Threat Source newsletter (June 2, 2022) — An RSA Conference primer
Summary: Cisco Talos' June 2, 2022 newsletter previews its RSA Conference activities, including a June 7 session on threat actor trends and live Beers with Talos and Security Stories podcasts at the Marriott Marquis. It also covers the Follina zero-day in the Microsoft Windows Support Diagnostic Tool (CVE-2022-30190), which allows arbitrary code execution when MSDT is called via URL protocol from applications such as Word or an RTF file, and for which Microsoft has issued workarounds and Defender protections but no patch.
What's compelling: Follina is the latest in a string of Microsoft vulnerabilities over 12 months, after PrintNightmare and multiple Exchange Server issues, and attackers have shown they will keep looking for vulnerable Microsoft products to gain a foothold. The same newsletter notes Hive took down Costa Rica's health department online services after Conti's May ransomware attack, with experts citing evidence the two groups may be working together.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2022-30190
- Related
- CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 14, 2022