Saturday , February 15 2025
windows

Microsoft fixes two Windows zero-days exploited in attacks

Microsoft fixed two zero-day vulnerabilities in April 2024 Patch Tuesday, but they didn’t label them as such at first. CVE-2024-26234 is a vulnerability that involves a malicious driver being signed with a valid Microsoft Hardware Publisher Certificate. It was discovered by Sophos X-Ops in December 2023 and reported by team lead Christopher Budd.

This malicious file was labeled as “Catalog Authentication Client Service” by “Catalog Thales,” likely an attempt to impersonate Thales Group. However, further investigation revealed that it was previously bundled with a marketing software called LaiXi Android Screen Mirroring.’

Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Xploit_Cr3w and Blind_Virus are the two champion teams categorically for BCS ICT Fest 2025 arranged jointly by BCS and BUET....
Read More
Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

Between December 2024 and January 2025, Recorded Future's Insikt Group discovered a campaign targeting unpatched Cisco devices used by major...
Read More
Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

CISA Releases Advisories For 20 Industrial Control Systems (ICS)

On February 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued 20 advisories about serious vulnerabilities in Industrial Control...
Read More
CISA Releases Advisories For 20 Industrial Control Systems (ICS)

“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

The new Astaroth Phishing Kit can bypass two-factor authentication to steal login credentials for Gmail, Yahoo, and Microsoft. It uses...
Read More
“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

CVE-2023-38831
Malware campaign target Bangladeshi Government Entities: Report

A sophisticated malware campaign is targeting military and government entities in Bangladesh. It uses social engineering to deliver malicious files...
Read More
CVE-2023-38831  Malware campaign target Bangladeshi Government Entities: Report

(CVE-2025-1146
CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CrowdStrike has issued a security advisory for a serious TLS vulnerability, CVE-2025-1146, in its Falcon Sensor for Linux, Falcon Kubernetes...
Read More
(CVE-2025-1146  CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CVE-2025-0108 & CVE-2025-0110
Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Palo Alto Networks has issued advisories for two critical vulnerabilities in its PAN-OS. The vulnerabilities, CVE-2025-0108 and CVE-2025-0110, may enable...
Read More
CVE-2025-0108 & CVE-2025-0110  Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Update Now
Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

Ivanti has released security updates for Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC)...
Read More
Update Now  Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

This Adtech Company is Powering Surveillance of U.S. Military Personnel

Last year, a joint investigation revealed that a Florida-based data broker, Datastream Group, was selling highly sensitive location data that...
Read More
This Adtech Company is Powering Surveillance of U.S. Military Personnel

Intel Patched 374 Vulnerabilities in multiple products

In 2024, Intel addressed a remarkable 374 vulnerabilities across its software, firmware, and hardware products, distributing bug bounty rewards for...
Read More
Intel Patched 374 Vulnerabilities in multiple products

While Sophos couldn’t verify the authenticity of LaiXi software, Budd says they’re confident the file is a malicious backdoor.

“Just as we did in 2022, we immediately reported our findings to the Microsoft Security Response Center. After validating our discovery, the team at Microsoft has added the relevant files to its revocation list (updated today as part of the usual Patch Tuesday cycle; see CVE-2024-26234),” Budd said.

Sophos’ findings support information from a January report by cybersecurity company Stairwell and a tweet by reverse engineering expert Johann Aydinba.

Redmond has updated the advisory for CVE-2024-26234, confirming that it has been exploited and publicly disclosed.

In July 2023 and December 2022, Sophos discovered more harmful drivers that had been signed using valid WHCP certificates. However, instead of assigning CVE-IDs like they do now, Microsoft released security advisories for those incidents.

MotW bypass exploited in malware attacks:

Microsoft silently patched another zero-day vulnerability today. This vulnerability, tracked as CVE-2024-29988, is related to a security feature bypass in SmartScreen prompt. The vulnerability is caused by a weakness in the protection mechanism.

CVE-2024-29988 is a bypass for the CVE-2024-21412 flaw and was reported by Peter Girnus of Trend Micro’s Zero Day Initiative, as well as by Dmitrij Lenz and Vlad Stolyarov from Google’s Threat Analysis Group.

Dustin Childs, ZDI’s Head of Threat Awareness, identified it as a tool used in attacks to install malware on specific Windows systems. The tool is able to avoid detection by EDR/NDR and bypass the Mark of the Web (MotW) feature.

“This vulnerability is related to CVE-2024-21412, which was discovered by ZDI threat researchers in the wild and first addressed in February,” Childs told BleepingComputer.

“The first patch did not completely resolve the vulnerability. This update addresses the second part of the exploit chain. Microsoft did not indicate they were patching this vulnerability, so it was a (welcome) surprise when the patch went live.”

The Water Hydra group also used a different vulnerability to target forex and stock trading communities on New Year’s Eve.

CVE-2024-21412 was a bypass for another Defender SmartScreen vulnerability called CVE-2023-36025. This vulnerability was fixed in November 2023 but was used as a zero-day to distribute Phemedrone malware.

Microsoft released security updates for 150 vulnerabilities in April 2024. Out of these, 67 were remote code execution bugs.

Source: Microsoft, Bleepingcomputer

Check Also

Zuckerberg

Everything I Say Leaks,’ Zuckerberg Says in Leaked Meeting Audio

At an all-hands meeting at Meta on Thursday, Mark Zuckerberg did not mention the company’s …

Leave a Reply

Your email address will not be published. Required fields are marked *