Malware Devil

How the Rapid Shift to Remote Work Impacted IT Complexity and Post-Pandemic Security Priorities

More Insights

Webcasts

SASE: The Right Framework for Today’s Distributed Enterprises

10 Must-Have Capabilities for Stopping Malicious Automation Checklist

White Papers

2020 SANS Enterprise Cloud Incident Response Survey

Reports

The post DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack appeared first on Malware Devil.

https://malwaredevil.com/2021/04/13/dns-vulnerabilities-expose-millions-of-internet-connected-devices-to-attack/?utm_source=rss&utm_medium=rss&utm_campaign=dns-vulnerabilities-expose-millions-of-internet-connected-devices-to-attack

Enfrentando os desafios de segurança de rede usando as soluções de ITOM da ManageEngine

O gerenciamento de segurança de rede normalmente envolve a gestão ponta a ponta de toda a infraestrutura de segurança de rede em uma empresa. No entanto, neste ecossistema em rápida mudança, há uma necessidade inerente de os administradores de TI …

The post Enfrentando os desafios de segurança de rede usando as soluções de ITOM da ManageEngine appeared first on ManageEngine Blog.

The post Enfrentando os desafios de segurança de rede usando as soluções de ITOM da ManageEngine appeared first on Security Boulevard.

The post Enfrentando os desafios de segurança de rede usando as soluções de ITOM da ManageEngine appeared first on Malware Devil.

https://malwaredevil.com/2021/04/13/enfrentando-os-desafios-de-seguranca-de-rede-usando-as-solucoes-de-itom-da-manageengine/?utm_source=rss&utm_medium=rss&utm_campaign=enfrentando-os-desafios-de-seguranca-de-rede-usando-as-solucoes-de-itom-da-manageengine

NSA Alerted Microsoft to New Exchange Server Vulnerabilities

Microsoft today patched 114 CVEs to address the Exchange Server flaws, more than 50 remote code execution vulnerabilities, and one zero-day.

Microsoft today issued fixes for 114 vulnerabilities as part of its monthly security update release, which this month addressed 19 critical flaws, four critical Microsoft Exchange Server bugs found by the National Security Agency (NSA), and one zero-day bug in Desktop Window Manager.

The patches released today address flaws in Microsoft Windows, the Edge browser, Microsoft Office, Azure and Azure DevOps Server, Exchange Server, SharePoint Server, Hyper-V, Visual Studio, and Team Foundation Server. None of the bugs were disclosed at the recent Pwn2Own.

CVE-2021-28310, a Win32k elevation of privilege vulnerability, is the only CVE under active attack patched this month. Kaspersky researchers who found it believe it’s potentially being used in the wild by several attackers. They note it’s likely used with other browser exploits to escape sandboxes or achieve system privileges; however, they did not capture a full chain so are unable to confirm the full attack sequence.

Attack complexity for this vulnerability is low, according to Microsoft, and it requires low-level privileges. An attacker would have to access the target system locally or remotely, or rely on a user to run the malicious code for them.

Today’s patches also addressed four critical remote code execution vulnerabilities in Microsoft Exchange Server: CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, and CVE-2021-28483. All of these were discovered by the NSA and affect Exchange Server versions 2013 through 2019.

CVE-2021-28480 and CVE-2021-28481 have a CVSS score of 9.8 and require no authorization or user interaction to exploit. Dustin Childs of Trend Micro’s Zero-Day Initiative notes this CVSS score is higher than the scores for the Exchange Server vulnerabilities disclosed last month, and given that Microsoft lists the attack vector as “Network,” it’s likely they are wormable – at least between Exchange Servers. Considering they came from the NSA, patching should be a priority.

“We have not seen the vulnerabilities used in attacks against our customers,” Microsoft says of the on-premise Exchange Server flaws patched today. “However, given recent adversary focus on Exchange, we recommend customers install the updates as soon as possible to ensure they remain protected from these and other threats.” Exchange Online users are already protected.

Microsoft has also identified a whopping 27 remote code execution flaws in Remote Procedure Call, a protocol that lets a program request service from a program on another machine in the same network. Of these, 12 are rated as Critical and 15 are categorized at Important in severity.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial … View Full Bio

Recommended Reading:

How the Rapid Shift to Remote Work Impacted IT Complexity and Post-Pandemic Security Priorities

More Insights

Webcasts

SASE: The Right Framework for Today’s Distributed Enterprises

10 Must-Have Capabilities for Stopping Malicious Automation Checklist

White Papers

2020 SANS Enterprise Cloud Incident Response Survey

Reports

Cybersecurity Risk Management FREE Event 4/22
Using MS Teams as Your Phone System – FREE Event 4/14
Earn (ISC)2 CPEs at Interop Digital, April 29

The post NSA Alerted Microsoft to New Exchange Server Vulnerabilities appeared first on Malware Devil.

https://malwaredevil.com/2021/04/13/nsa-alerted-microsoft-to-new-exchange-server-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=nsa-alerted-microsoft-to-new-exchange-server-vulnerabilities

Compromised Microsoft Exchange Server Used to Host Cryptominer

Subscribe to Newsletters

More Informa Tech Live Events

White Papers

What Elite Threat Hunters See That Others Miss: Case Study

Are We Cyber-Resilient? The Key Question Every Organization Must Answer

10 Must-Have Capabilities for Stopping Malicious Automation Checklist

SANS 2021 Cyber Threat Intelligence Survey

Cybersecurity Report Card

Video

All Videos

Cartoon

How the NAME:WRECK Bugs Impact Consumers, Businesses

How this class of vulnerabilities will impact millions connected devices and potentially wreck the day of IT security professionals.
Read More

The post How the NAME:WRECK Bugs Impact Consumers, Businesses appeared first on Malware Devil.

https://malwaredevil.com/2021/04/13/how-the-namewreck-bugs-impact-consumers-businesses/?utm_source=rss&utm_medium=rss&utm_campaign=how-the-namewreck-bugs-impact-consumers-businesses

10 Must-Ask Questions When Choosing a SOAR Solution in 2021

The adoption of security orchestration, automation and response (SOAR) platforms has grown significantly in recent years. Countless end-user and service…

The post 10 Must-Ask Questions When Choosing a SOAR Solution in 2021 appeared first on Siemplify.

The post 10 Must-Ask Questions When Choosing a SOAR Solution in 2021 appeared first on Security Boulevard.

The post 10 Must-Ask Questions When Choosing a SOAR Solution in 2021 appeared first on Malware Devil.

https://malwaredevil.com/2021/04/13/10-must-ask-questions-when-choosing-a-soar-solution-in-2021/?utm_source=rss&utm_medium=rss&utm_campaign=10-must-ask-questions-when-choosing-a-soar-solution-in-2021

Global Dwell Time Drops as Ransomware Attacks Accelerate

The length of time attackers remain undiscovered in a target network has fallen to 24 days, researchers report, but ransomware plays a role.

Attackers are spending less time inside target networks, researchers report, but the seemingly positive trend hides a concerning development: Ransomware attacks, which by nature have a shorter “dwell time,” are growing more common and efficient, shrinking the average time frame for all attacks.

In their 2021 M-Trends threat report, Mandiant researchers note the global median dwell time, or the number of days an attacker is in an environment before detection, has fallen to 24 days. While median dwell time has consistently dropped from 416 days in 2011, this year’s number marks a notable drop, says Steven Stone, senior director of advanced practices at Mandiant.

“Half the dwell time went away compared to last year,” he notes. The 2020 M-Trends report found a global median dwell time of 56 days, making this year’s number “a significant drop.”

This decline could be explained by several factors, including continued improvement in threat detection capabilities, new policies, and higher security budgets. However, the attack landscape plays a critical role. As dwell time dropped last year, the number of ransomware cases rose: Twenty-five percent of Mandiant investigations involved ransomware, a sharp increase from 14% in 2019.

A breakdown of dwell time by attack type is more telling. The median dwell time for non-ransomware investigations was 45 days; for ransomware investigations, it was only five. These metrics combined brought the global median dwell time down to its new low of 24 days.

As researchers see more ransomware, they expect dwell time to continue shrinking. After all, the attackers deploying ransomware don’t want to remain hidden for very long.

“We’re seeing ransomware intrusions … move to ransomware much, much quicker than we have in previous years,” Stone points out. “We think that’s clearly a contributing factor.”

In the past, ransomware operators would try to get into a target environment and typically spend more time trying to understand it before deploying ransomware at the end. Now they move quickly through the attack cycle. Many have adopted the technique of “multifaceted extortion,” in which they also threaten to publish stolen data if the ransom isn’t paid in time.

It seems attackers are growing more comfortable with ransomware compared with other forms of monetization. This, combined with increasingly higher payouts, is bad news for defenders. Today’s ransomware operators are growing more comfortable with negotiating higher sums.

“We talk about intrusion like it’s a machine, but it’s ultimately people, and people tend to do what they’re most comfortable with,” Stone explains. “They need a mechanism to monetize the intrusion, and as they’re learning more and more about how to do that with ransomware year over year, they’re getting more comfortable in that space.”

What Else Is In Attackers’ Toolkits?
Of course, ransomware isn’t the only threat Mandiant researchers investigated last year. Their responses to a range of security intrusions yielded several observations, including a preference for exploits (29%) over phishing attacks (23%) as an initial infection vector. Other common vectors included stolen credentials or brute force (19%) along with prior compromise (12%).

“It definitely sticks out to us,” Stone says of the rise in exploits. “If anything, we’re seeing that trend accelerate currently.” Researchers are already two full quarters into what will be the next M-Trends report, “and we’re actually seeing more exploits than we did when we wrote this report.”

There was a time when exploits were dominant, he explains, but they began to trend down as phishing attacks grew. Now “they’re back with a vengeance,” he says. While researchers aren’t sure what’s driving the trend, Stone notes that exploit usage is different than it was in the past. More exploits are continuously dropping, and there are more groups taking advantage of them.

“In the past we would typically see an exploit targeted by one high-end group … now you’ll see an exploit, and you’ll see a range of groups in a very quick time frame either using that or converting that once it goes public,” he adds.

The presence of offensive security tools in attackers’ arsenals was another dominant trend. Beacon, a backdoor commercially available as part of the Cobalt Strike platform, was seen in 24% of incidents. Empire, a publicly available PowerShell post-exploitation framework, was seen in 8%. Rounding out the top five were Maze ransomware (5%), Netwalker ransomware (4%), and the Metasploit pen-testing platform (3%).

When they aren’t using publicly available tools, attackers are relying on privately developed ones: Seventy-eight percent of malware families used in attacks were private; the rest =were public. The trend is consistent across the most advanced groups and lesser-skilled attackers, Stone explains. Many of these tools are easy to use, lowering the cost of entry and empowering attackers.

“We’re seeing a number of lower-level skillset groups deploy custom malware along with these public tools,” he says. “That makes incident response very challenging, and I think organizations need to be prepared for that.”

One of the groups using Cobalt Strike Beacon is UNC2452, the name Mandiant has given to the group behind the supply chain attack that involved an implant in SolarWinds’ Orion platform. This is “arguably the most advanced group we’ve ever dealt with,” Stone says, and the fact it’s deploying Beacon is very concerning.

While organizations face new threats, the process of preparing for these types of attacks hasn’t changed, he continues.

“Be prepared for an intrusion. Be prepared to make smart decisions based on the actual threats you’re seeing,” says Stone.

An attack from a group like UNC2452 and a ransomware attack are very different intrusions, he says, and organizations must respond and remediate differently. They have to be able to make the right call for a particular threat, versus a “one-size-fits-all” approach.

Recommended Reading:

Cybersecurity Risk Management

More Insights

Webcasts

Advancing the Hybrid Cloud & App Modernization Journey with IBM

What Elite Threat Hunters See That Others Miss: Case Study

White Papers

The Top 5 Mistakes Everyone is Making in Vulnerability Remediation

Reports

The post Global Dwell Time Drops as Ransomware Attacks Accelerate appeared first on Malware Devil.

https://malwaredevil.com/2021/04/13/global-dwell-time-drops-as-ransomware-attacks-accelerate/?utm_source=rss&utm_medium=rss&utm_campaign=global-dwell-time-drops-as-ransomware-attacks-accelerate

COVID-Related Threats, PowerShell Attacks Lead Malware Surge

Researchers measured 648 new malware threats every minute during Q4 2020.
Read More

The post COVID-Related Threats, PowerShell Attacks Lead Malware Surge appeared first on Malware Devil.

https://malwaredevil.com/2021/04/13/covid-related-threats-powershell-attacks-lead-malware-surge/?utm_source=rss&utm_medium=rss&utm_campaign=covid-related-threats-powershell-attacks-lead-malware-surge

Introducing ThycoticCentrify: Integrating Two Identity Security Leaders

By Art Gilliland and Jim Legg

Today, we are pleased to share that Centrify and Thycotic have merged to become one. This follows on the previously-announced acquisitions of Centrify and Thycotic by TPG Capital. We are now able to embark on the process of integrating our businesses and solutions to better serve our customers and partners.

As we’ve previously reinforced, our customers are our highest priority. We’re confident that this combination will enable us to better serve you through an enhanced and diversified product suite – a comprehensive platform uniquely built to enable and protect the modern, hybrid enterprise.

In the near-term, our customers can expect no changes or impact on their relationship with Thycotic or Centrify. Both companies will continue to operate in a “business-as-usual” mode as we begin the integration process. All products are still accessible, and our customers can expect the same great support and service that they have always known from our teams.

Likewise, our partners are vital to our success, and we believe that the combined company and solutions will create a more valuable and attractive offering to solve the modern identity security needs in the market. Again, “business as usual” is the current mindset, and you will continue to work with Centrify and Thycotic as separate partners. We are committed to keeping you apprised of the integration, the technology roadmap and integration, and the go-to-market strategy.

This is a very exciting time for all of us, and the opportunity before us is tremendous. Merging two companies is not easy, but we have a talented team in place to execute on our strategy. We have built out a comprehensive integration plan that will help to ensure success and hold us accountable to you and our teams.

During this transition we feel it is important to provide as much transparency as possible into the integration process, so starting today you will find Merger Status Update pages on both Thycotic.com and Centrify.com. These will be regularly updated with information regarding operations, technology integration, go-to-market, and more. You can already find links to an external FAQ, a joint blog, this morning’s press release, and more on those pages.

As part of the integration plan, we have also chosen a new temporary name: ThycoticCentrify.

This new name will be used in the interim period between now and when we launch our new brand later this year. Until then, for the most part, both brands will continue to operate separately. Over the next few months, we will take an informed approach to defining a new brand that is aspirational, references the rich legacies of both companies, and communicates modern identity security.

The post Introducing ThycoticCentrify: Integrating Two Identity Security Leaders appeared first on Security Boulevard.

The post Introducing ThycoticCentrify: Integrating Two Identity Security Leaders appeared first on Malware Devil.

https://malwaredevil.com/2021/04/13/introducing-thycoticcentrify-integrating-two-identity-security-leaders/?utm_source=rss&utm_medium=rss&utm_campaign=introducing-thycoticcentrify-integrating-two-identity-security-leaders

Thycotic and Centrify Merge to Become a Leading Cloud Privileged Identity Security Vendor

Combined company to deliver comprehensive cloud privileged access management solutions to meet unique demands of the market, from SMB to global enterprises

The post Thycotic and Centrify Merge to Become a Leading Cloud Privileged Identity Security Vendor appeared first on Security Boulevard.

The post Thycotic and Centrify Merge to Become a Leading Cloud Privileged Identity Security Vendor appeared first on Malware Devil.

https://malwaredevil.com/2021/04/13/thycotic-and-centrify-merge-to-become-a-leading-cloud-privileged-identity-security-vendor/?utm_source=rss&utm_medium=rss&utm_campaign=thycotic-and-centrify-merge-to-become-a-leading-cloud-privileged-identity-security-vendor

Dark Reading to Upgrade Site Design, Performance

Improvements will make site content easier to navigate, faster, and more functional.

Dark Reading will look different to readers in the days ahead, and that’s a good thing.

In an effort to improve the reader experience, Dark Reading has embarked on a broad initiative to improve the design, navigation, functionality, and performance of its entire site. In coming months, readers will see new page design, new navigation tools, new links to related content, and new capabilities across the Dark Reading site. We hope that these improvements will make it easier for readers to find the cybersecurity information they need, locate related information, and use Dark Reading’s content on mobile devices more effectively.

If you’re a loyal reader of Dark Reading, you’ll see the same great news, commentary, and in-depth information, but with a new look and feel. Our pages will be better organized, easier to read, and will load faster. You’ll see new navigation elements that make it easier to find the stories you’re looking for. You’ll see new links to Dark Reading’s many cybersecurity programs, including webinars, virtual events, original research, white papers, and e-zines. And you’ll discover that Dark Reading content is easier to see and read on mobile devices, making it more useful to you when you’re at home or on the go.

While we know that these improvements will make your experience much better in the long term, like all home improvement projects, it’s likely that there will be a few glitches or hiccups as we implement these new features and capabilities on Dark Reading in the coming months. We want to thank you for your patience as you experience the occasional glitch, and invite you to provide feedback on our new design and features. Some of our new features will offer a pop-up survey, which we hope you’ll answer. Or you can write us an email at [email protected].

We are excited about our new design and capabilities, and we hope they make Dark Reading even more helpful and useful to you. Please feel free to offer your feedback!

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech’s online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one … View Full Bio

Recommended Reading:

Managing a Hybrid Cloud Infrastructure

More Insights

Webcasts

Advancing the Hybrid Cloud & App Modernization Journey with IBM

What Elite Threat Hunters See That Others Miss: Case Study

White Papers

2020 SANS Enterprise Cloud Incident Response Survey

Reports