December 2021

Phishing Attacks Impersonate Pfizer in Fake Requests for Quotation Threat actors are conducting a highly targeted phishing campaign impersonating Pfizer to steal business and financial information from victims. Pfizer is a well-known pharmaceutical company that enjoys extensive publicity for producing one of the few mRNA vaccines currently available against COVID-19. Read more…

Technical Advisory: Zero-day Critical Vulnerability in Log4j2 Exploited in the Wild On December 9, 2021, Apache disclosed CVE-2021-44228, a remote code execution vulnerability – assigned with a severity of 10 (the highest possible risk score). The source of the vulnerability is Log4j, a logging library commonly used by a wide range Read more…

New Stealthy DarkWatchman Malware Hides in the Windows Registry A new malware named ‘DarkWatchman’ has emerged in the cybercrime underground, and it’s a lightweight and highly-capable JavaScript RAT (Remote Access Trojan) paired with a C# keylogger. According to a technical report by researchers at Prevailion, the novel RAT is employed Read more…

Western Digital Warns Customers to Update their My Cloud Devices Western Digital is urging customers to update their WD My Cloud devices to the latest available firmware to keep receiving security updates on My Cloud OS firmware reaching the end of support. “On April 15, 2022, support for prior generations Read more…

Upgraded to Log4j 2.16? Surprise, there’s a 2.17 Fixing DoS All set for the weekend? Not so fast. Yesterday, BleepingComputer summed up all the log4j and logback CVEs known thus far. Ever since the critical log4j zero-day saga started last week, security experts have time and time again recommended version 2.16 as the Read more…

The Week in Ransomware – December 17th 2021 – Enter Log4j A critical Apache Log4j vulnerability took the world by storm this week, and now it is being used by threat actors as part of their ransomware attacks. Last Friday, a researcher publicly released an exploit for the Log4j vulnerability, dubbed Read more…

TellYouThePass Ransomware Revived in Linux, Windows Log4j Attacks Threat actors have revived an old and relatively inactive ransomware family known as TellYouThePass, deploying it in attacks against Windows and Linux devices targeting a critical remote code execution bug in the Apache Log4j library. KnownSec 404 Team’s Heige first reported these Read more…

Credit Card Info of 1.8 million People Stolen from Sports Gear Sites Four affiliated online sports gear sites have disclosed a cyberattack where threat actors stole credit cards for 1,813,224 customers. While not much is known about the attack, a law firm representing the four websites stated that personal information Read more…