It seems many won’t get their salary on time due to a ransomware attack, and Trojan horse attacks are still at large. December months’ cyber news is getting hotter.
Kronos Ransomware Outage Drives Widespread Payroll Chaos
Kronos, a workforce management platform, has been hit by a ransomware attack, which it says will cause its cloud-based services to be unavailable for several weeks – and it is advising customers to find alternative ways to complete payroll and other HR tasks.
Customers have experienced cataclysmic problems as a result of the outage.
400 Banks’ Customers Targeted with Anubis Trojan
According to the researchers, this is only the beginning.
Customers of Chase, Wells Fargo, Bank of America, and Capital One, and around 400 other financial institutions, are being targeted by an app that masquerades as the official account management platform of French telecom company Orange S.A.
Once downloaded, the malware – a variant of the banking trojan Anubis – steals the user’s personal information in order to defraud them, according to Lookout researchers in a new report. And it’s not just big bank customers who are at risk, according to the researchers: Virtual payment platforms and cryptocurrency wallets are also under attack.
Log4j vulnerability exposed to hackers
After the previous patch for the recently disclosed Log4 Shell exploit was deemed “incomplete in certain non-default configurations,” the Apache Software Foundation (ASF) has released a new fix for the Log4j logging utility.
The second vulnerability, CVE-2021-45046, is rated 3.7 out of a possible ten on the CVSS rating system and hinders all versions of Log4j from 2.0-beta9 to 2.12.1 and 2.13.0 to 2.15.0, which the project maintainers shipped last week to address a critical remote code execution vulnerability (CVE-2021-44228) that could be exploited to penetrate and take over systems.
The incomplete patch for CVE-2021-44228 could be exploited to “craft malicious input data using a JNDI Lookup pattern, resulting in a denial-of-service (DoS) attack,” according to a new advisory from the ASF. The most recent version of Log4j, 2.16.0 (for users requiring Java 8 or later), effectively disables message lookups and disables JNDI.
Read latest cybersecurity news