CVE-2020-4006

We provide an overview of known cyberthreats related to Russia-Ukraine cyber activity, including DDoS attacks, HermeticWiper and defacement, and share recommendations for proactive defense.

US authorities warn critical infrastructure operators of the threat of cyberattacks orchestrated by Russia-linked threat actors. US Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) issued a joint alert to warn critical infrastructure operators about threats from Russian state-sponsored hackers. “This joint Cybersecurity Advisory (CSA)—authored […]

Microsoft Office 365 email accounts of employees at 27 US Attorneys’ offices were breached by the Russia-linked SVR group as part of the SolarWinds hack, DoJ warns. The US Department of Justice revealed that the Microsoft Office 365 email accounts of employees at 27 US Attorneys’ offices were hacked by the Russia-linked SVR (aka APT29, Cozy Bear, and The Dukes) during the SolarWinds attack. The […]

Remember when we told you to patch your VPNs already? I hate to say “I told you so”, but I informed…

The UK and US cybersecurity agencies have published a report detailing techniques used by Russia-linked cyberespionage group known APT29 (aka Cozy Bear). Today, UK NCSC and CISA-FBI-NSA cybersecurity agencies published a joint security advisory that warns organizations to patch systems immediately to mitigate the risk of attacks conducted by Russia-linked SVR group (aka APT29, Cozy Bear, and The Dukes)). The […]

The US government warned that Russian cyber espionage group SVR is exploiting five known vulnerabilities in enterprise infrastructure products. The U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI) have published a joint advisory that warns that Russia-linked APT group SVR (aka APT29, Cozy Bear, and The Dukes). […]

The U.S. government on Thursday warned that Russian APT operators are exploiting five known — and already patched — vulnerabilities in corporate VPN infrastructure products, insisting it is “critically important” to mitigate these issues immediately.

The SolarStorm timeline summarized here is based on the information available to us and our direct experience defending against this threat.

The IT giants VMware and Cisco revealed they were impacted by the recently disclosed SolarWinds supply chain attack. VMware and Cisco confirmed to have been both impacted by the recent SolarWinds hack. A recent advisory published by the NSA is warning that Russian state-sponsored hackers are exploiting the recently patched CVE-2020-4006 VMware flaw to steal sensitive information from […]

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. COVID-19 themed attacks October 1 – December 5, 2020 Drug dealers are selling Pfizer COVID vaccines on the darkweb LockBit Ransomware operators hit Swiss helicopter maker Kopter Police arrest two […]

We share information about CVE-2020-4006 and recommendations for how to mitigate.

The US National Security Agency (NSA) is warning organizations to patch or take mitigation steps to close a vulnerability in several VMware products that Russian state-sponsored hackers are exploiting to hijack authentication tokens and access sensitive data on other systems. The vulnerability, tracked as CVE-2020-4006, is a command injection flaw in the web administration interface […]

Russian state-sponsored hackers have been exploiting a vulnerability that VMware patched recently in some of its products, the National Security Agency (NSA) warned on Monday.

The National Security Agency (NSA) warns that Russia-linked hackers are exploiting a recently patched VMware flaw in a cyberespionage campaign. The US National Security Agency has published a security alert warning that Russian state-sponsored hackers are exploiting the recently patched CVE-2020-4006 VMware flaw to steal sensitive information from their targets. The US intelligence agency is urging companies […]

For the latest discoveries in cyber research for the week of 7th December, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Check Point has published a warning against cyber attackers leveraging the online shopping spree around Thanksgiving to distribute shipping and package tracking-related phishing email campaigns. Some 440% increase in campaigns impersonating online […]

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. A critical flaw in industrial automation systems opens to remote hack Crooks stole 800,000€ from ATMs in Italy with Black Box attack Operators behind Dark Caracal are still alive and […]

VMware addressed CVE-2020-4006 zero-day flaw in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. VMware has finally released security updates to fix the CVE-2020-4006 zero-day flaw in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. At the end of November, VMware only has released a workaround to address the critical […]

VMware on Thursday released patches for a Workspace ONE Access security flaw that was identified and reported by the National Security Agency (NSA).

For the latest discoveries in cyber research for the week of 30th November, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Check Point Research has analyzed a new global campaign that distributed Bandook, a 13-year old backdoor Trojan. Previous campaigns utilizing the malware were attributed to the Kazakh and the Lebanese governments. The […]

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. A cyberattack crippled the IT infrastructure of the City of Saint John Hundreds of female sports stars and celebrities have their naked photos and videos leaked online Romanians arrested for […]

Here’s an overview of some of last week’s most interesting news and articles: Challenges organizations face in combating third-party cyber risk A CyberGRX report reveals trends and challenges organizations of all sizes face in combating third-party cyber risk today. Each insight was gleaned from proprietary assessment data gathered from a sample of 4,000 third parties. cPanel 2FA bypass vulnerability can be exploited through brute force A two-factor authentication (2FA) bypass vulnerability affecting the popular cPanel … More →

VMware on Monday published an advisory to inform users that it’s working on patching a critical command injection vulnerability affecting Workspace ONE Access and some related components.

For the second time in less than a week, VMware is warning about a critical vulnerability (CVE-2020-4006). This time, the affected solutions are VMware Workspace One Access, Access Connector, VMware Identity Manager and VMware Identity Manager Connector. As some of these are components of the VMware Cloud Foundation (vIDM) and vRealize Suite Lifecycle Manager (vIDM) product suites, those are impacted as well. About the vulnerability (CVE-2020-4006) Not much has been shared about CVE-2020-4006, except that … More →

VMware discloses a critical zero-day vulnerability (CVE-2020-4006) in multiple VMware Workspace One components and released a workaround to address it. VMware has released a workaround to address a critical zero-day vulnerability, tracked as CVE-2020-4006, that affects multiple VMware Workspace One components. The flaw could be exploited by attackers to execute commands on the host Linux […]