What are the opening hours?

Monday 9am - 5pm Tuesday 9am - 5pm Wednesday 9am - 5pm Thursday 9am - 5pm Friday 9am - 5pm Saturday 9am - 5pm

https://www.facebook.com/140256002497760/

ECS, Park view Edifice Building, Hyderabad (2026)

02/08/2024

𝗗𝗶𝗴𝗶𝗖𝗲𝗿𝘁 𝘁𝗼 𝗠𝗮𝘀𝘀-𝗥𝗲𝘃𝗼𝗸𝗲 𝗧𝗟𝗦 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲𝘀 𝗗𝘂𝗲 𝘁𝗼 𝗗𝗼𝗺𝗮𝗶𝗻 𝗩𝗮𝗹𝗶𝗱𝗮𝘁𝗶𝗼𝗻 𝗕𝘂𝗴

DigiCert has issued a warning about mass-revoking SSL/TLS certificates due to a bug in their domain validation process, necessitating affected customers to reissue certificates within 24 hours. The issue affects approximately 0.4% of domain validations conducted between August 2019 and June 2024, where a random value used for DNS CNAME-based validation lacked the required underscore prefix, potentially posing a collision risk.

This oversight, attributed to a system update in August 2019, was discovered during an investigation into random value generation. DigiCert has since consolidated its random value generators and implemented measures to enhance compliance and testing, aiming to prevent future incidents. Affected customers must log into their CertCentral accounts, identify impacted certificates, generate new Certificate Signing Requests (CSRs), and undergo a new Domain Control Verification process to reissue certificates promptly to avoid disruption of service.

02/08/2024

𝗢𝘃𝗲𝗿 𝟭 𝗠𝗶𝗹𝗹𝗶𝗼𝗻 𝗗𝗼𝗺𝗮𝗶𝗻𝘀 𝗮𝘁 𝗥𝗶𝘀𝗸 𝗼𝗳 '𝗦𝗶𝘁𝘁𝗶𝗻𝗴 𝗗𝘂𝗰𝗸𝘀' 𝗗𝗼𝗺𝗮𝗶𝗻 𝗛𝗶𝗷𝗮𝗰𝗸𝗶𝗻𝗴

Over a million domains are vulnerable to a sophisticated cyber attack known as Sitting Ducks, recently highlighted by a joint analysis from Infoblox and Eclypsium. This attack method allows malicious actors, predominantly Russian-nexus cybercriminals, to stealthily hijack domains by exploiting weaknesses in the domain name system (DNS).

Unlike other domain hijacking techniques, Sitting Ducks does not require access to the domain owner's accounts directly. Instead, attackers exploit misconfigurations in both the domain registrar and authoritative DNS provider, allowing them to seize control of registered domains.

This method is particularly insidious because it is easier to execute, more likely to succeed undetected, and harder to mitigate compared to other known attacks. Once compromised, these domains can be used for a variety of malicious activities, from distributing malware and spam to perpetrating scams and hoax threats, exploiting the trust associated with legitimate domain owners.

30/07/2024

𝗔𝗰𝗿𝗼𝗻𝗶𝘀 𝗔𝗹𝗲𝗿𝘁𝘀: 𝗖𝘆𝗯𝗲𝗿 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗗𝗲𝗳𝗮𝘂𝗹𝘁 𝗣𝗮𝘀𝘀𝘄𝗼𝗿𝗱 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗲𝗱 𝗶𝗻 𝗔𝘁𝘁𝗮𝗰𝗸𝘀

Acronis has warned customers to patch a critical Cyber Infrastructure security flaw that allows attackers to bypass authentication on vulnerable servers using default credentials. Acronis Cyber Infrastructure (ACI) is a unified multi-tenant platform combining remote endpoint management, backup, and virtualization capabilities, aiding disaster recovery workloads and securely storing enterprise backup data.

Over 20,000 service providers use ACI to protect more than 750,000 businesses across 150+ countries. The vulnerability, tracked as CVE-2023-45249, can be exploited in low-complexity attacks that require no user interaction, enabling remote code ex*****on on unpatched ACI servers. Despite being patched nine months ago, the flaw affects multiple ACI builds before specific versions.

Acronis has confirmed that the bug has been exploited in attacks and has urged admins to update their installations immediately, emphasizing the critical nature of the vulnerability. Users should log into their accounts, download the latest ACI build from the "Products" section, and install it on vulnerable servers. Detailed patch protocols and support guidelines are available on the Acronis security advisory page.

29/07/2024

𝗙𝗼𝗿𝘁𝗶𝗚𝘂𝗮𝗿𝗱 𝗟𝗮𝗯𝘀 𝗧𝗵𝗿𝗲𝗮𝘁 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵: 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻 𝗧𝗮𝗿𝗴𝗲𝘁𝗶𝗻𝗴 𝗜𝗻𝗱𝗶𝗮𝗻 𝗠𝗼𝗯𝗶𝗹𝗲 𝗨𝘀𝗲𝗿𝘀 𝘄𝗶𝘁𝗵 𝗜𝗻𝗱𝗶𝗮 𝗣𝗼𝘀𝘁 𝗟𝘂𝗿𝗲𝘀

The FortiGuard Labs Threat Research team has detected a fraud campaign targeting iPhone users in India, leveraging India Post lures. This campaign involves smishing attacks where users receive an iMessage claiming a package is waiting at an India Post warehouse.

Public reporting attributes this to the China-based Smishing Triad, previously targeting regions like the US, UK, and Pakistan. These scams use third-party email addresses via iMessage, leading to fraudulent sites.

Analysis shows over 470 domains mimicking India Post, with a significant number registered through a Chinese registrar, Beijing Lanhai Jiye Technology Co., Ltd. Most domains use TLDs like 'vip' and 'top,' hosted mainly by Tencent. The cloned phishing sites collect sensitive user information and request credit card details for redelivery charges.

The attackers’ modus operandi involves sending iMessages to Apple ID email addresses, ensuring messages appear legitimate. Recommendations include verifying URLs, using strong passwords, enabling MFA, and reporting phishing attempts.

The investment in domain registrations indicates the scale and long-term potential impact of these phishing operations, highlighting the need for awareness and proactive measures. Fortinet provides protections through URL Filtering Services and training programs to help users recognize and avoid phishing threats.

26/07/2024

𝗗𝗼𝗰𝗸𝗲𝗿 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗔𝗱𝘃𝗶𝘀𝗼𝗿𝘆: 𝗔𝘂𝘁𝗵𝗭 𝗣𝗹𝘂𝗴𝗶𝗻 𝗕𝘆𝗽𝗮𝘀𝘀 𝗥𝗲𝗴𝗿𝗲𝘀𝘀𝗶𝗼𝗻 𝗶𝗻 𝗗𝗼𝗰𝗸𝗲𝗿 𝗘𝗻𝗴𝗶𝗻𝗲

Docker’s default authorization model is all-or-nothing, allowing users with access to the Docker daemon to execute any Docker command. Authorization plugins (AuthZ) provide greater access control by approving or denying requests to the Docker daemon based on authentication and command context. In 2018, a security issue was discovered where an attacker could bypass AuthZ plugins using a specially crafted API request, potentially leading to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later versions, resulting in a regression.

An attacker could exploit this bypass using an API request with Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin, which might approve the request incorrectly if not set to deny by default.

The issue was fixed in Docker Engine v18.09.1 in January 2019 but not included in Docker Engine v19.03 or newer versions. This regression was identified in April 2024, and patches were released on July 23, 2024, with the issue assigned CVE-2024-41110. Affected versions include

25/07/2024

𝗣𝗼𝘁𝗲𝗻𝘁𝗶𝗮𝗹 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗶𝗻 𝗟𝗮𝗻𝗴𝗖𝗵𝗮𝗶𝗻 𝗚𝗲𝗻 𝗔𝗜

Researchers from Palo Alto Networks have identified two vulnerabilities in LangChain, a popular open-source generative AI framework with over 81,000 stars on GitHub. The vulnerabilities, CVE-2023-46229 and CVE-2023-44467, affected LangChain and its experimental version, respectively.

These flaws could have allowed attackers to execute arbitrary code and access sensitive data. LangChain has since issued patches to resolve these vulnerabilities. Palo Alto Networks advises users to update to the latest version to ensure protection. The company also highlights how their products, such as Next-Generation Firewall, Prisma Cloud, and Cortex XDR, provide additional security against these types of attacks.

LangChain is widely used for LLM app development, offering components for integrating advanced LLM capabilities into applications. The identified vulnerabilities were promptly addressed by LangChain, but they underscore the importance of rigorous validation and continuous monitoring in AI-driven development.

24/07/2024

𝗙𝗿𝗼𝘀𝘁𝘆𝗚𝗼𝗼𝗽 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗗𝗶𝘀𝗿𝘂𝗽𝘁𝘀 𝗛𝗲𝗮𝘁𝗶𝗻𝗴 𝗶𝗻 𝟲𝟬𝟬 𝗨𝗸𝗿𝗮𝗶𝗻𝗶𝗮𝗻 𝗔𝗽𝗮𝗿𝘁𝗺𝗲𝗻𝘁 𝗕𝘂𝗶𝗹𝗱𝗶𝗻𝗴𝘀

A previously unseen malware, dubbed FrostyGoop, disrupted industrial processes in a cyberattack against a district energy company in Lviv, Ukraine, during January 2024, leaving residents of over 600 apartment buildings without heat for two days in sub-zero temperatures.

The attack, targeting temperature controllers of the municipal district energy company, altered controller values to falsely indicate higher temperatures, resulting in the circulation of cold water instead of heated water.

The Cyber Security Situation Center (CSSC) of Ukraine, in collaboration with Dragos, revealed that FrostyGoop, the ninth malware identified to target industrial control systems (ICS), used the Modbus protocol to communicate with and manipulate these systems.

Dragos' analysis indicated the malware, written in Golang for Windows and communicating over Modbus TCP port 502, could potentially disrupt various ICS devices globally due to Modbus' widespread and poorly secured usage.

The attack originated in April 2023 when intruders exploited a vulnerability in a Mikrotik router, deploying a web shell and later conducting the attack remotely from a Moscow-based IP address.

Dragos emphasized the need for better OT network security, including removing Modbus-exposed devices from the internet and enhancing ICS visibility and monitoring, to mitigate such threats. Although FrostyGoop specifically targets vulnerable, low-security systems, it highlights the pressing need for improved cybersecurity measures in critical infrastructure sectors.

23/07/2024

𝗔𝘁𝘁𝗲𝗻𝘁𝗶𝗼𝗻 𝗚𝗿𝗮𝗻𝗱 𝗧𝗵𝗲𝗳𝘁 𝗔𝘂𝘁𝗼 𝗙𝗮𝗻𝘀! 𝗙𝗮𝗸𝗲 𝗚𝗧𝗔 𝗩𝗜 𝗕𝗲𝘁𝗮 𝗗𝗼𝘄𝗻𝗹𝗼𝗮𝗱 𝗗𝗶𝘀𝘁𝗿𝗶𝗯𝘂𝘁𝗲𝘀 𝗠𝗮𝗹𝘄𝗮𝗿𝗲

Grand Theft Auto (GTA) is a household name in gaming, and Rockstar Games, the developer behind GTA, has announced the release of Grand Theft Auto VI in Autumn 2025 for PS5 and Xbox Series, which has got fans all excited.

However, this presents threat actors with the perfect opportunity to exploit fans, with Bitdefender researchers detecting suspicious Facebook ads promoting fake beta versions for free download on PC. Social media users, particularly those following GTA content, might encounter sponsored ads promising early access to a non-existent GTA VI beta.

These ads often showcase tempting features, early release dates, and even include convincing-looking gameplay footage, likely stolen from 2022’s Rockstar data breach and other sources. According to Bitdefender‘s report, between July 16 and 18, researchers came across a page promoting free access to the GTA beta version for the first 100 people through sponsored ads.

This page was running three different ads all using the same message and visuals, targeting people aged 18-65. The malicious domain used in the ad was created on June 27, 2024, and was also hosting another Ethereum scam. Users in Europe, including France, Poland, Romania, Germany, Spain, Hungary, Italy, Greece, the Netherlands, and Sweden, were the primary targets.

Security researcher Andrei Mogage’s analysis revealed that the MSI file downloaded through the Facebook ad impersonated a legitimate GTA VI installer and mimicked the installation process. The file shared similarities with FakeBat loader malware that deployed malicious payloads and PowerShell scripts to download next-stage malware like info-stealers and RATs. Clicking the ad leads to a website mimicking a legitimate download page. Here, a user might be prompted to download an ‘exclusive beta client’ or complete a survey to gain access.

These downloads aren’t beta versions; they’re malware in disguise. It is worth noting that Rockstar Games has not announced a beta program for GTA VI. The three malicious samples available for download from the ads were “broken” and could not execute payloads or exfiltrate data. As of July 19, none of these malicious ads remain active. While the reported malicious ads may be removed, there could be hundreds of such malicious ads currently running on social media, especially Facebook, which is known for approving malicious ads.

In February 2024, Savvy Seahorse, a DNS threat actor, was found using Facebook ads to promote and lure unsuspecting victims into its investment scams. In November 2023, Facebook displayed AI-generated “provocative” ads that spread NodeStealer malware. Back in April 2021, Facebook approved an advertisement that displayed and distributed a Facebook Messenger phishing link.

22/07/2024

𝗡𝗼𝗿𝘁𝗵 𝗞𝗼𝗿𝗲𝗮 𝗦𝘂𝘀𝗽𝗲𝗰𝘁𝗲𝗱 𝗼𝗳 𝗛𝗮𝗰𝗸𝗶𝗻𝗴 𝗜𝗻𝗱𝗶𝗮𝗻 𝗖𝗿𝘆𝗽𝘁𝗼 𝗘𝘅𝗰𝗵𝗮𝗻𝗴𝗲 𝗪𝗮𝘇𝗶𝗿𝗫

Indian crypto exchange WazirX has revealed it lost virtual assets valued at over $230 million after a cyber attack that has since been linked to North Korea. According to a late Thursday WazirX Xeet, the attack targeted one of its multi-signature wallets – digi-cash lockers designed to offer superior security by requiring multiple private keys to authorize a transaction.

WazirX's transaction verification process requires approval by multiple parties. The hacked wallet had six signatories – five from the WazirX team and one from Liminal. Most transactions on the WazirX platform require approval from three of the company's signatories, plus final approval from Liminal's signatory.

The attack exploited a discrepancy between Liminal's interface and the actual transaction data, allowing the attacker to gain control of the wallet and bypass the multi-signature security measures, WazirX explained. After discovering the breach, WazirX halted all crypto withdrawals, blocked some deposits, and reached out to affected wallet owners for recovery assistance.

The crypto exchange described the incident as a "force majeure" event, a term usually reserved for natural disasters or wars. WazirX claimed it took all necessary steps to protect customer assets but acknowledged the cyber attackers breached security features.

The exchange is actively working to locate and recover the stolen funds. Blockchain analytics platform Lookchain published a breakdown of the stolen WazirX assets, suggesting the thief is already seeking buyers. UK-based blockchain analytics firm Elliptic noted the thief has started swapping stolen tokens for Ether using decentralized services, and concluded the attackers are affiliated with North Korea.

North Korea has turned to cryptocurrency as a source of funds amid international sanctions, allegedly running crypto-stealing operations to fund its nuclear weapons program and enrich the ruling family. WazirX, claiming roughly 16 million users, was acquired in 2019 by Binance, though ownership disputes remain.

Binance was suspended from operating in India in December 2023 for violating anti-money laundering rules but was cleared to operate again last month, subject to a $2.25 million fine. WazirX also faced regulatory issues in India, with $8.1 million frozen in August 2022 as part of money laundering investigations.

Legislation to regulate cryptocurrency in India is still under consideration. Joanna Cheng, associate general counsel at NYC-based cryptocurrency custody and security firm Fireblocks, stated the industry would benefit from clear regulatory expectations on security standards, risk management, and consumer protection.

18/07/2024

𝗨𝗿𝗴𝗲𝗻𝘁 𝗨𝗽𝗱𝗮𝘁𝗲 𝗳𝗼𝗿 𝗪𝗣 𝗧𝗶𝗺𝗲 𝗖𝗮𝗽𝘀𝘂𝗹𝗲 𝗣𝗹𝘂𝗴𝗶𝗻 𝗗𝘂𝗲 𝘁𝗼 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗙𝗹𝗮𝘄

Security researchers have discovered a vulnerability in the Backup and Staging by WP Time Capsule plugin, affecting versions 1.22.20 and below. This WordPress plugin, with over 20,000 active installations, facilitates website backups and update management through cloud-native file versioning systems. However, a flaw allowed unauthorized users to exploit a broken authentication mechanism, potentially gaining administrative access to affected sites.

The vulnerability, found by Patchstack, stemmed from a logical error in the plugin’s code, specifically in the wptc-cron-functions.php file. Attackers could bypass critical authentication checks by manipulating JSON-encoded POST data to elevate their privileges and log in as site administrators.

Patchstack explained that the flaw allowed any unauthenticated user to log into the site as an administrator with a single request, provided the plugin was set up with a connection to the wptimecapsule.com site. The issue was reported to the plugin developers on July 3, who quickly released version 1.22.20 within six hours to mitigate the initial vulnerability. However, the initial patch was only partially effective, leading to the release of version 1.22.21 on July 12, which included a more robust security fix involving additional hash comparisons to prevent further exploitation.

Patchstack emphasized the importance of rigorous security protocols in plugin development for WordPress and other platforms, recommending proper access control and authorization checks when writing functions that involve setting the authorization of a request based on user input variables. Users of the WP Time Capsule plugin are strongly advised to update to version 1.22.21 or later immediately to ensure their sites are protected.

17/07/2024

𝗙𝗮𝗰𝗲𝗯𝗼𝗼𝗸 𝗔𝗱𝘀 𝗳𝗼𝗿 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗗𝗲𝘀𝗸𝘁𝗼𝗽 𝗧𝗵𝗲𝗺𝗲𝘀 𝗗𝗶𝘀𝘁𝗿𝗶𝗯𝘂𝘁𝗲 𝗜𝗻𝗳𝗼-𝗦𝘁𝗲𝗮𝗹𝗶𝗻𝗴 𝗠𝗮𝗹𝘄𝗮𝗿𝗲

Cybercriminals are exploiting Facebook business pages and advertisements to distribute the SYS01 password-stealing malware by promoting fake Windows themes.

Trustwave researchers observed that the threat actors also push fake downloads for pirated games, software, Sora AI, 3D image creator, and One Click Active. These campaigns, leveraging Facebook's massive reach, pose a significant threat as the ads promote free game downloads and software activation cracks for popular applications.

Threat actors either create new Facebook business pages or hijack existing ones, renaming them to match their advertisement themes and exploit the existing follower base. Thousands of ads per campaign direct users to fake download pages hosted on Google Sites or True Hosting, which offer free software and game downloads. However, these downloads contain the SYS01 malware, first discovered by Morphisec in 2022, designed to steal browser cookies, saved credentials, browser history, and cryptocurrency wallets.

The malware also uses Facebook cookies to steal account information, including personal data and advertising account details. The stolen data is stored temporarily before being sent to the attackers, who can sell it or use it to breach further accounts. Trustwave has also seen similar malvertising profiles on LinkedIn and YouTube, emphasizing the need for social media users to remain vigilant.

This campaign marks a shift in the SYS01 malware's delivery method from adult-themed clickbaits to targeting a general audience with ads for Windows themes and AI-based software tools. In February, Trustwave reported a similar campaign involving the Ov3r_Stealer malware.

16/07/2024

𝗠𝗮𝗹𝘃𝗲𝗿𝘁𝗶𝘀𝗶𝗻𝗴 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻 𝗧𝗮𝗿𝗴𝗲𝘁𝘀 𝗠𝗮𝗰 𝗨𝘀𝗲𝗿𝘀 𝘄𝗶𝘁𝗵 𝗙𝗮𝗸𝗲 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗧𝗲𝗮𝗺𝘀 𝗔𝗱

A sophisticated malvertising campaign is targeting Mac users searching for Microsoft Teams, highlighting the growing competition among malware creators in the macOS ecosystem. This latest attack, which uses Atomic Stealer malware, follows closely on the heels of the Poseidon (OSX.RodStealer) project, indicating growing advancements in threats affecting macOS.

The deceptive Microsoft Teams for macOS ad campaign, which ran for several days, employed advanced filtering techniques to evade detection. Appearing as a top search result for Microsoft Teams, the ad displayed microsoft.com as its URL but actually redirected users through a series of deceptive links.

The ad was likely paid for by a compromised Google ad account. Initially, the ad redirected straight to Microsoft’s website, but after multiple attempts and tweaks, a full attack chain was finally observed. Researchers from Malwarebytes stated that upon clicking the ad, users were subjected to a profiling process to ensure only actual people proceeded, helping the malicious site evade detection from automated security tools and scans.

A cloaking domain separated the initial redirect from the malicious landing page, which mimicked the design of the official Microsoft Teams download site. The ad, with a display URL showing Microsoft.com, led to a fake installation page. The advertiser, located in Hong Kong, runs over a thousand unrelated ads.

Further investigation revealed that the ad used a unique payload for each visitor, generated from a domain called locallyhyped.com. Once the downloaded file was opened, users were instructed to enter their password and grant access to the file system, allowing the malicious application to steal keychain passwords and important files. The data was then exfiltrated via a single POST request to a remote attacker-controlled web server.

To avoid such attacks, researchers advised caution when downloading applications via search engines. Using browser protection tools with the ability to block ads and malicious websites, regularly updating antivirus software, and employing a reputable ad blocker can help minimize the risk of malware infection.

This campaign underscores the increasing sophistication of macOS malware due to the keen interest demonstrated by threat actors in compromising the operating system’s environment. Last year, researchers from Cyble Research and Intelligence Labs (CRIL) observed that the Atomic Stealer used in this campaign had been offered via Telegram at the price of $1000 USD per month.

ECS

02/08/2024

02/08/2024

30/07/2024

29/07/2024

26/07/2024

25/07/2024

24/07/2024

23/07/2024

22/07/2024

18/07/2024

17/07/2024

16/07/2024

Address

Opening Hours

Website

Alerts

Shortcuts

Share

Category

Monday	9am - 5pm
Tuesday	9am - 5pm
Wednesday	9am - 5pm
Thursday	9am - 5pm
Friday	9am - 5pm
Saturday	9am - 5pm