Page 11 - Threat Intelligence Brief 7-10-2019_Neat

Internal Threats

How hackers turn Microsoft Excel’s own features against it - On Thursday, researchers from threat
intelligence firm Mimecast are disclosing findings that an Excel feature called Power Query can be
manipulated to facilitate established Office 365 system attacks. Power Query allows users to
combine data from various sources with a spreadsheet—like a database, second spreadsheet,
document, or website. This mechanism for linking out to another component, though, can also be
abused to link to a malicious webpage that contains malware. In this way, attackers can distribute
tainted Excel spreadsheets that wreak havoc, from granting attackers system privileges to installing
backdoors.
Source: https://www.wired.com/story/microsoft-excel-hacking-power-query-macros/

Sodinokibi Ransomware Exploits Windows Bug to Elevate Privileges - The Sodinokibi ransomware
is looking to increase its privileges on a victim machine by exploiting a vulnerability in the Win32k
component present on Windows 7 through 10 and Server editions. The file-encrypting malware
stepped into the limelight in April when it started to exploit a critical vulnerability in Oracle
WebLogic. Sodinokibi, a.k.a. REvil, also exploits CVE-2018-8453, security researchers found, a
vulnerability discovered and reported by Kaspersky, that Microsoft patched in October 2018.

Source: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-
exploits-windows-bug-to-elevate-privileges/

More Than Half of SMB Devices Run Outdated Operating Systems - New research underscores
security weaknesses in small-to midsized businesses including a dependence on antiquated
Microsoft operating systems, encryption misconfigurations, poor patching regimes, and reliance on
outdated Exchange 2000 email servers. Some 66% of SMB devices surveyed run Microsoft OS
versions that are expired or will expire in the next six months. The majority of devices scanned by
Alert Logic for the study currently run Windows versions that are more than 10 years old. Microsoft
will discontinue support for Windows 7 and Windows 2008 Server on January 14, 2020.

Source: https://www.darkreading.com/endpoint/more-than-half-of-smb-devices-run-
outdated-operating-systems/d/d-id/1335142

www.accumepartners.com 11