Great research for Microsoft here - Black Basta and Akira ransomware deployment using a logic flaw in VMware ESXi, using a zero day (which they don't mention).

If you get domain admin in Windows, you can make an Active Directory group called "ESX Admins", and then you can log into ESXi - this allows you to encrypt non-Windows systems (and everything else in VMware)

https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/

#threatintel

What if I told you there is an immensely popular operating system that you likely used it at least once, but did not realise what it was?

In fact, it is so popular and important there is an IEEE standard based on it.

It is uncanny how immensely popular AND immensely obscure this system is.

It is scary that until today I have never even heard of its reference desktop implementation.

The system is called "TRON".

🧵 thread~

p.s. thanks @fkinoshita for the pointer!

Microsoft announced earlier this week that the NTLM authentication protocol will be killed off in Windows 11 in the future.

https://www.bleepingcomputer.com/news/security/microsoft-plans-to-kill-off-ntlm-authentication-in-windows-11/

PSA: If you use #Veeam Backup & Replication (very common), upgrade. Especially if you face server to internet.

Screenshot from Code White, the API lets you remotely request Windows admin credentials for some reason, no auth request.

In their advisory Veeam claimed these are encrypted... it's base64 (lololol)

#CVE202327532 https://www.veeam.com/kb4424

Keep an eye on CVE-2023-21716 aka MS Word vulnerability from February 2023 in RTF files.

There's a public proof of concept: https://qoop.org/publications/cve-2023-21716-rtf-fonttbl.md

Where it gets more interesting - you can embed RTF files in email, Microsoft Outlook renders them with no clicks, by just reading the email. There's a decent chance this could become problematic combination.. although not yet as the PoC is vague enough to require a clue to exploit. HT @fellows

#CVE202321716

A great overview of what Windows Services are, how they work, and what weaknesses or abilities they can provide attackers. This is basic sysadmin must-know stuff, not just security.

@jsecurity101 @v3r5ace

https://posts.specterops.io/the-defenders-guide-to-windows-services-67c1711ecba7