IT News

Mozilla has issued a critical patch for Firefox, Firefox ESR, and Thunderbird after a security issue was discovered at the Tianfu Cup 2020 International Cybersecurity Contest

The security issue has been assigned CVE-2020-26950 which has the “reserved” status. Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) list—a dictionary that provides definitions for publicly disclosed cybersecurity vulnerabilities and exposures. The goal of CVE is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services).

What is the problem that’s being fixed?

The description Mozilla published itself reveals that write side effects in MCallGetProperty opcode were not accounted for. In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition.

Use-after-free is a naming convention for vulnerabilities related to the incorrect use of dynamic memory during an operation by a program. It means that after freeing a memory location, a program does not clear the pointer to that memory, which could allow an attacker to abuse the error and launch a buffer overflow attack. In a “worst case” scenario this could allow for a remote code execution (RCE) attack, but whether that is true in this case is unknown at the moment.

Which versions are vulnerable?

Make sure you are on the latest versions of the following:

• Firefox should be updated to version 82.0.3 or later
• Firefox ESR (Extended Support Release) should be updated to version 78.4.1 or later
• Thunderbird should be updated to 78.4.2

Firefox Extended Support Release (ESR) is a version of the popular browser for large organizations that need to deploy and maintain Firefox at a large scale. It does not have all the latest functions, to limit the number of updates, but it does receive security and stability updates.

How do I check my version and update?

To find out which version you are using on a Windows machine, open the application menu and click on Help > About. On a Mac, look at the top menu and click Firefox > About Firefox. This will show which version you currently have and whether an update is available.

The screens and the way to access are largely the same for all the Mozilla programs, so we will only show the Firefox example.

After the update you should see a screen similar to this:

The next stable version of Firefox will be released on November 17, 2020.

Stay safe, everyone!

The post Mozilla patches critical security issues in Firefox and Thunderbird appeared first on Malwarebytes Labs.

This week on Lock and Code, we offer something special for listeners—a backstage pass to a cybersecurity training that we held for employees during Cybersecurity Awareness Month, which ended in October.

The topic? The future of cybersecurity for the Internet of Things.

Our guests, Chief Information Security Officer John Donovan and Security Evangelist and a Director for Malwarebytes Labs Adam Kujawa guide us through some of the future’s most pressing questions. Will we ever run antivirus software on IoT devices? What predictions can we make for how the cybersecurity industry will respond to the next, possible big IoT attack? And what can we do today to stay safe?

This episode was recorded live in front of our fellow Malwarebytes employees (over Zoom, of course, as is tradition during the coronavirus pandemic). The episode even includes a Q&A with our employees.

Tune in to get a glimpse into how Malwarebytes helped its own employees during Cybersecurity Awareness Month, on the latest episode of Lock and Code, with host David Ruiz.

You can also find us on the Apple iTunes store, Google Play Music, and Spotify, plus whatever preferred podcast platform you use.

We cover our own research on:

• Hospital ransomware, because scammers have gone back to targeting things they really shouldn’t be.
• Retirement announcements, though perhaps not in the way you might expect.
• Updating is good, and updating to protect against zero-days is even better.
• Trojans and US elections? Oh my.
• If you’re in California then data privacy laws are changing. Find out how.
• Everything you ever wanted to know about RegTech but were too scared to ask.
• In a big week for patching, Apple has a little updating of their own to do.

Other cybersecurity news

• Ransomware isn’t kid’s stuff: Toy maker Mattel discloses a ransomware attack (Source: ZDNet)
• It’s a trap: what happens when a tech support scammer manages to dial through to a law enforcement cybercrime squad? (Source: The Register)
• Getting bored with ad fraud: What are some of the ways you can nip this problem in the bud? (Source: Help net Security)
• Fake Elon and his Bitcoin: The age-old Twitter problem resurfaces once again (Source: International Business Times)
• Game makers compromised: Gaming giants Capcom reveal they’ve been the target of a cyberattack (Source: BBC)

Stay safe, everyone!

The post Lock and Code S1Ep19: Forecasting IoT cybersecurity with John Donovan and Adam Kujawa appeared first on Malwarebytes Labs.

Every organization in the financial industry needs to meet certain regulatory obligations, even if it’s just filing a tax return or submitting an annual report. In certain industries, such as financial services, they’ve added their own additional sets of rules that must be adhered to. For example, organizations who take and process credit card payments have an obligation to meet the Payment Card Industry Data Security Standard (PCI DSS).

To make keeping up with new regulations easier, financials are turning to RegTech. RegTech is the contraction of the words Regulatory Technology. In the financial word it is one of the hot topics. What is it and why is it so popular? Read on.

What is RegTech?

By definition, RegTech is an innovative technology that enables organizations to effortlessly adjust to the weight of always expanding needs for regulatory reporting. In essence, RegTech providers are an industry within the financial industry that provides other members of the financial world with the technology that helps them to stay current with ever-changing rules and regulations.

The wins for the users of RegTech consist mainly of these elements:

• Gain efficiency by streamlining and harmonizing processes within the organization.
• Reporting of compliance and issues is made easier by prefabricated, but often customized, modules.
• Risk can be identified and countered quicker by using smart technology.

To achieve these goals, RegTech uses 5 different types of technology:

• Monitoring processes to obtain a real-time objective about what is going on in the organization. This is essential for reporting and risk identification goals.
• Reporting is often a mandatory part of new regulations and, by constant monitoring, the required reports can be produced at the touch of a button.
• Data exchange is another part of many new regulations, specifically those that help startups on their way. Technology to enable and monitor the exchange of data helps to comply with these regulations while keeping an eye on data streams.
• Internal legal departments are supported with tools to make the implementation of new regulations more efficient and thus cheaper.
• Automation is introduced where possible to avoid human mistakes. The jungle of regulations can easily lead to human error. Monitoring and streamlining can help to avoid such errors. Reporting will have to record them if they should occur, nonetheless. And corrections can be applied where needed.

What makes RegTech so popular?

At one point, the financial industry was under a lot of stress due to new regulations. Depending on the country financials are working from and the regions they plan to do business with, the range of regulations they have to comply with can be challenging. RegTech helps financials to respond in a cost-efficient and versatile way, while maintaining a high standard of quality and security.

How does Regtech work?

This is a very hard question to answer as developments are happening at a fast pace. Every new regulation creates opportunities for the RegTech companies to work on new technology and offer it to banks, financial institutions and FinTech companies. On the other side, RegTech companies supply the supervisory agencies that lay down the rules and regulations with the technology to check compliance by the constituents. This branch is sometimes referred to as SupTech.

For example, by combining Artificial Intelligence (AI) and Big Data it is possible to predict suspicious behavior by monitoring transactions in real-time and scanning for irregularities. This technology will pick up the signals much sooner than any human possibly can, and helps to find patterns indicating money laundering and terrorist funding.

Security implications of RegTech

Many of the regulations are laid down with privacy and security in mind. A correct implementation of these regulations should not pose a problem in this field. On the contrary, if the regulators are accomplishing what they set out to do, these regulations should lift the privacy and security demands to a higher level.

Also, implementation of RegTech gives the in-house security teams at financial organizations the opportunity to focus on other issues as the technology takes over one part of their job. This doesn’t mean internal teams should let go of the process entirely, even though that might sound appealing as they often have a lot of other things on their plate, but it should ease the burden somewhat.

It’s not only necessary to measure the effectiveness of your organization’s security controls against the regulations, but also to check whether new and anticipated legislation does not interfere with your existing security standards. An obligation to offer information to your competitors should not reduce your defenses against a data breach. The Know Your Customer (KYC) documentation not only authenticates the customer’s credentials but also helps maintain a verified record of customers. Regulatory compliance mechanisms like the KYC registry store extremely sensitive personally identifiable information (PII) and elaborate customer data. So, it is important to devise systems that prevent unauthorized access, minimize cyber risks, and limit the possible consequences of a data breach.

Risk and compliance functions use different methods to keep up with regulatory challenges. They use software as a service (SaaS) in the cloud to identify risks, strategize risk tolerance, and facilitate regulatory requirements across various regions and financial services.

How does RegTech provide data security and privacy?

There are some key areas where RegTech contributes to keep our data safe:

• Fraud prevention. Information provided by criminals can be checked against existing KYC data. This helps to prevent identity theft and abuse of stolen data.
• Money laundering and terrorist funding are other areas that are monitored by using KYC data.
• Compliance with national regulations. On top of worldwide and business standards you will often find local standards are applied.
• Cloud security tools to keep data stored in the cloud at the same safety level as locally stored data.
• Authentication methods to ensure a high level of security. For example, multi-factor authentication (MFA) methods, cryptography, and encryption.

As more and more business collect PII, customers are concerned about their personal data security and their privacy. And as cybercriminals get more sophisticated, the need for more advanced and effective tools has risen. RegTech companies provide an important part of this new technology for the financial industry.

The post RegTech explained: a crucial toolset for the financial industry appeared first on Malwarebytes Labs.

Apple has patched three vulnerabilities in iOS (and iPadOS) that were actively being exploited in targeted attacks. Vulnerabilities that are being exploited in the wild without a patch being available are referred to as zero-days. The vulnerabilities were found and disclosed by Google’s Project Zero team, and patches were issued yesterday.

What has Apple patched in the update?

Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) list. CVE is a dictionary that provides definitions for publicly disclosed cybersecurity vulnerabilities and exposures. The goal of CVE is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services).

The zero-days are listed under the ID numbers:

CVE-2020-27930: Affected by this issue is some unknown processing of the component FontParser. Manipulation with an unknown input could lead to a memory corruption vulnerability. This means a font could be created which leads to memory corruption, allowing for a remote code execution (RCE) attack .

CVE-2020-27932: A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild. Using such a vulnerability could allow malware to bypass security restrictions on an affected system.

CVE-2020-27950: A malicious application may be able to disclose kernel memory. Apple is aware of reports that an exploit for this issue exists in the wild. Disclosed kernel memory may contain sensitive data like encryption keys and memory addresses used to defeat the address space layout randomization.

What is Project Zero?

Formed in 2014, Project Zero is a team of security researchers at Google who find and study zero-day vulnerabilities in hardware and software systems. Their mission is to make the discovery and exploitation of security vulnerabilities more difficult, and to significantly improve the safety and security of the Internet for everyone.

Update your iOS now

Since Apple has flagged that at least two of these vulnerabilities are being exploited in the wild and told us of the possible consequences, users should install the update as soon as possible.

Owners of an iPhone or iPad are advised to update to iOS 14.2 and iPadOS 14.2 or iOS 12.4.9. Apple patched the same vulnerabilities in the Supplementary Update for macOS Catalina 10.15.7. You can always find the latest Apple security updates at its security updates site.

Stay safe, everyone!

The post Update your iOS now! Apple patches three zero-day vulnerabilities appeared first on Malwarebytes Labs.

First-day returns in California showed voters firmly approving to change their state’s current data privacy law—which already guarantees certain privacy protections that many states do not—through the passage of Prop 24.

As of the morning of November 4, according to The Sacramento Bee, 56.1 percent of California voters said “Yes” to Prop 24. At that time, 65.3 percent of the state’s votes had been counted. Though far from a complete tally, the numbers proved advantageous enough for celebration for the “Yes on 24” campaign.

“With tonight’s historic passage of Prop 24, the California Privacy Rights Act, we are at the beginning of a journey that will profoundly shape the fabric of our society by redefining who is in control of our most personal information and putting consumers back in charge of their own data,” said Alastair Mactaggart, chair of Californians for Consumer Privacy and sponsor for Prop 24. “I’m looking forward to the work ahead and the next steps in implementing this law, including setting up a commission that is dedicated to protecting consumers online.”

Proposition 24 represented one of the rarer examples in data privacy law that split advocates in two. The typical roster of data privacy supporters in the state—including Electronic Frontier Foundation, ACLU of Northern California, Consumer Watchdog, Common Sense Media, Color of Change, and Oakland Privacy—divided themselves into three separate categories: Support, oppose, or neither.

The disagreement was well-founded. As we reported, while some groups praised Prop 24 because of its increased protections on data that could reveal race and ethnicity, other groups opposed the proposition because of new loopholes that could disproportionately harm minority communities.  

Adding a potential sense of voter whiplash to the ballot proposition was that its biggest supporter and primary funder Mactaggart actually served as one of the lead architects on the very law that the proposition was trying to amend. Two years ago, after announcing an intention to bring a ballot proposition to Californians to better secure their data privacy rights, Mactaggart instead worked directly with California lawmakers to get a bill drafted, passed, and signed by then-governor Jerry Brown.

That law, called the California Consumer Privacy Act, barely went into effect in January of this year, and details on its enforcement and on how the public could assert their rights were released only this summer.

In the end, though, none of that drama appeared to matter much to California voters. With the passage of Prop 24, Californians can expect additional protections on what the proposition has defined as “sensitive personal information,” as well as the country’s first government agency established entirely to enforce a data privacy law.  

The post Prop 24 passes in California, will change data privacy law appeared first on Malwarebytes Labs.

This blog post was authored by Jérôme Segura and Hossein Jazi.

The 2020 US elections have been the subject of intense scrutiny and emotions, while happening in the middle of a global pandemic. As election night ended and uncertainty regarding the results began to creep in, threat actors decided to jump in on it too.

Those tracking the threat landscape know very well that major world events do not go unnoticed by criminals. In this case, we began observing a new spam campaign delivering malicious attachments that exploit doubts about the election process.

The QBot banking Trojan operators return with yet another themed spam wave using the same hijacked email thread technique enticing victims with malicious election interference attachments.

Hijacked email threads pushing bogus DocuSign documents

The malicious emails come as thread replies, similar to what Emotet does to add legitimacy and make detection harder. They contain zip attachments aptly named ElectionInterference_[8 to 9 digits].zip.

While the election results are still being evaluated and debated, victims are enticed to open up the document to read about alleged election interference:

The extracted file is an Excel spreadsheet that has been crafted as if it were a secure DocuSign file. Users are tricked to allow macros in order to ‘decrypt’ the document.

This tried and tested trick will download a malicious payload onto the victim’s machine. The URL for that payload is encoded in a cell of a Cyrillic-named sheet “Лист3”.

Once executed, the QBot Trojan will contact its command and control server and request instructions. In addition to stealing and exfiltrating data from its victims, QBot will also start grabbing emails that will later be used as part of the next malspam campaigns.

World events are the best lure

At the core of the malware attacks we witness each day are typical social engineering schemes. Threat actors need to get victims to perform a certain set of actions in order to compromise them.

Spam campaigns routinely abuse email delivery notifications (Fedex, DHL, etc.) or bank alerts to disguise malicious payloads. But world events such as the Covid pandemic or the US elections provide ideal material to craft effective schemes resulting in high infection ratios.

Malwarebytes users were already protected against this attack thanks to our Anti-Exploit technology. Additionally, we detect the payload as Backdoor.Qbot.

Indicators of Compromise

Malicious Excel documents

b500a3c769e22535dfc0c0f2383b7b4fbb5eb52097f001814d8219ecbb3048a1
f2fb3e7d69bf1b8c0c20484e94b20be33723b4715e7cf94c5cbb120b800328da
0282a796dec675f556a0bf888eda0fe84f63558afc96321709a298d7a0a4f8e5
e800b0d95e02e6e46a05433a9531d7fb900a45af7999a262c3c147ac23cd4c10
7dec31d782ab776bcbb51bd64cbbd40039805ad94733d644a23d5cf16f85552c
0bec208127e4a021dccb499131ea91062386126b75d098947134a37e41c4b035
30de8dcd4e894549d6d16edb181dd1a7abec8f001c478cf73baf6075756dc8c2
a8329913c8bbccb86b207e5a851f7696b1e8a120929ca5c0a5709bd779babedf
ef8a17c3bb01d58bfea74a19f6cb8573cfb2d94d9e6159709ac15a7e0860dbce
7ddc225ad0ed91ce90b3bde296c5ce0b4649447fb3f02188e5303e22dc7cb5f0

QBot

china[.]asiaspain[.]com/tertgev/1247015.png

1edfe375fafa1f941dc4ee30702f4af31ba636e4b639bcbb90a1d793b5d4b06c
06be75b2f3207de93389e090afd899f392da2e0f1c6e02226db65c61f291b81b

QBot C2s

142.129.227[.]86
95.77.144[.]238

MITRE ATT&CK techniques

The post QBot Trojan delivered via malspam campaign exploiting US election uncertainties appeared first on Malwarebytes Labs.

The threat actors behind Maze ransomware have announced their retirement. On November 1, they posted the retirement announcement on the website where they would normally name and shame their victims that were unwilling to pay the ransom.

“The Project is closed.

Maze Team Project is announcing it is officially closed.

All the links to out project, using of our brand, our work methods should be considered to be a scam.

We never had partners or official successors. Our specialists do not works with any other software. Nobody and never will be able to host new partners at our news website. The Maze cartel was never exists and is not existing now. It can be found only inside the heads of the journalists who wrote about it. Attention to everyone who wants for its private information to be deleted from our news website. You can contact to Maze support chat. Support will be continued for a month after the press release.”

The Maze gang was known for introducing an extra way to create leverage against victims. Not only did the attackers lock organizations’ data up, they also stole the data and threatened to publish it if the ransom was not paid, giving victims another compelling reason to pay up, especially if the data was of a sensitive nature.

So it’s ironic that in the rest of the spelling error-ridden statement, the cybercriminals assume the posture of a group of people out to improve the world rather than line its own pockets. As if raising awareness of security flaws and the danger of Bitcoin was the attackers real goal. If they set out to ease their conscience, we would have preferred them to publish their master decryption keys.

Did the Maze gang retire unexpectedly?

Not really. At Malwarebytes we saw detections drop over the last month after a steep peak in August.

We suspect this is a result of the fact that many of their affiliates have moved to a new family, Egregor aka Ransom.Sekhmet. A week earlier, BleepingComputer reported that the Maze gang had stopped seeking out and encrypting new victims some time in September. The gang also cleaned up its data leak site and seemed to be busy extorting its final victims.

Will the Maze ransomware gang truly retire?

We will have to wait and see—history has shown us that when a crime group decides to close its doors, it’s rarely because the criminals have seen the error of their ways and it’s more often due to a new, more powerful threat that the threat actors would prefer to use.

So, with businesses now being targeted with the next ransomware and no sign of hope for victims of the past we see no reason to be particularly happy about this. We do, however, see plenty of reasons for businesses to look at their protection against brute force and other attacks on their RDP ports.

We will keep you posted of any new developments, as always.

Stay safe, everyone!

The post Maze ransomware gang announces retirement appeared first on Malwarebytes Labs.

Before you start to Google for election news, we’d like you to check whether your browser is at the latest and safest version. “Again?”, Chrome users may say. Yes, because Google has found another zero-day vulnerability – that means it’s a hole that is actively being exploited right now.

It’s the second zero-day in Google found in the past two weeks. Last week we reported about CVE-2020-15999 and advised to upgrade to at least version 86.0.4240.111. Today it is the turn of CVE-2020-16009 which is patched in Chrome version 86.0.4240.183 and later.

How do I install Chrome patches?

The easiest way to do it is to allow Chrome to update automatically which basically uses the same method as outlined below but does not require your attention. But you can end up lagging behind if you never close the browser or if something goes wrong, such as an extension stopping you from updating the browser. So, it doesn’t hurt to check now and then. And now would be a good time, given the zero-day vulnerability. My preferred method, which also allows me to keep track, is to have Chrome open the page chrome://settings/help which you can also find by clicking Settings > About Chrome.

If there is an update available, Chrome will notify you and start downloading it. Then it will tell you all you have to do to complete the update is Relaunch the browser.

What is this Chrome patch for?

Google has not disclosed what the 0-day does or how it is used. This is habitual as they want to give users a chance to update before giving threat-actors the chance to design their own exploits. But researchers came to the conclusion that it must have something to do with the way the Chrome browser handles Javascript by looking at the changelog.

After the update, the security hole should be patched and your settings page should say:

If so, you’re good to go for now.

Stay safe, everyone!

The post Update your Chrome again as Google patches second zero-day in two weeks appeared first on Malwarebytes Labs.

Healthcare is not in a good place right now.

With some countries and states deciding to go back in to lockdown due to the continued rise of reported COVID-19 infections—and several garnering record-high numbers compared to when almost every country initially went into lockdown—it seems horrible timing that hospital ransomware is back in the news.

Early on in the coronavirus crisis, a promise was made by some ransomware gangs to leave hospitals alone. But cybercriminals behaving like criminals—whether we’re in the middle of a pandemic or not—isn’t something that we should be shocked about.

In the last few months, we’ve seen rising hospital ransomware attacks.

In late September, a chain of hospitals under the Universal Health Services (UHS), one of the largest healthcare providers in the United States, were hit with what appeared to be Ryuk ransomware. According to their official statement, they successfully provided patient care despite not being able to access their IT applications, largely because of back-up processes and offline documentation methods they already had in place. Thankfully, no patient and/or employee data were compromised during the attack.

UHS hospitals and patients were, in a way, lucky. But this isn’t always the case.

Several weeks ago, we reported on Uniklinikum, a German hospital, being hit with a still-unknown strain of ransomware. And because the hospital stopped admitting new patients due to its systems behaving abnormally—a method that many ransomware-hit hospitals have adopted—a woman in need of serious medical attention had to be driven to another hospital 20 miles further. She died. This is considered the first case of death linked to a cyberattack.

“The stereotype of a cybercriminal is that of a bored teenager who is computer literate and socially maladjusted. This is far from the truth and every time there is a crisis we can see that cybercriminals are in reality ruthless and heartless individuals looking to inflict suffering on their victims in whatever way they can, and if a global crisis, such as COVID-19, plays to their advantage they will do so,” Brian Honan, head of BH Consulting, told ISMG in March of this year. “We should not relax any of our defenses but be more aware of criminals looking to leverage the crisis to spread misinformation, set up scams, launch phishing attacks and launch cyberattacks. Contrary to popular belief, there are no common, decent criminals in the online world.”

Last week, the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the US Department of Health and Human Services (HSS) released a joint alert on ransomware activity targeting hospitals and other healthcare providers. The malware families they named that actively target such organizations are TrickBot, BazarLoader (aka BazarBackdoor), Ryuk, and Conti.

This alert also highlights the importance of having and maintaining an offline, encrypted backup of data; creating, maintaining, and exercising a threat incident response plan—even a basic one—so staff would know how to respond in the event of a ransomware attack; and knowing and following the Ransomware Response Checklist, which is included in this CISA guide page.

Healthcare organizations might think that it’s only sensible to pay the ransom as lives could be severely impacted by a ransomware attack. However, in many cases, this scenario can be avoided by being prepared, expecting to be hit, and knowing what to do when—not if—it comes.

The post Hospital ransomware: Gangs are back to target healthcare appeared first on Malwarebytes Labs.

We had a very busy week at Malwarebytes Labs.

We offered advice on Google’s patch for an actively exploited zero-day bug that affects Chrome users, our podcast talked about finding consumer value in Cybersecurity Awareness Month with Jamie Court, we provided guidance about keeping ransomware cash away from your business, pointed out how scammers are spoofing bank phone numbers to rob victims, analyzed how a fake COVID-19 survey hides ransomware in a Canadian university attack, and discussed how a new Emotet delivery method was spotted during a downward detection trend.

Believe it or not, we also found time to explain what was going on with the HP printer issue on Mac, analyzed how California’s Prop 24 splits data privacy supporters and discussed Vastaamo, a data breach with unprecedented consequences.

Other cybersecurity news

• Federal agencies are warning of an increased and imminent cybercrime threat to US hospitals and healthcare providers, especially with regard to ransomware attacks. (Source: NBC)
• Despite their own claims, questions have been raised as to whether the SunCrypt gang are indeed the newest members of the Maze cartel. (Source: Security Boulevard)
• The five biggest cybersecurity threats for the healthcare industry as seen by cloud-first security firm Wandera. (Source: TechRepublic)
• CVE-2020-14882 A bug in Oracle Weblogic is being actively exploited, and the exploitation is trivial. (Source: InfoSec Handlers Diary Blog)
• Foreign cyber threats to the 2020 US presidential election are predominantly sophisticated disinformation campaigns. (Source: digital shadows)
• Why satellite hacking has become the biggest global threat for countries like the US, China, Russia, and India? (Source: The Eurasia Times)
• Facebook warned of perception hacks undermining trust in democracy. (Source: Axios)
• Microsoft warned that threat actors are actively exploiting systems unpatched against the ZeroLogon privilege escalation vulnerability in the Netlogon Remote Protocol. (Source: BleepingComputer)
• Email compromise attacks are on the increase as threat actors shift their focus from finance employees to group mailboxes. (Source: BetaNews)
• Zoom has kicked off end-to-end encryption for its mobile and desktop apps. (Source: ZDNet)

Stay safe, everyone!

The post A week in security (October 26 – November 1) appeared first on Malwarebytes Labs.