Last week in security news, researchers uncovered an attack campaign that spent the past two years targeting Windows machines running MS-SQL servers. The security community also learned of a vulnerability that enabled attackers to steal the credentials of people using the Zoom Windows client.

Top Story of the Week: Inside Vollgar’s Campaign Against MS-SQL Servers

Guardicore Labs found that the campaign had been targeting Windows machines running MS-SQL servers since May 2018. The campaign used brute-force attacks in an attempt to access targeted Windows machines. Upon successful authentication, the campaign loaded backdoors and executed malicious modules containing crypto-miners and remote-access Trojans (RATs).

Researchers at Guardicore dubbed the campaign “Vollgar, blending together the Vollar cryptocurrency mined in this campaign with the attacks’ vulgar behavior.

Source: iStock

Also in Security News

• VelvetSweatshop Technique Used by Attack Campaign to Deliver LimeRAT: Researchers at Mimecast discovered an attack campaign that used “VelvetSweatshop” to password-protect a malicious Excel spreadsheet. As VelvetSweatshop is the default password employed by Excel to decrypt protected documents, this decision streamlined the attack chain by allowing the worksheet to bypass security tools and by not requiring users to manually enter a password.
• Zoom Vulnerability Allowed Attackers to Steal Windows Credentials: As reported by Bleeping Computer, security researchers found that the Zoom Windows client was vulnerable to a UNC path injection in the client’s chat feature. A digital attacker could have exploited the security flaw to steal the user’s Windows credentials.
• Indian Financial Institutions Targeted by Crimson RAT: Zscaler observed an attack campaign that used spear phishing emails to target Indian financial institutions. Those emails used either malicious PE executables or Office documents to deliver samples of Crimson RAT, malware that is capable of exfiltrating files and sending them to its command-and-control (C&C) server.

Security Tip of the Week: Improve Your Organization’s Password Security

Security professionals can help protect their organizations against brute-force attacks by improving their password security. They can do this by using multifactor authentication (MFA) wherever possible. Additionally, they should also consider working with a penetration testing service for the purpose of evaluating the overall password security of the organization.