CVE-2014-1761

The United States Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday announced that it has expanded its Known Exploited Vulnerabilities Catalog with nine more security flaws, including two recently addressed zero-days.

The U.S. CISA added to the Known Exploited Vulnerabilities Catalog another 9 security flaws actively exploited in the wild. US Cybersecurity and Infrastructure Security Agency (CISA) added nine new vulnerabilities to its Known Exploited Vulnerabilities Catalog, including two recently patched zero-day issues affecting Adobe Commerce/Magento Open Source and Google Chrome. CISA orders all Federal Civilian Executive […]

For roughly a decade, a previously unknown advanced persistent threat (APT) actor has been engaging in long-term surveillance operations against academics, activists, journalists, human rights defenders, and law professionals, SentinelOne reports.

One doesn’t have to be a great coder to become a successful cybercriminal, as underground markets are filled with offerings that automate one or another step of an attack chain. Take for example the AKBuilder, a builder for Word documents that carry exploits for several vulnerabilities and a malicious, encrypted payload. The evolution of AKBuilder According to SophosLabs principal researcher Gábor Szappanos, two versions of the builder have, at one time or another, found their … More →

Kaspersky Lab researchers investigated a threat actor that was undertaking aggressive cyber espionage activity in the Asian region, targeting multiple diplomatic and government entities with a particular focus on China and its international affairs. This group, named Dropping Elephant (also known as “Chinastrats”), used their unsophisticated tools to attack some high profile Western targets as well. In February 2016, following an alert from a partner, Kaspersky Lab’s Global Research and Analysis Team began its investigation … More →

Custom Backdoor Used in Targeted Attacks with Command and Control Servers Disguised as Antivirus Company Sites Researchers at Symantec have discovered a new backdoor Trojan being used in attacks against companies mainly located in Taiwan, but also against organizations in Brazil and the United States.

Unit 42 has collected multiple spear phishing emails, weaponized document files, and payloads that targeted various offices of the Mongolian government during the time period of August 2015 and February 2016. The phishing emails and document files leveraged a variety of geopolitically sensitive subject matters as attractive lures, such as events in Beijing, the Dalai

Security researchers from ESET uncovered the Roaming Tiger hacking campaign, bad actors in the wild are targeting Russian organizations. Roaming Tiger is the name of a cyber espionage campaign targeting high profile organizations in Russia and former Soviet Union countries, including Belarus, Kazakhstan, Kyrgyzstan, Tajikistan, Ukraine, and Uzbekistan. The Roaming Tiger campaign was discovered by experts at […]

Cybercriminals are increasingly copying cyberespionage groups in using targeted attacks against their victims instead of large-scale, indiscriminate infection campaigns. This change in tactics has been observed among those who launch attacks, as well as those who create and sell attack tools on the underground market. A recent example of such behavior was seen in a […]

Researchers at Proofpoint recently discovered a Phishing campaign that originated form select job postings on CareerBuilder. Taking advantage of the notification system the job portal uses, the attacker uploaded malicious attachments instead of résumés, which in turn forced CareerBuilder to act as a delivery vehicle for Phishing emails. The scam is both simple and complex. […]

As user habits evolve, so do the tactics of attackers . It should come as little surprise then that as enterprises upgraded to newer versions of Windows in 2014, the amount of 64-bit Windows malware being used in attack campaigns increased as well.

Advanced persistent threats (APT) – given the moniker, one might think everything about them is sophisticated.

Advanced Persistent Threat (APT) actors are generally considered to be among the most sophisticated cyber exploiters out there. But is this perception correct? Gabor Szappanos, a researcher with SophosLabs Hungary, says no. “It is always good to know the strength of the enemy at the other side of the gate,” he notes, and for this reason he and his colleagues decided to analyze over a dozen malware samples exploiting the CVE-2014-1761 vulnerability, which allowed them … More →

A new strain of Zeus Trojan dubbed Chthonic has been discovered in the wild targeting more than 150 banks and 20 payment systems mainly in Europe. Experts believe they have seen everything about the Zeus trojan, P2P versions, versions that infect SaaS, agents that exploit the Tor network or that recruit money mules … then […]

The notorious remote access Trojan (RAT) known as PlugX (Korplug) has been used by a threat group to target users in Afghanistan, Russia, Tajikistan, Kazakhstan and Kyrgyzstan. PlugX has been observed in numerous targeted attacks since 2012, particularly in campaigns launched by Chinese advanced persistent threat (APT) actors.

Sometimes “Patch Tuesday” comes and goes with little excitement or fanfare; yesterday was not one of those days. In just one day, Oracle released patches for 154 new vulnerabilities, Adobe issued updates for Flash and ColdFusion, and Microsoft released 24 patches of their own. On top of the sheer volume of patches, we learned that

Ongoing cyber espionage campaign based on BlackEnergy malware hit targets in Poland, Ukraine and Belgium. Experts at ESET and F-Secure firms analyzed it. BlackEnergy malware is still in the wild representing a serious threat, a new ‘Lite’ version of the malware has been detected by experts at ESET security firm. BlackEnergy is a popular DDoS Trojan, gained […]

Researchers at FireEye have analyzed the operations of the advanced persistent threat (APT) group dubbed “Pitty Tiger,” and determined that it might have been active since as far back as 2008.

MiniDuke – the extremely small and highly customized Asembler-based backdoor used in the past to target mostly government entities and institutions around the world – has been spotted again, this time by ESET researchers. The exploit used to deliver the malware is that of the recently patched Word RTF Memory Corruption Vulnerability (CVE-2014-1761), and comes in the form of a specially crafted RTF file named Proposal-Cover-Sheet-English.rtf, delivered via email. “Although the backdoor is still quite … More →

On Monday, researchers at Trend Micro said a vulnerability in Microsoft Word (CVE-2014-1761), disclosed in March and patched during April’s monthly update, is being used as part of a series of targeted attacks in Taiwan. In one attack, an email (allegedly from a government employee) is sent to a victim with a malicious attachment. The […]

A recently-patched Microsoft Word vulnerability is being used in attacks against government agencies in Taiwan, researchers with Trend Micro found. The vulnerability, CVE-2014-1761, was the subject of a security advisory from Microsoft back in March, and was patched in April. The presence of a patch however has not stopped attackers from targeting the vulnerability.

Update (05/21/2014): As previously suspected, other reports also support that CVE-2013-2729 is being used in malicious PDFs).Email remains a widely used infection vector…

April’s Microsoft Patch Tuesday is on par with the prior releases this year. There are only four bulletins being released, two rated “Critical” and two rated “Important”. Of course the long coming, but somehow still apocalyptic news that Windows XP is dead has overshadowed these bulletins. So this is it. We’ve been warned. And warned and warned. Today marks the last day that Microsoft will issue public patches for Windows XP, even though XP still … More →

The Microsoft April security release is almost upon us with security updates scheduled to deploy on Tuesday, April 8th. This day will go down in history as a major milestone for Windows XP and Office 2003 since it will be the last day these products will be supported. Windows XP is a thirteen-year operating system that lacks the security features of the latest Windows platforms like ELAM for pre-boot anti-malware protection and Windows Defender 2.0 … More →

Microsoft issued a security advisory for the presence of a zero-day vulnerability in Microsoft Word products which allows a remote code execution. Another zero-day vulnerability is threatening the Microsoft world, the news was issued by Microsoft through an official security advisory (CVE-2014-1761). The vulnerability is present in Microsoft Word product, it allows a remote code execution that can […]

Vulnerability CVE-2014-1761 in Microsoft Word Could Allow Remote Code Execution, Microsoft Warns – Office 2011 for Mac Affected