Blog

Topics Covered in the Report Include &nbsp; Vulnerabilities Data Deep-Dive Find out how vulnerabilities have trended between categories (including Elevation of Privilege and Remote Code Execution) and between Microsoft products, and more importantly, why.A Breakdown of the Vulnerability Snowball Effect Learn why the vulnerability count can start to snowball—even after a vulnerability is found and patched.Expert Opinions and Advice Hear from notable industry figures, such as Paula Januszkiewicz, CEO, CQURE; David Morimanno, Director of Identity &amp; Access Management Technologies, Integral Partners, a Xalient Company; Greg van der Gaast, Managing Director, Sequoia Consulting; Terry Cutler, Ethical Hacker &amp; Founder, Cyology Lab; Sami Laiho, Windows OS MVP Chief Research Officer / Founder, Truesec Finland; Eliza-May Austin, CEO, th4ts3cur1ty.company; Dr. Jessica Barker, Co-Founder, Cygenta; Marc Maiffret, Chief Technology Officer, BeyondTrust. Are Organizations Having an Identity Crisis? Increasingly, attackers are re-focusing their efforts on exploiting identities, rather than Microsoft software vulnerabilities. Learn from real-life examples of the growing challenges organizations face around managing identities and identity security. How to Identify an Identity Crisis in Your Microsoft Ecosystem Learn what an identity crisis in your Microsoft ecosystem looks like, with insights drawn from the new Attack Vectors book. In a world where it is easier to log in than hack in, identity has become the new perimeter. Read more&nbsp; : <a href="https://assets.beyondtrust.com/assets/documents/BT_whitepaper_Microsoft-Vulnerabilities-Report-2024-August.pdf" data-mce-href="https://assets.beyondtrust.com/assets/documents/BT_whitepaper_Microsoft-Vulnerabilities-Report-2024-August.pdf">https://assets.beyondtrust.com/assets/documents/BT_whitepaper_Microsoft-Vulnerabilities-Report-2024-August.pdf</a>

The Latest Microsoft Vulnerabilities Data, Analyzed The 11th Edition of the Microsoft Vulnerabilities Report

A group of cybercriminals associated with the RansomHub ransomware has been detected using a new tool specifically designed to disable endpoint detection and response (EDR) software on compromised systems. This tool, known as EDRKillDiscovered by cybersecurity firm Sophos in connection with a failed ransomware attack in May 2024, EDRKillShifter is classified as a “loader” executable. It functions as a delivery mechanism for a legitimate but vulnerable driver, also known as a “bring your own vulnerable driver” (BYOVD) tool. According to security researcher Andreas Klopsch, this tool can deploy various driver payloads depending on the vulnerability.RansomHub, which appeared in February 2024 as a renamed version of Knight ransomware, exploits known security vulnerabilities to obtain threat information.In a recent update, Microsoft revealed that cybercrime group Scattered Spider has added ransomware strains like RansomHub and Qilin to its toolbox. EDRKillShifter operates via a command-line interface requiring password entry, decrypting an embedded resource named BIN and executing it in memory. This BIN resource then decompresses and executes an obfuscated Go-based payload, which uses various vulnerable and legitimate drivers to elevate privileges and disable the EDR software.Source: <a href="https://thehackernews.com/2024/08/ransomhub-group-deploys-new-edr-killing.html" data-mce-href="https://thehackernews.com/2024/08/ransomhub-group-deploys-new-edr-killing.html">https://thehackernews.com/2024/08/ransomhub-group-deploys-new-edr-killing.html</a>

Actualités/Cyber Alertes

The Latest Microsoft Vulnerabilities Data, Analyzed The 1...

RansomHub Group Deploys New EDR-Killing Tool in Latest Cy...