A cybercriminal group calling itself Diicot is performing mass SSH brute-force scanning and deploying a variant of the Mirai IoT botnet on compromised devices, according to researchers. The group also deploys a cryptocurrency mining payload on servers with CPUs that have more than four cores.
“Although Diicot have traditionally been associated with cryptojacking campaigns, Cado Labs discovered evidence of the group deploying an off-the-shelf Mirai-based botnet agent, named Cayosin,” researchers from Cado Security said in an analysis of the group’s recent and ongoing attack campaign. “Deployment of this agent was targeted at routers running the Linux-based embedded devices operating system, OpenWrt.”
It was discovered that in SVG++ library that the demo application incorrectly
managed memory resulting in a memory access violation
under certain circumstances. An attacker could possibly use this issue
to leak memory information or run a denial of service attack.
This issue only affected Ubuntu 18.04 LTS. (CVE-2019-6246)
It was discovered that in SVG++ library that the demo application
incorrectly handled null pointers under certain circumstances.
An attacker could possibly use this issue to cause
denial of service, leak memory information or manipulate
program execution flow. (CVE-2021-44960)
Trend Micro has announced the integration of generative AI into its flagship Vision One platform with the new AI tool, Companion. Companion uses advanced AI/machine learning analytics and correlated detection models to enhance extended detection and response (XDR) capabilities, according to the cybersecurity vendor. It has been designed to amplify security operations, improve accessibility and efficiency, and quicken threat hunting speeds for analysts of varying skill levels, Trend Micro claimed in a press release. The release marks the initial phase of a multi-quarter rollout of AI and large language model (LLM) capabilities embedded within Vision One, it added.
Team Cymru has launched Pure Signal Scout, an external threat-hunting and malicious infrastructure analysis tool to “level up” security operations centers (SOCs). Under the promise of being the “fastest” tool available for threat insights, Pure Signal Scout is expected to save analysts’ time by providing fast answers to complex queries.
“We are now achieving in one working day what used to take several,” Josh Picolet, team leader of Team Cymru’s S2 Threat Research, said in a statement. This includes determining if an IP is important to a threat investigation. Another point factoring in the speed of response is that Scout is cloud-based and designed to eliminate the need to deploy multiple data services and solutions. It also eliminates the need to create custom scripts to combine disparate threat feeds and data sources.
In the latest cyber incident affecting the US federal government, two arms of the US Department of Energy (DOE) and, according to press reports, the US Department of Agriculture and the Office of Personnel Management, have been swept up in a sprawling spree of attacks by the Russia-based Clop ransomware gang.
USN-6083-1 fixed a vulnerability in cups-filters. This update provides
the corresponding update for Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that cups-filters incorrectly handled the beh CUPS
backend. A remote attacker could possibly use this issue to cause the
backend to stop responding or to execute arbitrary code.
Microsoft® Lync™ Better Together over Ethernet (BToE) feature on
Polycom® VVX® business media. phones enables you to control phone
activity from your computer using your Lync client.
The BToE feature enables you to place, answer, and hold audio and video
calls from your Polycom VVX phone and your Lync client on your computer.
The automatic and mandatory-by-default reordering of OpenBSD kernels
is NOT transactional and as a result, a local unpatched exploit exists
which allows tampering or replacement of the kernel. Arbitrary build
artifacts are cyclically relinked with no data integrity or provenance
being maintained or verified for the objects being consumed with
respect to the running kernel before and during the execution of the
mandatory kernel_reorder process in…
