Corporate - Multipurpose Email & Newsletter Templates

<View in browser.

PROFICIO

THREAT INTEL NEWSLETTER
5/9/2022
We review and prioritize thousands of cybersecurity news items,
so you don’t have to.

NOTABLE NEWS AND SECURITY EVENTS

Top news, attacks, and announcements impacting the global cybersecurity industry

AVOSLOCKER RANSOMWARE VARIANT ABUSES DRIVER FILE TO DISABLE ANTI-VIRUS, SCANS FOR LOG4SHELL

We found samples of AvosLocker ransomware that makes use of a legitimate driver file to disable anti-virus solutions and detection evasion. While previous AvosLocker infections employ similar routines, this is the first sample we observed from the US with the capability to disable a defense solution using a legitimate Avast Anti-Rootkit Driver file (asWarPot.sys). In addition, the ransomware is also capable of scanning multiple endpoints for the Log4j vulnerability Log4shell using Nmap NSE script...

CHINESE HACKERS PERFORM 'RARELY SEEN' WINDOWS MECHANISM ABUSE IN THREE-YEAR CAMPAIGN

Researchers have disclosed a sophisticated Winnti cyber campaign that abuses Windows mechanisms in a way 'rarely seen'. According to Cybereason, the Chinese advanced persistent threat (APT) group Winnti is behind the campaign, which has gone undetected for years. Active since at least 2010, Winnti is a threat group that operates using a vast array of malware and tools at its disposal. The APT, also known as APT41, BARIUM, or Blackfly, is suspected of working on behalf of the Chinese state and focuses on cyberespionage and data theft...

EMOTET TESTS NEW ATTACK CHAIN IN LOW VOLUME CAMPAIGNS

The operators of the infamous Emotet botnet are testing new attack techniques in response to Microsoft’s move to disable Visual Basic for Applications (VBA) macros by default. The threat actors are adopting the new techniques on a limited number of targets before adopting them in larger scape malspam campaigns. Proofpoint researchers state that the operators are testing the new techniques in more selective attacks in parallel to the typical large scape malspam attacks...

TLS FLAWS LEAVE AVAYA, ARUBA SWITCHES OPEN TO TAKEOVER

Network switches from Aruba and Avaya are vulnerable to multiple flaws that could allow attackers to remotely execute code and completely take over the devices. Researchers from device-intelligence firm Armis found five vulnerabilities - two flaws in Aruba switches and three flaws in Avaya switches - that could be used to compromise networks that allow some outsider access, even with limited rights. The flaws can be exploited by a user of a captive portal or authentication server...

GARTNER TOP TRENDS IN CYBERSECURITY 2022

Gartner Top Trends for Cybersecurity in 2022 emerged from the challenges inherent in protecting the ever-expanding digital footprint of modern organizations. The pandemic response has accelerated hybrid work and the digitalization of business processes in the cloud, both of which introduce new security challenges.

READ THE TRENDS

This unpatched DNS bug could put 'well-known' IoT devices at risk

Pixiv, DeviantArt artists hit by NFT job offers pushing malware

A new secret stash for “fileless” malware

Cisco fixes NFVIS bugs that help gain root and hijack hosts

Cisco Issues Fresh Warning Over Counterfeit Switches

Attacking Emotet’s Control Flow Flattening

ABOUT PROFICIO

Industry Leading MDR Service Provider

Proficio is an award-winning managed security services provider (MSSP) delivering 24/7 security monitoring and managed detection and response (MDR) services. Proficio has Security Operations Centers (SOCs) in San Diego, Singapore, and Barcelona where our security teams monitor security events, investigate suspicious behavior, and hunt for targeted attacks. We have been recognized in Gartner’s Market Guide for MDR services annually since 2017.

Not currently enjoying the peace of mind in being protected by Proficio's award-winning services?

WHAT ARE YOU WAITING FOR?

Our Address
Proficio
2177 Salk Ave
#100
Carlsbad, CA 92008

PROFICIO

Proficio Threat Intel Newsletter 5.9.22