Displaying items by tag: Andrew Brandt

Attackers have tested an exploit for a critical Office vulnerability already fixed by Microsoft, by using a different format than that which was originally used in the exploit. The new exploit disappeared after a short interval.

Attackers used a script written in Python during a recent ransomware attack which took just three hours, encrypting all the virtual disks on the target's virtual machine hypervisor.

Old sometimes is not gold, especially when it comes to ancient versions of ColdFusion running on versions of Windows that have reached their end-of-life, as the global security firm Sophos has demonstrated through its research into a server that was taken over by unknown actors using the Cring ransomware.

Global security vendor Sophos claims to have discovered a new strain of Windows ransomware which is the final executable payload in a manual attack where every other stage is delivered through a PowerShell script. One of the entry points was an on-premise Microsoft Exchange Server installation.

Global security provider Sophos has discovered a Microsoft Exchange Server hosting a malicious monero cryptominer which is aimed at other Exchange servers.

The tactics employed by cyber criminals who deploy Windows ransomware on systems for monetary gain have changed over the last 10 months in order to evade detection by endpoint security that has improved markedly, a researcher from the global security firm Sophos claims.

The Snatch ransomware, that attacks Windows systems, appears to have incorporated a new trick into its routine by rebooting PCs into safe mode before beginning the encryption of files on an infected system, the security firm Sophos claims.