New ClickFix attack deploys Havoc C2 via Microsoft Sharepoint - Related to update, microsoft, c2, outage, buggy

DHS says CISA will not stop monitoring Russian cyber threats

The US Cybersecurity and Infrastructure Security Agency says that media reports about it being directed to no longer follow or research on Russian cyber activity are untrue, and. Its mission remains unchanged.

"CISA's mission is to defend against all cyber threats to Critical Infrastructure, including from Russia," the US cyber agency posted to X.

"There has been no change in our posture. Any reporting to the contrary is fake and undermines our national security."

Building on these developments, this comes after The Guardian reported on Saturday that the Trump administration no longer sees Russia as a cyber threat against US critical infrastructure and its interests.

, a new memo at CISA directs the agency to prioritize China and. Protecting local systems and does not mention Russia. CISA analysts were verbally told not to follow or research on Russia's cyber activity.

CISA is a government agency responsible for protecting critical infrastructure, including election infrastructure. From cyber and physical threats. The agency monitors and mitigates cyber threats from foreign adversaries, including Russia, by sharing threat intelligence, coordinating incident response, and working with government and private organizations to strengthen national cybersecurity defenses.

In response to questions about the Guardian's story, Tricia McLaughlin, Assistant Secretary for Public Affairs. Department of Homeland Security, told BleepingComputer that the memo is fake and that CISA will continue to address cyber threats from Russia.

"This is garbage. The Guardian's entire story is based on an alleged memo that the Trump Administration never issued and the Guardian refuses to let us see or provide the date of expressed memo," McLaughlin told BleepingComputer.

"CISA remains committed to addressing all cyber threats to US Critical Infrastructure. Including from Russia. There has been no change in its posture or priority on this front."

Moving to another aspect, theRecord also reported on Friday that Defense Secretary Pete Hegseth ordered Cyber Command to stand down from any planned offensive operations targeting Russia.

Additionally, this was further confirmed by The New York Times and The Washington Post on Saturday, with information stating this shift in posture is only meant to last during the ongoing negotiations to stop Russia's invasion of Ukraine.

A senior defense official shared the following statement when contacted about the shift in Cyber Command's directives.

"Due to operational security concerns, we do not comment nor discuss cyber intelligence, plans, or operations," shared the defense official.

"There is no greater priority to Secretary Hegseth than the safety of the Warfighter in all operations. To include the cyber domain."

Die US-amerikanische IT-Sicherheitsbehörde warnt vor beobachteten Angriffen auf Schwachstellen in Cisco RV-Routern, Hitachi Vantara, WhatsUp Gold und ...

​Microsoft says a coding issue is behind a now-resolved Microsoft 365 outage over the weekend that affected Outlook and Exchange Online authentication...

Various industrial organizations in the Asia-Pacific (APAC) region have been targeted as part of phishing attacks designed to deliver a known malware ...

Microsoft links recent Microsoft 365 outage to buggy update

​Microsoft says a coding issue is behind a now-resolved Microsoft 365 outage over the weekend that affected Outlook and Exchange Online authentication.

:29 PM UTC, the incident also triggered Teams and Power Platform degraded functionality and caused Purview access issues and errors.

These issues were addressed by reverting the buggy code change tagged as the preliminary root cause of the widespread outage that started at 8:40 PM UTC and ended around 9:45 PM UTC.

"A recent upgrade to Microsoft 365 authentication systems contained a code issue, resulting in impact to some Microsoft 365 apps and services," the business unveiled on Saturday after resolving the authentication and. Access problems.

"Following our reversion of the problematic code change, we've monitored service telemetry and worked with previously impacted individuals to confirm that service is restored."

Redmond says a preliminary post-incident analysis should be . The business will also review the change management process to understand why the buggy change wasn't detected during testing.

While Microsoft resolved the Microsoft 365 authentication problems over the weekend. Another advisory .

"We've so far been unable to identify any Microsoft service updates which we believe are contributing towards impact. However, we've observed through analysis of telemetry that an accumulation of authentication token errors associated with a third-party application may be causing the issue," Redmond added 12 hours after acknowledging the incident.

In January, Microsoft also reverted a networking configuration change behind widespread connectivity issues, timeouts, connection drops, and resource allocation failures impacting Azure services for East US 2 clients between January 8 and January 10.

More in the recent past, on February 25, Microsoft fixed another issue caused by a DNS change that triggered Entra ID DNS authentication failures for consumers using its Seamless SSO and Microsoft Entra Connect Sync.

In 2024, global ransomware attacks hit 5,414, an 11% increase from 2023.

After a slow start, attacks spiked in Q2 and. Surged in Q4, with 1,827 incide...

Brazil, South Africa, Indonesia, Argentina, and Thailand have become the targets of a campaign that has infected Android TV devices with a botnet malw...

New ClickFix attack deploys Havoc C2 via Microsoft Sharepoint

When opened, the HTML displays a fake 0x8004de86 error, stating that it "Failed to connect to the "One Drive" cloud service" and that clients must fix the error by updating the DNS cache manually.

Phishing attachment displaying fix instructions.

Building on these developments, this PowerShell command will attempt to launch another PowerShell script hosted on the threat actor's SharePoint server.

Malicious PowerShell command that was shared as a fix.

Fortiguard says that the script checks whether the device is in a sandbox environment by querying the number of devices in the Windows domain. If it determines it's in a sandbox, the script will terminate.

Otherwise. The script will modify the Windows Registry to add a value indicating that the script was run on the device. It will then proceed to check if Python is installed on the device and, if not, install the interpreter.

Finally, a Python script is downloaded from the same SharePoint site and executed to deploy the Havok post-exploitation command and. Control framework as an injected DLL.

Havoc is an open-source post-exploitation framework similar to Cobalt Strike, allowing attackers to remotely control compromised devices. Threat actors commonly use post-exploitation frameworks like Havoc to breach corporate networks and then spread laterally to other devices on the network.

In this campaign, Havok is configured to communicate back to the threat actor's services through Microsoft's Graph API. Embedding malicious traffic within legitimate cloud services. By doing so, the attackers blend in with regular network communications to evade detection.

The malware uses SharePoint APIs on Microsoft Graph to send and receive commands, effectively transforming the attacker's SharePoint account into a data exchange system.

Threat actors have also begun to evolve the technique to use them on social media platforms like Telegram, where a fake identity verification service named 'Safeguard' was used to trick consumers into running PowerShell commands that install a Cobalt Strike beacon.

Die US-amerikanische IT-Sicherheitsbehörde warnt vor beobachteten Angriffen auf Schwachstellen in Cisco RV-Routern, Hitachi Vantara, WhatsUp Gold und ...

In 2024, global ransomware attacks hit 5,414. An 11% increase from 2023.

After a slow start, attacks spiked in Q2 and surged in Q4, with 1,827 incide...

In Zohocorps ADSelfService Plus können Angreifer eine Sicherheitslücke missbrauchen, um Konten zu übernehmen. Aktualisierte Software stopft das Sicher...