Cybersecurity News - Page 297

It’s not clear who is behind the security incident as no group took responsibility for it.

The tech giant has released the clarified guidance after multiple security researchers reported that the security updates don’t fully address the vulnerability.

The affected organizations were based in the UK, the Netherlands, Germany, Sweden, Norway, and Italy.

The company said that while documents were encrypted, the hackers were able to obtain the decryption key due the Accellion FTA vulnerability.

The group has been observed using new plugins and RAT families, such as DetaRAT, ReverseRAT, MargulasRAT and ActionRAT.

The operation targeted organizations from the Middle East, with some of them related to industrial sector.

Once the victim runs the attachment or downloads the fake Microsoft update, Cobalt Strike is installed on the system, providing the threat actors persistent remote access to the targeted machine.

The software vendor estimates that nearly 1,500 businesses have been affected by the recent REvil ransomware attack.

The attack was launched by a threat actor affiliated with the Russia-linked APT 29 hacking group.

CVE-2021-34527 includes both RCE and a LPE vector that can be used by hackers to execute commands with SYSTEM privileges on vulnerable Windows systems.