Malware Round-up For The Week of Feb 27 - Mar 3
Today, Talos is publishing a glimpse into the most prevalent threats we've observed over the past week. Unlike our other posts, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior
Covert Channels and Poor Decisions: The Tale of DNSMessenger
This post was authored by Edmund Brumaghin and Colin Grady Executive Summary The Domain Name System (DNS) is one of the most commonly used Internet application protocols on corporate networks. It is responsible for providing name resolution so that network resources can be acc
Cisco Coverage for Smart Install Client Protocol Abuse
Summary Talos has become aware of active scanning against customer infrastructure with the intent of finding Cisco Smart Install clients. Cisco Smart Install is one component of the Cisco Smart Operations solution that facilitates the management of LAN switches. Research has ind
Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Iceni Argus PDF Content Extraction affect MarkLogic
Vulnerability discovered by Marcin ’Icewall’ Noga and a member of the Talos VulnDev team. Overview Talos has discovered multiple vulnerabilities in Iceni Argus PDF content extraction product. Exploiting these vulnerabilities can allow an attacker to gain full control over the v
Vulnerability Deep Dive - Ichitaro Office Excel File Code Execution Vulnerability
This vulnerability was discovered by Cory Duplantis and another member of Cisco Talos Overview Vulnerabilities in word processing and office productivity suites are useful targets for exploitation by threat actors. Users frequently encounter file types used by these software s
Vulnerability Spotlight: Multiple Ichitaro Office Vulnerabilities
These vulnerabilities were discovered by Cory Duplantis and another member of Cisco Talos Talos has discovered three vulnerabilities within the Ichitaro Office suite. Ichitaro is published by JustSystems and is considered one of the more popular word processors used within Japan
Korean MalDoc Drops Evil New Years Presents
This blog was authored by Warren Mercer and Paul Rascagneres. Executive Summary Talos has investigated a targeted malware campaign against South Korean users. The campaign was active between November 2016 and January 2017, targeting a limited number of people. The infection ve
Vulnerability Spotlight: Multiple Vulnerabilities in the Aerospike NoSQL Database Server
Vulnerabilities discovered by Talos Talos is releasing multiple vulnerabilities discovered in the Aerospike Database Server. These vulnerabilities range from Denial of Service to potential remote code execution. This software is used by various companies that require a high perf
Cisco Coverage for 'Magic Hound'
'Magic Hound' is the code name used to reference a seemingly limited series of malware distribution campaigns that were observed targeting organizations in Saudi Arabia as well as organizations with business interests in Saudi Arabia. Similar to other malware distribution