HighRansomware
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
The Hacker News·Source published ·1 min read
What happened?
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.
Key details
- Atlassian Data Center products have a critical flaw allowing arbitrary file access.
- A new DarkSword iOS exploit kit variant supports keychain and crypto-wallet theft.
- MATCHBOIL malware has been updated to contact its C2 server every two minutes.
- ShinyHunters group member Edward Dubrovsky was arrested in Toronto.
- Threat actors hijacked three ccTLDs to obtain unauthorized Google certificates.
Affected
- Atlassian Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye Data Center products are affected.
- ShinyHunters group activities affect platforms like FBIjobs.gov managed by third-party vendors.
- Google domains and organizations are affected by ccTLD hijacking for unauthorized certificates.
What to look for
- Chrome blocked unauthorized Google certificates through CRLSets.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.