article thumbnail

0patch releases free unofficial patches for Windows 0days exploited in the wild

Security Affairs

A few days ago, Microsoft warned of hackers actively exploiting two zero-day remote code execution vulnerabilities in Windows Adobe Type Manager Library. The vulnerabilities affects the way Windows Adobe Type Manager Library handles a specially-crafted multi-master font – Adobe Type 1 PostScript format. and Windows Server 2012.

Libraries 357
article thumbnail

Experts add a BlueKeep exploit module to MetaSploit

Security Affairs

It has been developed to target only the 64-bit versions of Windows 7 and Windows 2008 R2. The initial PR of the exploit module targets 64-bit versions of Windows 7 and Windows 2008 R2.” The module leverages an improved general-purpose RDP protocol library , as well as enhanced RDP fingerprinting capabilities.

Libraries 267
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Avast released a free decryptor for the Windows version of the Akira ransomware

Security Affairs

This Linux version is 64-bit and also uses the Boost library, it uses the Crypto++ library instead of Windows CryptoAPI. Files are encrypted by Chacha 2008 ( D. The authors used Microsoft Linker version 14.35. In June 2023, the malware analyst rivitna published a sample of the ransomware that is compiled for Linux.

article thumbnail

Expert identifies new Nazar APT group referenced in 2017 Shadow Brokers leak

Security Affairs

Guerrero-Saade discovered that the SIG37 campaign references hacking activities dated back as far as 2008 that was carried out by an unknown threat actor, the expert tracked it as Nazar. Native Farsi speakers told the expert that the term ‘nazar’ translates to ‘supervision’ or ‘monitoring’ from Persian to Roman characters.

Libraries 349
article thumbnail

Experts bypassed Microsoft’s emergency patch for the PrintNightmare

Security Affairs

2008 and 2012 but require Point&Print configured for Windows 2016,2019,10 & 11(?). Delpy shared a screenshot of a reversed-engineered Windows DLL with The Register and explained that the issues ties how Microsoft was checking for remote libraries in its patch for PrintNightmare. These work out of the box on Windows 7, 8, 8.1,

Libraries 256
article thumbnail

Microsoft Patch Tuesday, November 2023 Edition

Krebs on Security

” The second zero day this month is CVE-2023-36033 , which is a vulnerability in the “DWM Core Library” in Microsoft Windows that was exploited in the wild as a zero day and publicly disclosed prior to patches being available.

Phishing 309
article thumbnail

Threat actors leverages DLL-SideLoading to spread Qakbot malware

Security Affairs

Dynamic-link library (DLL) side-loading is an attack method that takes advantage of how Microsoft Windows applications handle DLL files. Qakbot , also known as QBot, QuackBot and Pinkslipbot, is an info-stealing malware that has been active since 2008.

Passwords 260