Adrian Johnson
TLDR:
- A zero-day vulnerability in Windows Event Log service has been discovered that could potentially crash the service on multiple versions of Windows.
- A critical remote code execution (RCE) flaw in Jenkins has been exploited in the wild, and proof-of-concept (PoC) exploits have been made public.
- A financially motivated threat actor is using popular websites such as Vimeo, Ars Technica, GitHub, and GitLab to distribute malware.
- The FBI has disrupted the KV botnet, which was being used by state-sponsored hackers from China to target critical infrastructure organizations in the US.
- Data breaches are expected to reach record levels in 2024, and ransomware attacks are becoming more focused on data exfiltration.
A zero-day vulnerability has been discovered in the Windows Event Log service that could cause the service to crash on multiple versions of Windows. This vulnerability poses a significant risk to enterprise defenders, as it can be triggered remotely and could potentially be used to bypass security defenses. The vulnerability has not yet been patched, and no known exploit code has been released.
In addition to the Windows Event Log zero-day, a critical remote code execution (RCE) flaw in Jenkins has been exploited in the wild. Several proof-of-concept (PoC) exploits for this vulnerability have been made public, indicating that it is actively being targeted by threat actors. Users are urged to patch their Jenkins installations immediately to prevent attacks.
A financially motivated threat actor known as UNC4990 is using popular websites such as Vimeo, Ars Technica, GitHub, and GitLab to distribute malware. The threat actor is using booby-trapped USB storage devices and malicious payloads hosted on these websites to surreptitiously deliver malware to unsuspecting victims. Organizations should be vigilant and ensure that their systems are properly protected against this type of attack.
The FBI has disrupted the KV botnet, which was being used by state-sponsored hackers from China to target critical infrastructure organizations in the US. The botnet, also known as Volt Typhoon, posed a significant risk to US-based critical infrastructure and was an ongoing threat. The disruption of the botnet is a significant win for defenders.
Data breaches are expected to reach record levels in 2024, according to cybersecurity firm Experian. The increasing focus on data exfiltration by ransomware attackers is contributing to this trend. Organizations need to prioritize their security efforts and implement strong defenses to protect their sensitive data.
Overall, these developments highlight the ongoing challenges and risks in the cybersecurity landscape. It is crucial for organizations to stay informed about the latest threats and vulnerabilities and take proactive measures to protect their systems and data.
