Threat Advisory HomeBlogThreat Advisory Threat Advisory: Active Exploitation of new Microsoft Windows Vulnerabilities Overview On November 9, 2021, Microsoft released its monthly security update KB5007186 for its Windows family of products [1]. Among these, Microsoft’s security intelligence center (MSTIC) flagged two vulnerabilities as being actively exploited in the wild: CVE-2021-42321, a post-authentication Microsoft Exchange Server vulnerability includes servers used by customers in Exchange Hybrid Mode. Microsoft further stated, “We are aware of limited targeted... Read More November 11, 2021 Threat Advisory Herjavec Group BlackMatter Ransomware Profile BlackMatter Ransomware is a breakout ransomware group that became operational shortly after the shutdown of the REvil Ransomware and DarkSide Ransomware operations in late Summer 2021. Like DarkSide, this group has been very vocal and expressive with the press about their operation. Furthermore, they have openly claimed that BlackMatter is the product of reproducing the “best parts” of previous ransomware operations[1]. Black Matter has... Read More September 24, 2021 Threat Advisory, Cybersecurity Conversations, Thought Leadership Herjavec Group LockBit 2.0 Ransomware Profile LockBit ransomware was initially discovered in September 2019. Since then, the malware has been used in ransomware attacks against a range of industries located across the globe. With the evolution of ransomware operators and their tactics over the past few years, groups like the LockBit gang have implemented successful tactics from other groups to increase their success and/or profits. In... Read More August 23, 2021 Threat Advisory, Cybersecurity Conversations, Thought Leadership Herjavec Group’s March 2021 Threat Summary Analysis Herjavec Group’s Threat Management Team leverages the Threat Summary to provide an overview of the most common threats and vulnerabilities seen in customer environments in recent months. This summary will include further information on supply chain compromises, malware attacks, and targeted phishing attacks. Download the Threat Summary below. GET THE HG THREAT SUMMARY ANALYSIS For more information on Herjavec Group's... Read More March 30, 2021 Threat Advisory, Cybersecurity Conversations, Thought Leadership Threat Advisory: Attackers leveraging compromised Microsoft Exchange Servers to deploy DEARCRY Ransomware Attackers have been observed deploying DEARCRY ransomware on compromised Microsoft Exchange Servers via the ProxyLogon exploit first observed on March 9th, 2021. Security professionals have been busy working on Microsoft Exchange Server vulnerability issues since the beginning of March 2021. Unfortunately, security professionals saw successful exploitation of the vulnerabilities (ProxyLogon vulnerabilities, i.e. CVE-2021-26855) on March 9th, 2021 and ransomware installation... Read More March 12, 2021 Threat Advisory Threat Advisory: F5 Patches Multiple Critical Vulnerabilities in its Big-IP Suite On Wednesday, March 10, 2021, application services and network delivery firm F5 announced the release of patches for seven related vulnerabilities in its BIG-IP product, including four with a "critical" CVSS rating. As of the release of this notification, no exploitation in the wild has been reported. According to F5’s advisory "The vulnerability allows for unauthenticated attackers with network access... Read More March 10, 2021 Threat Advisory Threat Advisory: Risk Based Security Researchers Report DriveSure Data Exposure Security researchers from Risk Based Security, an organization that analyzes data breaches, have released a summary regarding a data exposure they discovered in early January. The data originates from drivesure.com databases and contained over 20 gigabytes of data.[1] DriveSure provides car dealerships with services to assist them with employee training and customer retention programs. The data was shared on the... Read More February 12, 2021 Threat Advisory Threat Advisory: Subway Restaurants Serving TrickBot with New TrickBoot Module On December 12, 2020, Subway UK disclosed that its system used for marketing campaigns was compromised and was used for a phishing campaign distributing TrickBot. The phishing campaign spoofed a Subway order confirmation and targeted customers from the United Kingdom. An investigation into the incident determined that no guest accounts were breached and Subway has begun the process of notifying... Read More December 17, 2020 Threat Advisory Threat Advisory: SolarWinds Orion versions 2019.4 -2020.2.1 Software Supply Chain Attack During the evening of December 13th, 2020 it was announced that for several months, emails and other sensitive materials on the SolarWinds Orion network have been exfiltrated by sophisticated, nation-state hackers [1]. Mandiant has classified the attack with a neutral tag of UNC2452 (Uncategorized 2452) while other sources are alleging this activity is attributable to APT29/Cozy Bear and have reason... Read More December 14, 2020 Threat Advisory Threat Advisory: Russian State-Sponsored Malicious Cyber Actors Exploiting CVE-2020-4006 The NSA recently released an advisory on Russian state-sponsored malicious actors exploiting CVE-2020-4006, a command-injection vulnerability in several VMWare Access and VMWare Identity Management Products. VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector have been identified containing a command injection vulnerability. If successful, the exploit allows a potential malicious actor, with network access to the administrative... Read More December 8, 2020 Threat Advisory Search for: FILTER BY CATEGORY Careers COVID-19 Security Considerations Cyber CEO Cyber Security Awareness Month Cybersecurity Conversations From the HG Cyber Playbook Robert Herjavec Security News Thought Leadership Threat Advisory Webinar FILTER BY SERVICE OFFERING Technology Implementation Security Consulting (Advisory) PCI/Compliance Managed Services Incident Response Identity Services General Compliance REVIEW AND SHARE OUR LATEST CONTENT Resources WEBINARS ON DEMAND VIEW NOW 1234567...12Next COMPANY Who We Are Careers Social Responsibility Executive Team Security News SERVICES Managed Security Services Advisory Services Security Workshops Security Assessments & Testing PCI Compliance Privacy & Compliance Technology Architecture & Implementation Identity and Access Management Digital Forensics & Incident Response CONNECT Contact Us Locations Contact Technical Support HG Portal Robert Herjavec SUBSCRIBE © 2021 - Herjavec Group | Privacy Policy | Terms of Use