#windows
-
New BigDiskBuster zero-day cuts off Windows Defender updates
Researcher Abdelhamid Naceri has dropped yet another exploit against Microsoft's built-in antivirus — this one keeps Defender from updating. It is roughly the tenth flaw in his drawn-out feud with the company.
-
Fake LastPass Installer Kills Antivirus With a Microsoft-Signed Driver
A bogus LastPass Authenticator page on GitHub served an installer that used a legitimately signed kernel driver to switch off security software before stealing passwords.
-
Chinese Group FamousSparrow Targets Latin American Governments with the SparroWocky Backdoor
ESET researchers have discovered a new modular backdoor, SparroWocky, that the China-linked group FamousSparrow is using for cyberespionage against government organizations in Latin America.
-
Iranian hackers spy on activists with the CHOSEN BRICK spyware
Government agencies in the US, the UK and the Netherlands, together with the FBI, have warned about a Windows malware that Iran's intelligence services use against dissidents, activists and journalists around the world.
-
Microsoft Ships Emergency Patches to Fix Remote Desktop Failures
Out-of-band Windows updates fix the Remote Desktop Services outages caused by the September patches, along with problems affecting Hyper-V and USB audio.
-
How a Single Link Opened a Backdoor Through the Sogou Keyboard for 455 Million Users
The China-linked group UNC3569 used a vulnerability in the popular Sogou input method to install the GRAYRABBIT backdoor. A single click on a link turned out to be enough.
-
Four Spy Groups Adopted the Same BlueMoon Exploit Kit Within a Week
Proofpoint has detailed a previously unknown exploit kit called BlueMoon that chains together Chrome and Windows vulnerabilities. Within a matter of days it was picked up by several cyberespionage groups, most of them linked to China.
-
“ShieldCrash”: a new zero-day exploit for Microsoft Defender grants SYSTEM privileges
An anonymous researcher going by the handle Nightmare Eclipse has released an exploit for Microsoft Defender right after September's “Patch Tuesday.”
-
Microsoft Patches Nearly a Thousand Vulnerabilities in a Single Month — a New Record
Microsoft's September update bundle fixed no fewer than 974 vulnerabilities — the largest in the company's history. AI is speeding up the hunt for holes, but administrators can no longer keep up with testing and deploying the fixes.
-
Bill Gates's “Flame”: How the Microsoft Founder Spent an Hour Fighting to Install Movie Maker
A leaked internal email from 2003, surfaced in court records, shows Bill Gates in the role of an ordinary Windows user — and the ordinary user was thoroughly displeased.
-
REVSTEALER leaves four modules behind — one disables Windows Update and Defender to make room for a miner
Elastic Security Labs has documented four previously unknown programs tied to a new Windows stealer, REVSTEALER. Unlike the stealer itself, they persist on the system — and one of the modules muzzles the defenses to launch a cryptominer.
-
Researcher Publishes FalconFlank — a 0day Exploit for CrowdStrike Falcon
A hacker going by the handle Chaotic Eclipse has released a PoC for a privilege-escalation vulnerability in CrowdStrike Falcon — already the third exploit against popular security products in a short span.
-
Windows 11 to enable memory protection on more devices — at the cost of gaming performance
Microsoft will start turning on memory integrity on eligible devices as soon as next month. The protection works at the kernel level, but on older processors it can lower frame rates in games.
-
Defrag98: a browser-based simulator of the Windows 98 disk defragmenter
Defrag98 has surfaced online — a web page that recreates the hypnotic grid of the Windows 98 disk defragmenter. No practical use, just nostalgia.
-
ReactOS 0.4.16: a graphical installer and improved hardware support
The open-source Windows alternative project has released a major new version featuring a graphical installer, a Server Core mode and numerous driver improvements.
-
HOOKEDGE: How APT28 Hides Espionage in Free Webhooks
Researchers at Recorded Future have detailed a new backdoor from the Russian group APT28 that has targeted diplomats in Romania, Spain and Turkey and disguises its command-and-control as ordinary network traffic.
-
SLEEPWALKER: the backdoor that sleeps until one “magic packet” arrives
An independent researcher has described a previously unknown Windows backdoor that lies dormant in memory until it receives a specially crafted network packet, then executes commands written in a custom 23-instruction language.
-
ReactOS Gains Support for Job Objects — a Step Toward Running Modern Windows Applications
Initial support for Job Objects — a key Windows kernel mechanism required by browsers and other modern software — has been added to the ReactOS codebase.
-
Microsoft Defender's Own Driver Turned into a Weapon Against Security Software
Check Point researchers have shown how Windows Defender's built-in bootstrap driver can be used for arbitrary kernel-level operations — up to and including wiping out Defender itself on a Windows 11 machine.
-
CISA: Critical Windows IKE Vulnerability Already Exploited in Attacks
The U.S. agency CISA has warned of active exploitation of a critical RCE vulnerability in the IKE service extensions component, affecting all supported versions of Windows.
- More