Threat Source newsletter for Aug. 6, 2020
Summary: Cisco Talos reports that the WastedLocker ransomware is now abusing a Windows memory management feature to evade detection and bypass ransomware protections already deployed on a victim machine, and the newsletter notes it has been potentially linked to a recent cyber attack on GPS service provider Garmin. Talos researchers also disclosed seven vulnerabilities in Microsoft Azure Sphere, a cloud-connected SoC platform for IoT security, including two chainable flaws that, assuming an attacker could flash a malicious application, would allow arbitrary writing anywhere in the /mnt/config partition and further privilege escalation.
Bottom line: WastedLocker's new technique is designed to defeat the ransomware protections you already have in place, and its potential link to the Garmin attack shows the operators are pursuing high-profile targets. The Azure Sphere flaws matter because they sit in the cloud-connected silicon meant to secure IoT devices, where a flashed malicious application is the entry condition.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026