You are here

Home » Cybersecurity

Cybersecurity

Conti Ransomware – The Newest Member in the Ryuk Family Tree

Conti is a new family of ransomware believed to be based on code from Ryuk’s second version. Conti also uses the same ransom note its predecessor used in earlier attacks and reportedly leverages the same Trickbot infrastructure. Conti was recently observed by the Carbon Black Threat Analysis Unit (TAU). Most notably, Conti’s attributes appear to be better and faster than most malware families, as it allows up to 32 simultaneous encryption efforts, resulting in faster encryption of targeted files.

CISA Alert: Critical Vulnerability in SAP NetWeaver AS Java

The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published a new alert about a previously undisclosed vulnerability, CVE-2020-6287, affecting the SAP NetWeaver Application Server (AS) Java component LM Configuration Wizard. An unauthenticated attacker can exploit this vulnerability through the Hypertext Transfer Protocol (HTTP) to take control of trusted SAP applications.

Phoenix Contact Automation Worx Software Suite (ICSA-20-191-01)

CISA has published an advisory on stack-based buffer overflow and out-of-bounds read vulnerabilities in Phoenix Contact Automation Worx Software Suite. PC Worx version 1.87 and prior and PC Worx Express version 1.87 and prior are affected. Successful exploitation could allow an attacker to execute arbitrary code under the privileges of the application. Phoenix Contact recommends a series of steps to mitigate the vulnerabilities. CISA also recommends a series of measures to mitigate the vulnerabilities.

Rockwell Automation Logix Designer Studio 5000 (ICSA-20-191-02) – Product Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on an improper restriction of XML external entity reference vulnerability in Rockwell Automation Logix Designer Studio 5000. Versions 32.00, 32.01, and 32.02 are affected. Successful exploitation of this vulnerability could allow an unauthenticated attacker to craft a malicious file, which when parsed, could lead to some information disclosure of hostnames or other resources from the program.

Grundfos CIM 500 (ICSA-20-189-01) – Product Used in the Water Sector

CISA has published an advisory on missing authentication for critical function and unprotected storage of credentials vulnerabilities in Grundfos CIM 500. All versions prior to v06.16.00 are affected. Successful exploitation of these vulnerabilities could allow access to cleartext credential data. Grundfos recommends updating to firmware v06.16.00 and to change user credentials after updating. CISA also recommends a series of measures to mitigate the vulnerabilities.

Mitsubishi Electric GOT2000 Series (ICSA-20-189-02)

CISA has published an advisory on improper restriction of operations within the bounds of a memory buffer, session fixation, NULL pointer dereference, improper access control, argument injection, and resource management errors vulnerabilities in Mitsubishi Electric GOT2000 Series. GT27, GT25, and GT23 are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to cause a denial-of-service condition or remote code execution. Mitsubishi recommends users follow as series of steps to update CoreOS to the latest version.

Click2Gov, Again? – Magecart-Style Credit Card Skimming Potentially Enabled by Click2Gov Vulnerabilities

DataBreaches.net states it best…”Here we go again?” As previously published in several Security & Resilience Updates, December 2019 – February 2020 included a significant spate of local and municipal government entities being impacted by vulnerabilities with online payment application Click2Gov. According to cybersecurity firm TrendMicro, they have identified at least eight U.S.

Pages

Subscribe to Cybersecurity