Malicious Windows drivers, Last Pass breach and Malware threats... and more

Signed Malicious Windows Drivers Used In Ransomware Attacks

It’s been reported that kernel-mode hardware drivers that have been certified (signed) by Microsoft's Windows Hardware Developer Program have been used maliciously in post-exploitation cyber-attacks, i.e. where the attacker had already gained administrative privileges on compromised systems.

The attacks have been linked to known ransomware and SIM swappers. It is understood that Microsoft has now released security updates to revoke the certificates, has suspended the accounts used to submit the drivers to be signed, and is working on a further detection measures.?

LastPass Second Data Breach

Password app company LastPass has reported a second data breach that may be related to a previous breach in August where source code and some proprietary LastPass technical information were taken.

The company has reported that in this most recent attack, a threat actor using information from August’s attack accessed “certain elements of our customers’ information.” LastPass says, however, that customers’ passwords remain safely encrypted, its services remain fully functional, and it is currently working to discover the scope of the attack and what information has been accessed.

The advice from LastPass is to follow its best practices around setup and configuration of LastPass as detailed here:?

Top Three Malware Threats Identified

Check Point's latest Global Threat Index has highlighted how three particular malware families (infostealers) made up approaching a fifth (16 per cent) of global detections in September. These are AgentTesla (RAT malware) that affected 7 percent of organisations, SnakeKeylogger, a Modular .NET keylogger and credential stealer that affected 5 per cent of organisations, and the Lokibot info-stealer (used in phishing emails) that accounted for 4 per cent of attacks.

The advice is to remember to keep using simple but effective cyber hygiene practices including taking regular backups, using antivirus and keeping it updated, and being particularly careful with email security and not clicking on any suspicious links in emails.?

Until next time …

Scan the QR code or click here to get your?Cyber Security Score?in under 5 minutes and subscribe to our?free Cyber Security Tips?to reduce your risk!