Today's cybersecurity landscape highlights critical vulnerabilities, with MikroTik routers being actively exploited and new evasion tactics emerging in phishing campaigns. We also see the ongoing evolution of information stealers and their post-infection modules.
MikroTik Routers Under Attack via Exposed SSHVulnerability
CERT Polska has issued a warning about attackers actively exploiting MikroTik routers with internet-exposed SSH services. These attacks allow unauthorized individuals to gain complete administrative control without needing to authenticate, with incidents reported since early September.
Why it matters: If your business uses MikroTik routers, ensure your SSH service is not exposed to the internet, or implement strong access controls to prevent unauthorized access.
Read more at The Hacker News ↗
New REVSTEALER Modules Disable Windows Security and Mine CryptoThreat
Elastic Security Labs has identified four new programs linked to the REVSTEALER information stealer. These modules can persist on infected machines even after REVSTEALER removes itself, with one specifically disabling Windows Update and Microsoft Defender to secretly run a cryptocurrency miner.
Why it matters: Regularly monitor your Windows systems for unusual activity and ensure your security software and updates are functioning correctly to protect against advanced persistent threats.
Read more at The Hacker News ↗
Phishing Campaigns Using Invisible Unicode Characters for EvasionThreat
Threat actors are now employing an 'ASCII smuggling' technique in their phishing campaigns, utilizing invisible Unicode characters. This method helps them bypass standard email security filters, making their malicious lures harder to detect.
Why it matters: Educate employees about sophisticated phishing techniques and encourage caution with all emails, even those that appear legitimate, as visual cues can be misleading.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.