Threat Spotlight: Mighty Morphin Malware Purveyors: Locky Returns Via Necurs
Throughout the majority of 2016, Locky was the dominant ransomware in the threat landscape. It was an early pioneer when it came to using scripting formats Windows hosts would natively handle, like .js, .wsf, and .hta. These scripting formats acted as a vehicle to deliver the pay
Threat Round-up for Apr 14 - Apr 21
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 14 and April 21. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlightin
Vulnerability Spotlight: ARM Mbedtls x509 ECDSA invalid public key Code Execution Vulnerability
Vulnerability Discovered by Aleksandar Nikolic Overview Talos is disclosing TALOS-2017-0274/CVE-2017-2784, a code execution vulnerability in ARM MbedTLS. This vulnerability is specifically related to how MbedTLS handles x509 certificates. MbedTLS is an SSL/TLS implementation
Vulnerability Spotlight: Information Disclosure Vulnerability in Lexmark Perceptive Document Filters
Discovered by Marcin 'Icewall' Noga of Cisco Talos. Talos are today releasing a new vulnerability discovered within the Lexmark Perceptive Document Filters library. TALOS-2017-0302 allows for information disclosure using specifically crafted files. Overview The vulner
Cisco Coverage for Shadow Brokers 2017-04-14 Information Release
On Friday, April 14, the actor group identifying itself as the Shadow Brokers released new information containing exploits for vulnerabilities that affect various versions of Microsoft Windows as well as applications such as Lotus Domino. Additionally, the release included previo
Threat Round-up for Apr 7 - Apr 14
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 7 and April 14. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting
Cisco Coverage for CVE-2017-0199
Over the past week, information regarding a serious zero-day vulnerability (CVE-2017-0199) in Microsoft Office was publically disclosed. Since learning of this flaw, Talos has been actively investigating the issue. Preliminary reports indicated that this vulnerability was activel
Microsoft Patch Tuesday - April 2017
It’s that time again! Today we bring you April’s Microsoft Patch Tuesday information. These fixed vulnerabilities affect Outlook, Edge, Internet Explorer, Hyper-V, .NET, and Scripting Engine. Bulletins Rated Critical CVE-2017-0106 outlines a vulnerability in Microsoft Word. It
From Box to Backdoor: Discovering Just How Insecure an ICS Device is in Only 2 Weeks
This post was authored by Martin Lee and Warren Mercer, based on research conducted by Patrick DeSantis. *blog post was updated with additional information for Day 4 on April 21. Industrial Control Systems provide stability to civilization. They clean our water, deliver our pow