September 15, 2022

New Lenovo BIOS Updates Fix Security Bugs in Hundreds of Models Chinese computer manufacturer Lenovo has issued a security advisory to warn of several high-severity BIOS vulnerabilities impacting hundreds of devices in the various models (Desktop, All in One, IdeaCentre, Legion, ThinkCentre, ThinkPad, ThinkAgile, ThinkStation, ThinkSystem). Also Read: PDP Act (Personal Read more…

CISA Orders Agencies to Patch Windows, iOS Bugs Used in Attacks CISA added two new vulnerabilities to its list of security bugs exploited in the wild today, including a Windows privilege escalation vulnerability and an arbitrary code execution flaw affecting iPhones and Macs. The elevation of privileges bug in the Read more…

US Govt Sanctions Ten Iranians Linked to Ransomware Attacks The Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions today against ten individuals and two entities affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) for their involvement in ransomware attacks. Throughout the last two years, these threat actors have Read more…

Microsoft Teams Stores Auth Tokens as Cleartext in Windows, Linux, Macs Security analysts have found a severe security vulnerability in the desktop app for Microsoft Teams that gives threat actors access to authentication tokens and accounts with multi-factor authentication (MFA) turned on. Microsoft Teams is a communication platform, included in the Read more…

Phishing Page Embeds Keylogger to Steal passwords as you Type A novel phishing campaign is underway, targeting Greeks with phishing sites that mimic the state’s official tax refund platform and steal credentials as they type them. The campaign aims to trick victims into entering their banking credentials on the sites, Read more…

Chinese Hackers Create Linux Version of the SideWalk Windows Malware State-backed Chinese hackers have developed a Linux variant for the SideWalk backdoor used against Windows systems belonging to targets in the academic sector. The malware is attributed with high confidence to the SparklingGoblin threat group, also tracked as Earth Baku, Read more…

Windows Terminal Gets Support for Creating Custom Themes Microsoft released a new Windows Terminal version today that adds a long-awaited feature, making it possible to create and use custom themes. For now, users can only create themes by editing the Windows Terminal global JSON settings file to alter the background Read more…

Zero-day in WPGateway WordPress Plugin Actively Exploited in Attacks The Wordfence Threat Intelligence team warned today that WordPress sites are actively targeted with exploits targeting a zero-day vulnerability in the WPGateway premium plugin. WPGateway is a WordPress plugin that allows admins to simplify various tasks, including setting up and backing up Read more…

Cyberspies Drop New Infostealer Malware on Govt Networks in Asia Security researchers have identified new cyber-espionage activity focusing on government entities in Asia, as well as state-owned aerospace and defense firms, telecom companies, and IT organizations. The threat group behind this activity is a distinct cluster previously associated with the Read more…