Threat Source newsletter (Nov. 11, 2021)
Summary: Microsoft's November 2021 security update disclosed 56 vulnerabilities across its software, hardware and firmware, including six critical flaws and 49 rated important. The only one Microsoft reports as actively exploited in the wild is CVE-2021-42292, an Excel flaw that lets an attacker bypass certain security settings and skip a security prompt. Cisco Talos also reported a Babuk ransomware campaign, attributed to an actor sometimes called Tortilla and operating since July 2021, mainly hitting users in the U.S. with smaller counts in the U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand.
What you should know: The one actively exploited bug in the batch is rated only important, not critical, and it works by removing the security prompt that email-borne attacks depend on - so patch priority cannot be read off the severity label alone. Talos assesses with moderate confidence that Tortilla's entry point was ProxyShell exploitation in Exchange Server via a China Chopper web shell.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-42292
- Related
- CVE-2021-42292: Microsoft Excel Security Feature Bypass Known Exploited Vulnerabilities · Nov 17, 2021Microsoft Patch Tuesday, November 2021 Edition Cyber Risks ·