Vulnerability Note

  Major software vulnerabilities are a fact of life, as illustrated by the fact that Microsoft has patched between 55 and 110 vulnerabilities each month this year – with 7% to 17% of those vulnerabilities being critical. May had the fewest vulnerabilities, with a total of 55 and only four considered critical. The problem is that the critical vulnerabilities are things we have seen for many years, like remote code execution and privilege escalation. Microsoft isn't the only big name regularly patching major vulnerabilities: We see monthly security updates coming from Apple, Adobe, Google, Cisco, and others. Everything old is new again With major vulnerabilities in so many applications, is there any hope for a secure future? The answer is, of course, yes, but that does not mean there won't be challenges getting there. The vulnerabilities being seen may not be new to those of us who have been  defending against attackers  for years or even decades, but the adversaries continually

  EXECUTIVE SUMMARY: Feint and punch? This ransomware fake-out might mean that your team will have to put up a good fight in order to avoid a flash knockdown… Microsoft reports an active phishing campaign in which threat actors distribute a computer infection that spreads “fake ransomware”. The ransomware look-a-like involved is in fact trojan malware that can result in a full computer takeover. In Windows systems, this malware offers hackers an easy backdoor entry point. Once in the system, passwords and other  credentials can be harvested  from both email clients and web browsers. The roster of user platforms at risk of compromise include Outlook, Internet Explorer, Firefox and Chrome. The email campaign First, emails purporting to contain payment-related information arrive in users’ inboxes. Then, users who open the emails and click on the attachment are immediately connected to a malicious domain. Ultimately, this leads to the download of the Java-based STRRAT malware. This malware