Security Program Controls/Technologies

"This compromise was quickly contained and our technology environment is currently considered to be free of known malicious activity as confirmed by our third-party security experts," said a Conduent spokesperson, who did not confirm whether the intrusion involved ransomware or data exfiltration.

Attackers have used a malicious Google ad with Homebrew's proper "brew.sh" URL to redirect to the typosquatted "brewe[.]sh" site, which lures targets into downloading the package manager that enables infostealer malware execution, according to security researcher Ryan Chenkie.

Initial compromise with Nnice ransomware enables not only the exfiltration of credentials, web session cookies, and emails and the identification of security software but also the escalation of privileges, attainment of boot-level persistence, and encryption of files with the ".xdddd" extension, according to an investigation by the CYFIRMA Research and Advisory team.

Threat actors leveraged a phishing webpage luring targets into downloading a legitimate software-spoofing Microsoft Installer package that conceals its malicious nature by launching the app while executing a malicious DLL to deploy the multi-stage PNGPlug loader, a report from Intezer showed.

Automated detection and mitigation of the 80-second DDoS attack has spared the targeted organization from any impact, according to Cloudflare.

Malaysia, Mexico, Thailand, Indonesia, and Vietnam accounted for most of the infections with the botnet, which exploited the CVE-2017-17215 and CVE-2024-7029 vulnerabilities for initial access and the eventual botnet malware retrieval for DDoS intrusions, an analysis from Qualys researchers revealed.

STAC5143 commenced its attacks with the delivery of a deluge of spam messages followed by a Teams call purporting to be from "Help Desk Manager" that sought Teams-based remote screen control access to enable command execution and backdoor deployment, according to an analysis from Sophos.