Talion Threat Set Radio

Microsoft sees in the new year with exchange server flaw dubbed Y22K, halting emails for affected organisations.

Purple Fox rootkit seeing increased distribution through trojanised versions of Telegram messenger.

Compromised version of Atera tools used to compromise organisations using decade old code signing oversight.

Rook, a new ransomware strain which appears to be created from the Babuk source code leak appears in the wild.

Researchers say Log4J flaw will take years to fully address owing to the sheer number of nested dependencies.

The ransomware gang which breached Gigabyte provides a free decryptor after realising they hit the US police.

New lightweight malware strain hides in the registry among other stealth techniques.

Two active directory bugs from November patch Tuesday abused in tandem by PoC to allow takeover.

Pysa ransomware strain experiences huge surge to become a top player as the year closes.

In this weeks episode the fallout from the Log4j discovery, new developments on the resurrection of Emotet & an accidental uncovering of Hello Kitty ransomware.

New Cerber ransomware impersonator targets Confluence and Gitlab servers.

Direct Cobalt Strike installation further suggests new Emotet infrastructure gearing up for Ransomware campaign.

Solarwinds attackers deploy new stealthy malware strain and search for new supply chain attack opportunities.

In this weeks episode, Trickbot adopt new evasion methods to avoid sandbox environments, nation state actors employ simple yet effective technique to perform post phishing exploitation, and an RCE vulnerability affecting over 150 distinct HP printer models has existed for over 8 years. 

In this weeks episode proof of concept weaponised with alarming speed as windows installer zero day spotted in the wild, GoDaddy suffers breach affecting 1.2 million sites, ongoing since September and new strain of Linux malware hides in cron jobs scheduled for dates that don't exist.

This week’s Threat Intel news:

• Emotet rises from the dead, uses its old payload Trickbot to rebuild itself.
• North Korea state actors target security researchers with compromised analysis software.
• Research highlights the TLDs favoured by attackers for different types of malicious activity.

This week’s Threat Intel news:

• US charges 2 suspected major REvil ransomware operators
• Conti ransomware gang make grovelling apology to Arab Royals over data leak
• TeamTNT hackers target your poorly configured Docker server

 This week’s Threat Intel news: 

• Darkside hit with a $10m bounty as fallout of Colonial Pipeline attack continues.
• Critical Linux kernel vulnerability disclosed.
• FBI releases advisory stating ransomware gangs specifically target victims in financially sensitive negotiations.