New polyglot malware hits aviation, satellite communication firms

A previously undocumented polyglot malware is being deployed in attacks against aviation, satellite communication, and critical transportation organizations in the United Arab Emirates. The malware delivers a backdoor called Sosano, which establishes persistence on the infected devices and allows the attackers to execute commands remotely. The activity was discovered by Proofpoint in October 2024, which states […]

New Microsoft 365 outage impacts Teams, causes call failures

Microsoft is investigating a new Microsoft 365 outage that is affecting Teams customers and causing call failures. Since the incident started more than one hour ago, outage monitoring service Downdetector has received hundreds of reports, with affected users saying they’re also experiencing authentication problems. “Users may not be able to receive calls placed through Microsoft Teams-provisioned auto attendants and […]

New ClickFix attack deploys Havoc C2 via Microsoft Sharepoint

A newly uncovered ClickFix phishing campaign is tricking victims into executing malicious PowerShell commands that deploy the Havok post-exploitation framework for remote access to compromised devices. ClickFix is a social-engineering tactic that emerged last year, where threat actors create websites or phishing attachments that display fake errors and then prompt the user to click a button […]

Ransomware gangs exploit Paragon Partition Manager bug in BYOVD attacks

Microsoft had discovered five Paragon Partition Manager BioNTdrv.sys driver flaws, with one used by ransomware gangs in zero-day attacks to gain SYSTEM privileges in Windows. The vulnerable drivers were exploited in ‘Bring Your Own Vulnerable Driver’ (BYOVD) attacks where threat actors drop the kernel driver on a targeted system to elevate privileges. “An attacker with local access to a […]