vulnerabilities
JetBrains' platform "a suitable vector to position an attacker to perform a supply chain attack" if compromised warns Rapid7.
"The executable in question was built using the LockBit 3 ransomware builder tool leaked in 2022, so this particular sample may not have originated with the actual LockBit developers"
"There might be active exploitation attempts across common AWS IP space"
As a major Exchange Service update lands, Redmond admits "it is possible that some functionality may break after installing CU14..."
"Threat actors have recently developed workarounds to current mitigations and detection methods and have been able to exploit weaknesses, move laterally, and escalate privileges without detection..."
A 10-line exploit is now widely available. Unpatched instances *will* come under attack.
There are no workarounds that remove the vulnerability, which allows unauthenticated remote command execution on vulnerable systems. A patch is available.
VPN appliances "all appear to have been constructed with the code equivalent of string, stamped with the word ‘secure’ and then just left to decay for 20 years..."
Attackers re-write JavaScript loaded by the VPN login page for the Appliance to capture credentials; also grabbed Veeam credentials, moved laterally for full SYSTEM control.