Threat Intelligence Bulletin: 12/09/2022

The Underground Economist: Volume 2, Issue 22

Welcome back to The Underground Economist, Volume 2, Issue 22, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of November 23, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

The Underground Economist: Volume 2, Issue 23

Welcome back to The Underground Economist, Volume 2, Issue 23, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of December 9, 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

Microsoft Patch Tuesday 12/14/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may affect our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights:

Microsoft's Patch Tuesday update for December 2022 involved 48 vulnerabilities in total, with:

6 vulnerabilities classified as Critical
40 vulnerabilities classified as High, and
2 zero-day vulnerabilities, one of which is being actively exploited

(Microsoft defines a critical vulnerability as one whose exploitation could allow code execution without user interaction.)

Most notable vulnerabilities

This month’s security updates include patches for two zero-day bugs: CVE-2022-44698 (Windows SmartScreen Security Feature Bypass Vulnerability, which is being actively exploited in the wild) and CVE-2022-44710 (DirectX Graphics Kernel Elevation of Privilege Vulnerability).

Microsoft also issued patches for other notable bugs such as CVE-2022-41076, CVE-2022-41127, and CVE-2022-44690.

CVE-2022-44698

CVE-2022-44698 (CVSS score: 5.4) is a zero-day vulnerability affecting Windows SmartScreen. Microsoft has released patches for the issue for affected Windows versions starting from Windows 7 and Windows Server 2008 R2. A victim can be lured to visit an infected site or open an attachment in order to bypass the SmartScreen. As this issue is still being exploited in the wild, admins should pay special attention to this patch.