Top stories.
- Patch Tuesday notes: Microsoft addresses six actively exploited zero-days.
- LummaStealer activity surges alongside CastleLoader.
- North Korean hackers use social engineering and malware to target the crypto sector.
- Business News: Sophos acquires London-based Arco Cyber.
Patch Tuesday notes: Microsoft addresses six actively exploited zero-days.
Microsoft yesterday issued fixes for 58 vulnerabilities, including six actively exploited zero-days, BleepingComputer reports. The zero-days affect Windows Shell, MSHTML, Microsoft Word, Windows Remote Desktop Services, the Desktop Window Manager, and the Windows Remote Access Connection Manager.
Adobe released patches for dozens of flaws across its product line, including Audition, After Effects, InDesign, Bridge, Lightroom Classic, Substance 3D apps, and the DNG SDK, according to BeyondMachines.
SecurityWeek notes that Intel and AMD have addressed more than 80 vulnerabilities across their products, including several serious flaws affecting Intel's Trust Domain Extensions (TDX).
SecurityWeek also has a summary of patches from industrial vendors, including Siemens, Schneider Electric, Aveva, and Phoenix Contact.
LummaStealer activity surges alongside CastleLoader.
Bitdefender has observed a surge in LummaStealer malware-as-a-service activity following widespread law enforcement disruption efforts over the past year. The malware is delivered via social engineering, and uses the CastleLoader malware loader as a delivery mechanism. The researchers say CastleLoader's "modular, in-memory execution model, extensive obfuscation, and flexible command-and-control communication make it well-suited to malware distribution of this scale."
Bitdefender notes infrastructure overlaps between LummaStealer and CastleLoader, indicating that the two malware families are coordinating or using the same service providers. The researchers explain, "This overlap is consistent with the reuse of domain registrations or hosting resources across multiple malware families, further highlighting the close operational relationship between CastleLoader and LummaStealer delivery activity."
North Korean hackers use social engineering and malware to target the crypto sector.
Mandiant says a North Korean threat actor tracked as "UNC1069" is using a combination of social engineering techniques alongside seven unique malware families to target the cryptocurrency and DeFi sectors. In one incident observed by Mandiant, the attackers "relied on a social engineering scheme involving a compromised Telegram account, a fake Zoom meeting, a ClickFix infection vector, and reported usage of AI-generated video to deceive the victim."
The researchers add, "The volume of tooling deployed on a single host indicates a highly determined effort to harvest credentials, browser data, and session tokens to facilitate financial theft. While UNC1069 typically targets cryptocurrency startups, software developers, and venture capital firms, the deployment of multiple new malware families alongside the known downloader SUGARLOADER marks a significant expansion in their capabilities."
Business News: Sophos acquires London-based Arco Cyber.
UK-headquartered cybersecurity firm Sophos has acquired London-based cybersecurity assurance provider Arco Cyber. Sophos stated, "Arco Cyber will join Sophos as a dedicated team to advance Sophos CISO Advantage. Its technology and expertise will be integrated into Sophos Central, the platform which delivers Sophos’ broader ecosystem including advisory services, managed detection and response (MDR), and partner-delivered services that enable MSPs and MSSPs to scale cybersecurity strategy for their customers."
Read more in the Business Briefing at 4pm ET.
