatched Windows zero-day bugs as initial vectors as well as defense evasion malware called Tarrask to create "hidden" scheduled tasks. These "hidden" scheduled tasks are used to maintain access to the hacked devices even after reboots.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-new-malware-uses-windows-bug-to-hide-scheduled-tasks/

CitySprint confirms security breach, warns delivery drivers their personal data may be in the hands of hackers

CitySprint has reportedly suffered a data breach that may have allowed hackers to access couriers' sensitive personal data. CitySprint, a same-day delivery firm, uses self-employed drivers to deliver packages.

See the full report here: https://grahamcluley.com/citysprint-confirms-security-breach-warns-delivery-drivers-their-personal-data-may-be-in-the-hands-of-hackers/

U.S. Warns of APT Hackers Targeting ICS/SCADA Systems with Specialized Malware

The U.S. government issued an advisory that warned of nation-state actors deploying specialized malware to maintain access to industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices. The custom-made tools are specifically designed to single out Schneider Electric programmable logic controllers (PLCs), OMRON Sysmac NEX PLCs, and Open Platform Communications Unified Architecture (OPC UA) servers.

See the full report here: https://thehackernews.com/2022/04/us-warns-of-apt-hackers-targeting.html

Critical Apache Struts RCE vulnerability wasn't fully fixed, patch now - BleepingComputer

Apache has fixed a critical vulnerability (CVE-2021-31805) in its Struts project that was previously believed to have been resolved but wasn't fully remedied. Struts is an open-source application development framework used by Java web developers for building model–view–controller (MVC) apps. Organizations should upgrade to Struts2 version 2.5.30 (or greater), which fixes the critical OGNL Injection vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-apache-struts-rce-vulnerability-wasnt-fully-fixed-patch-now/

New Fodcha DDoS botnet targets over 100 victims every day - BleepingComputer

Fodcha – a rapidly growing botnet – has spread to over 62,000 devices between March 29 and April 10. It is abusing routers, DVRs, and servers across the Internet to target more than 100 victims every day in distributed denial-of-service (DDoS) attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/new-fodcha-ddos-botnet-targets-over-100-victims-every-day/

Apple emergency update fixes zero-days used to hack iPhones, Macs - BleepingComputer

Apple has released security updates to address two zero-day vulnerabilities that are being exploited by attackers. The two flaws are an out-of-bounds write issue (CVE-2022-22674) in the Intel Graphics Driver and an out-of-bounds read issue (CVE-2022-22675) in the AppleAVD media decoder.

See the full report here: https://www.bleepingcomputer.com/news/security/apple-emergency-update-fixes-zero-days-used-to-hack-iphones-macs/

Hackers exploit critical VMware CVE-2022-22954 bug, patch now - BleepingComputer

A proof-of-concept exploit has been released online for the VMware remote code execution vulnerability tracked as CVE-2022-22954. The critical vulnerability impacting VMware Workspace ONE Access and VMware Identity Manager is being actively exploited in the wild. VMware has released security updates and workaround instructions for the affected products.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-vmware-cve-2022-22954-bug-patch-now/

Critical flaw in Elementor WordPress plugin may affect 500k sites - BleepingComputer

A critical remote code execution flaw has been patched in version 3.6.3 of the Elementor Website Builder plugin for WordPress. Security researchers have identified and published a proof of concept (PoC) for the bug that may impact as many as 500,000 websites.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-flaw-in-elementor-wordpress-plugin-may-affect-500k-sites/

New EnemyBot DDoS botnet recruits routers and IoTs into its army - BleepingComputer

A threat actor named Keksec is deploying a new Mirai-based botnet malware – Enemybot. Enemybot features string obfuscation while its C2 server hides behind Tor nodes, so mapping it and taking it down is quite challenging.

See the full report here: https://www.bleepingcomputer.com/news/security/new-enemybot-ddos-botnet-recruits-routers-and-iots-into-its-army/

CISA warns orgs to patch actively exploited Windows LPE bug - BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) has added ten new security bugs to its list of actively exploited vulnerabilities, including a high severity local privilege escalation bug (CVE-2022-24521) in the Windows Common Log File System Driver. All Federal Civilian Executive Branch Agencies (FCEB) agencies must patch this bug by May 2.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-to-patch-actively-exploited-windows-lpe-bug/