Word backdoor, WSL Attack surface, EnemyBot adapting, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight.
Episode 234 - 27 May 2022
Word backdoor- https://www.zdnet.com/article/this-zero-day-windows-flaw-opens-a-backdoor-to-hackers-via-microsoft-word-heres-how-to-fix-it/
WSL attack surface -
https://www.bleepingcomputer.com/news/security/new-windows-subsystem-for-linux-malware-steals-browser-auth-cookies/
Killnet warns Italy - https://www.thesundaily.my/world/italy-on-alert-over-killnet-cyber-attack-threat-DA9266005
Spirit Super suckered -
https://portswigger.net/daily-swig/data-breach-at-australian-pension-provider-spirit-super-impacts-50k-victims-following-phishing-attack
EnemyBot adapting -
https://threatpost.com/enemybot-malware-targets-web-servers-cms-tools-and-android-os/179765/
Hi, I’m Paul Torgersen. It’s Monday May 31st, 2022, and this is a look at the information security news from overnight.
From ZDNet.com
Security researchers discovered a zero-day flaw called Follina that enables a malicious Word document to execute code via the Microsoft Support Diagnostic Tool, even when macros are disabled. There is no patch yet. For mitigation, Microsoft recommends disabling a protocol used for troubleshooting Windows bugs. Details and links in the article.
From BleepingComputer.com:
Hackers are showing an increased interest in the Windows Subsystem for Linux, or WSL, as an attack surface for new malware. Some of the more advanced samples are suitable for espionage and downloading additional modules. After the first malicious Linux binary for WSL was discovered just over a year ago, Black Lotus Labs says that since last fall, they have tracked more than 100 samples of WSL-based malware.
From TheSunDaily.my:
Italy is on high alert after the pro-Russian ‘Killnet’ hacker group said it would launch a cyber attack that would inflict “irreparable” damage on the country. Killnet has staged several attacks on Italian public institutions in recent weeks, including on the websites of the Senate and the defense ministry. All this in response to Italy backing Western sanctions on Russia following its invasion of Ukraine.
From PortSwigger.net:
A phishing attack on Australian pension provider Spirit Super has resulted in PII being leaked on some 50,000 customers. The personal data includes names and other sensitive information, but according to the company, does not include birthday, tax ID or driver’s license numbers, or bank account details.
And last today, from ThreatPost.com
A rapidly evolving IoT malware dubbed EnemyBot is targeting content management systems, web servers and Android devices, taking advantage of recently disclosed vulnerabilities in VMWare, Adobe, WordPress and others. The threat actor group Keksec is believed to be behind the distribution of the malware, which borrows code heavily from other botnets, such as Mirai, Qbot and Zbot. Details in the article.
That’s all for me today . Have a great rest of your day. And until tomorrow, be safe out there.