February 2025 - rwth-security - lists.rwth-aachen.de

Threat Actors Exploit ClickFix to Deploy NetSupport RAT in Latest Cyber Attacks
by Bernd Kohler 11 Feb '25

11 Feb '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Threat Actors Exploit ClickFix to Deploy NetSupport RAT in Latest Cyber Attacks" --> "ClickFix is a technique used by threat actors to inject a fake CAPTCHA webpage on compromised websites ..." VG Bernd [0] https://thehackernews.com/2025/02/threat-actors-exploit-clickfix-to.html -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Thunderbid - address book URI fields - CVE-2025-1015
by Bernd Kohler 11 Feb '25

11 Feb '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "CVE-2025-1015" --> siehe dazu auch [1] --> "thunderbird_esr128 and below" --> import "address book containing a malicious payload in a field" VG Bernd [0] https://github.com/r3m0t3nu11/CVE-2025-1015 [1] https://exploitfinder.com/dbexploit/exploit.html?id=CVE-2025-1015&type=GitA… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Apple Patches Actively Exploited iOS Zero-Day CVE-2025-24200 in Emergency Update
by Bernd Kohler 11 Feb '25

11 Feb '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Apple Patches Actively Exploited iOS Zero-Day CVE-2025-24200 in Emergency Update" --> "out-of-band security updates to address a security flaw in iOS and iPadOS" VG Bernd [0] https://thehackernews.com/2025/02/apple-patches-actively-exploited-ios.html -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Hackers Exploit Google Tag Manager to Deploy Credit Card Skimmers on Magento Stores
by Bernd Kohler 11 Feb '25

11 Feb '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Hackers Exploit Google Tag Manager to Deploy Credit Card Skimmers on Magento Stores" VG Bernd [0] https://thehackernews.com/2025/02/hackers-exploit-google-tag-manager-to.html -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

DragonRank Exploits IIS Servers with BadIIS Malware for SEO Fraud and Gambling Redirects
by Bernd Kohler 10 Feb '25

10 Feb '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "DragonRank Exploits IIS Servers with BadIIS Malware for SEO Fraud and Gambling Redirects" VG Bernd [0] https://thehackernews.com/2025/02/dragonrank-exploits-iis-servers-with.html -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Ubuntu's crypto-config Continues Being Developed For Gradual Roll-Out
by Bernd Kohler 07 Feb '25

07 Feb '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Ubuntu's crypto-config Continues Being Developed For Gradual Roll-Out" VG Bernd [0] https://www.phoronix.com/news/Ubuntu-crypto-config-2025 -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Unpacking the BADBOX Botnet with Censys
by Bernd Kohler 07 Feb '25

07 Feb '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Unpacking the BADBOX Botnet with Censys" VG Bernd [0] https://censys.com/unpacking-the-badbox-botnet/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Geclonte Cisco "Annyconnect" Seite der TU Dresden
by Jens Hektor 06 Feb '25

06 Feb '25

Hi, lesenswert: https://www.malwarebytes.com/blog/news/2025/02/university-site-cloned-to-ev… Gruß, Jens Hektor

1 0

05 Feb '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "PoC Releases for Linux Kernel Flaw CVE-2024-36972: Double Free Flaw Enables Privilege Escalation and Container Escape" VG Bernd [0] https://securityonline.info/poc-releases-for-linux-kernel-flaw-cve-2024-369… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

PoC Exploit Released for Active Directory Domain Services Privilege Escalation Vulnerability
by Bernd Kohler 05 Feb '25

05 Feb '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "PoC Exploit Released for Active Directory Domain Services Privilege Escalation Vulnerability" --> CVE-2025-21293 VG Bernd [0] https://cybersecuritynews.com/poc-exploit-active-directory-domain-services/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0