April 6, 2020 By David Bisson 2 min read

Last week in security news, researchers uncovered an attack campaign that spent the past two years targeting Windows machines running MS-SQL servers. The security community also learned of a vulnerability that enabled attackers to steal the credentials of people using the Zoom Windows client.

Top Story of the Week: Inside Vollgar’s Campaign Against MS-SQL Servers

Guardicore Labs found that the campaign had been targeting Windows machines running MS-SQL servers since May 2018. The campaign used brute-force attacks in an attempt to access targeted Windows machines. Upon successful authentication, the campaign loaded backdoors and executed malicious modules containing crypto-miners and remote-access Trojans (RATs).

Researchers at Guardicore dubbed the campaign “Vollgar, blending together the Vollar cryptocurrency mined in this campaign with the attacks’ vulgar behavior.

Source: iStock

Also in Security News

  • VelvetSweatshop Technique Used by Attack Campaign to Deliver LimeRAT: Researchers at Mimecast discovered an attack campaign that used “VelvetSweatshop” to password-protect a malicious Excel spreadsheet. As VelvetSweatshop is the default password employed by Excel to decrypt protected documents, this decision streamlined the attack chain by allowing the worksheet to bypass security tools and by not requiring users to manually enter a password.
  • Zoom Vulnerability Allowed Attackers to Steal Windows Credentials: As reported by Bleeping Computer, security researchers found that the Zoom Windows client was vulnerable to a UNC path injection in the client’s chat feature. A digital attacker could have exploited the security flaw to steal the user’s Windows credentials.
  • Indian Financial Institutions Targeted by Crimson RAT: Zscaler observed an attack campaign that used spear phishing emails to target Indian financial institutions. Those emails used either malicious PE executables or Office documents to deliver samples of Crimson RAT, malware that is capable of exfiltrating files and sending them to its command-and-control (C&C) server.

Security Tip of the Week: Improve Your Organization’s Password Security

Security professionals can help protect their organizations against brute-force attacks by improving their password security. They can do this by using multifactor authentication (MFA) wherever possible. Additionally, they should also consider working with a penetration testing service for the purpose of evaluating the overall password security of the organization.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today