Cybersecurity

The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published a new alert advising that is has observed cyber actors using emails containing a Microsoft Word document with a malicious Visual Basic Application (VBA) macro code to deploy KONNI malware. KONNI is a remote administration tool (RAT) used by malicious cyber actors to steal files, capture keystrokes, take screenshots, and execute arbitrary code on infected hosts.

The Apache Software Foundation has released a security advisory to address vulnerabilities in Struts in the version range 2.0.0 – 2.5.20. An attacker could exploit one of these vulnerabilities to take control of an affected system. The current version, Struts 2.5.22, is not affected.

The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published a new alert advising it is currently tracking an unknown malicious cyber actor who is spoofing the Small Business Administration (SBA) COVID-19 loan relief webpage via phishing emails. These emails include a malicious link to the spoofed SBA website that the cyber actor is using for malicious re-directs and credential stealing.

CISA has published an advisory on a classic buffer overflow vulnerability in Siemens SCALANCE and RUGGEDCOM. For RUGGEDCOM RM1224, all versions prior to 6.3 are affected. For SCALANCE M-800 / S615, all versions prior to 6.3 are affected. Successful exploitation of this vulnerability could allow an attacker to gain unauthenticated access to a device and cause a buffer overflow to execute custom code. Siemens recommends applying the updates available for each of the products. CISA also recommends a series of measures to mitigate the vulnerability.