Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

April 2022

Critical Vulnerability in Multiple WSO2 Products Exploited - CVE-2022-29464

Over the past week, threat actors have started scanning for and opportunistically exploiting CVE-2022-29464--a remote code execution vulnerability in multiple WSO2 products used to integrate application programming interfaces (API), applications, and web services. CVE-2022-29464 vulnerability has a CVSS score of 9.8 and severity of Critical which allowed unauthenticated and remote attackers to execute arbitrary code in the following products.

Cybersecurity Best Practices for the Oil and Gas Industry

While every sector of the economy experiences cyber attacks, the oil and gas industry is a particularly enticing target because there are inherent weaknesses in its rapidly expanding digital landscape. It's also an industry that can't afford to go offline at any time, which means cybercriminals can force quick action from those they attack.

How the Arctic Wolf Platform Can Stop Business Email Compromise Attacks

In this whiteboard session, Matt Trushinski, Director of Product Marketing, shows how the Arctic Wolf® Platform can stop business email compromise attacks by using a real-life example from a customer. Additional Resources: About Arctic Wolf.

Arctic Wolf Security Operations Cloud

In this whiteboard session, Brandon Tschida, Director, Presales Engineering, walks you through the Arctic Wolf® Security Operations Cloud. Threats are increasing at an exponential rate and the traditional approach of leveraging tools to combat the problem no longer works. With growing threat alerts and a lack of trained people to hire, organizations need a new approach to stay secure. With Arctic Wolf's Security Operations Cloud, security operations are delivered as a concierge service. Reduce the noise at your organization and only receive 1-2 real alerts in any given week.

How the Arctic Wolf Platform Stops Active Ransomware

In this whiteboard session, Matt Trushinski, Director of Product Marketing, shows how the Arctic Wolf® Platform can stop ransomware by using a real-life example from a customer. The incident started after a bad actor with stolen credentials logged into multiple systems at 5:23 a.m. Learn the details of how Arctic Wolf's Triage Team began investigating within minutes to alert the customer and stop the active ransomware in its tracks.

How the Arctic Wolf Platform Helps Reduce Cyber Risk

In this whiteboard session, Matt Trushinski, Director of Product Marketing, shows how the Arctic Wolf® Platform helps reduce cyber risk by ingesting raw telemetry from a customer's environment and turning it into high-quality, actionable security alerts. Learn how the platform can parse, enrich, and analyze data to improve a customer's security posture over time and harden their environment—and, ultimately, end cyber risk at their organization.

The Cybersecurity Dangers of Cryptocurrency

Cryptocurrency, the next generation of money. Adored by luminaries from Elon Musk to Snoop Dogg. Now the official currency of El Salvador, and a funding source for Ukrainian resistance to the Russian invasion. But is crypto really all that it seems? Cryptocurrency has tremendous potential to address a host of the world’s financial issues: from limited access to financial resources, to ineffective and costly payment and transfer services.

Newly Proposed Rules from the SEC Mean New Requirements for the Financial Industry and Public

On March 9, the US Securities and Exchange Commission (SEC) issued proposed rules regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies. SEC Chair Gary Gensler highlighted in the press release that “Over the years, our disclosure regime has evolved to reflect evolving risks and investor needs. Today, cybersecurity is an emerging risk with which public issuers increasingly must contend.

What Is Cryptojacking and How Can You Defend Against It?

It should come as no surprise that as cryptocurrencies become more popular and edge towards the mainstream, the mining of these digital currencies—which uses computing power to solve complex math problem— has given rise to a new form of cyber attack: cryptojacking. Cryptojacking may sound like a way to steal someone's cryptocurrency assets, but it's a less obvious form of theft.

The Karakurt Web: Threat Intel and Blockchain Analysis Reveals Extension of Conti Business Model

Tetra Defense, an Arctic Wolf® company, partnered with Chainalysis to analyze the link between the Karakurt cyber extortion group to both Conti and Diavol ransomware through Tetra’s digital forensics and Chainalysis’ blockchain analytics. As recent leaks have revealed, Conti and Trickbot are complicated operations with sophisticated structures. But, our findings indicate that web is even wider than originally thought, to include additional exfiltration-only operations.

Wormable Vulnerability in Windows Remote Procedure Call (RPC) - CVE-2022-26809

April Patch Tuesday brings 145 vulnerability fixes from Microsoft — the highest number in 19 months—including CVE-2022-26809, a critical remote code execution (RCE) vulnerability in Windows Remote Procedure Call (RPC) Runtime library that impacts all supported Windows products. Notably, Microsoft also released security updates for Windows 7, an end-of-life product since January 2020, which highlights the severity of CVE-2022-26809.

NginxDay: Vulnerabilities in NGINX's LDAP Reference Implementation

On Monday, April 11, 2022, NGINX published a security blog post detailing three vulnerabilities in the NGINX LDAP reference implementation. NGINX is web server software that also performs reverse proxy, load balancing, email proxy, and HTTP cache services. No CVE has been assigned to these vulnerabilities at this time. The reference implementation uses Lightweight Directory Access Protocol (LDAP) to authenticate users of NGINX proxied applications.

Multiple Critical Vulnerabilities Disclosed in VMware Products

On Wednesday, April 6, 2022, VMware disclosed several critical-severity vulnerabilities impacting multiple VMware products. If successfully exploited, the vulnerabilities could lead to Remote Code Execution (RCE) or Authentication Bypass. In addition to the critical severity vulnerabilities, VMware disclosed several high and medium severity vulnerabilities, which could lead to Cross Site Request Forgery (CSRF), Local Privilege Escalation (LPE), or Information Disclosure.

Top Cyber Attacks of March 2022

In an unsettling new phase of the cybersecurity era, Russia’s ground war in Ukraine and behind-the-scenes war on the internet have dovetailed into an upswing of cybercrime that may or may not be politically motivated. Time will tell how this online maneuvering ultimately plays out, but for the moment tension abounds as the cybersecurity community anticipates the next big attack.

Casino Cybersecurity: A Winning Bet

According to the American Gaming Association, there are 981 casinos in the United States, raking in more than $57 billion annually in gross gaming revenue. With that much money at play, it’s no wonder hackers view casinos as potential jackpots. And while the public tends to consider casinos as exceptionally secure, the reality is this: When it comes to cybersecurity, the house doesn’t always win.

GitLab Password Security Vulnerability - CVE-2022-1162

On Thursday, March 31, 2022, GitLab released an advisory for a critical password security vulnerability in GitLab Community and Enterprise products tracked as CVE-2022-1162. GitLab is DevOps software that combines the ability to develop, secure, and operate software in a single application. The exploitation of CVE-2022-1162 can allow a threat actor to guess a hard-coded password for any GitLab account with relative ease.