Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

October 2022

Trustwave Launches Value-Driven Enterprise Pen Testing Offering

Trustwave has enhanced its pen testing offering to now include a high-quality, cost-effective offering to larger organizations. This new Enterprise Pen Testing (EPT) offering is designed to meet the complex testing needs of these organizations with an extensive breadth and depth of vulnerability identification, ability to deliver scaled programs of work, at an extremely competitive price point.

Insta-Phish-A-Gram

Following Trustwave SpiderLabs’ blog on social media-themed phishing on Facebook, comes another flavor of ‘infringement’ phishing. In this case, the targets, still under the umbrella of Meta, are Instagram users. This theme is not new, and we have seen it from time to time over the last year. It’s the same copyright infringement trickery again, but this time, the attackers gain more personal information from their victims and use evasion techniques to hide phishing URLs.

The Necessity of Conducting a Physical Security Assessment

Having the most advanced, artificially intelligent-featured security software certainly makes a company “sound” secure, and in fact, those defenses do help stop most advanced attacks. But not all attacks involve complicated ransomware, spearfishing, or DDoS attacks. What organizations have to remember is their computer network is only one threat vector they have to worry about. And it’s not even the most obvious.

Trustwave Launches Enhanced Co-Managed SOC Capabilities to Help Clients Maximize SIEM Value and Productivity

Trustwave's Co-Managed SOC (Security Operations Center) is a powerful offering that has a tremendous track record of helping organizations maximize the value realized from their SIEM (Security Information and Event Management) investment, reducing alert noise by up to 90%, while maintaining a position of “your SIEM, your content.” The service has just received a major enhancement with the addition of Trustwave’s one-of-a-kind cybersecurity collaboration platform, Security Colony, whic

Archive Sidestepping: Self-Unlocking Password-Protected RAR

Trustwave SpiderLabs’ spam traps have identified an increase in threats packaged in password-protected archives with about 96% of these being spammed by the Emotet Botnet. In the first half of 2022, we identified password-protected ZIP files as the third most popular archive format used by cybercriminals to conceal malware.

Say Hello to SpiderLabs: The Team Behind Trustwave's Security Product Offerings

SpiderLabs is among the most well-respected teams in the cybersecurity industry, having gained a reputation for conducting cutting-edge research, plying the foggy corners of the darkweb for information, and detecting and hunting down threats. What is less well known is how Trustwave’s SpiderLabs’ various teams’ function and then pull together to create the formidable force that is the backbone of all of Trustwave’s offerings.

ModSecurity Request Body Parsing: Recent Bypass Issues

ModSecurity is an open-source web application firewall (WAF) engine maintained by Trustwave. This blog post discusses multiple input interpretation weaknesses in the ModSecurity project. Each input interpretation weakness could allow a malicious actor to evade some ModSecurity rules. Both ModSecurity v2 and ModSecurity v3 were affected. The issues have been addressed in v2.9.6 and v3.0.8, respectively.

Trustwave Recognized in the IDC MarketScape for Managed Cloud Security Services for the Multi-cloud Era

Trustwave has been recognized in the IDC MarketScape: Worldwide Managed Cloud Security Services in the Multicloud Era Vendor Assessment (doc #US48761022, September 2022). Trustwave, a pure-play cybersecurity services provider, is well positioned in the market. It shows the market acceptance for specialized security skills from its MSS providers.

HTML File Attachments: Still A Threat

This past month, Trustwave SpiderLabs observed that HTML (Hypertext Markup Language) file attachments had become a common occurrence in our spam traps, which is not unusual since malware is often delivered through phishing spam. For the past 30 days, SpiderLabs has found the combination of.HTML (11.39%) and.HTM (2.7%) files are our second most spammed file attachment, totalling 14.09%, followed by.EXE files at 12.84%.

Post-Exploitation Persistent Email Forwarder in Outlook Desktop

There is an exploitation method that can automatically forward emails CC’d to external addresses via an Outlook Desktop rule, even when this action is prevented on the corporate Exchange server. This can be a serious data exfiltration risk allowing post-exploitation persistence in a previously breached account. The legitimate email account owner is highly likely to be unaware of the creation of this rule.

Through the Looking Glass of Risk: An Analysis of the SOCI Reforms as a Case Study for critical Infrastructure Security Regulation

This blog examines some interesting aspects of the recent reforms to Australia's Security of Critical Infrastructure Act - specifically related to the new risk management obligations that have been introduced. We'll unpack some of the ambiguities that exist and remain to be clarified in this specific area of the reforms.

Trustwave Action Response: Zero Day Vulnerabilities in Microsoft Exchange Server 2013, 2016, and 2019

Trustwave security teams are aware of two zero-day vulnerabilities (CVE-2022-41040 and CVE-2022-41082) impacting Microsoft Exchange Server 2013, 2016, and 2019 and organizations with Outlook Web Access facing the Internet. If exploited, the vulnerabilities can allow an attacker to elevate privilege and remote code execution capability. We immediately investigated the vulnerabilities and potential exploits and continue to monitor the situation.