Patrick Domingues

Researchers have discovered a sophisticated new type of malware that targets UEFI and its called MoonBounce. The Bootkit or also known as rootkit malware is suspected to be associated with (advanced persistent threat 41). APT41 is a group of hackers who have been robbing businesses for many years.

Researchers at Kaspersky Labs discovered a new type of malware. This is the third known type that infects UEFI firmware. The first two types were FinFisher and ESPecter.

• The malware is injected into the SPI flash part of the motherboard, signifying that it cannot be removed even after hard disk replacement.
• The injection is stored in the CORE_DXE component, which is called during the early boot sequence of UEFI.
• Once the MoonBounce rootkit malware makes its way inside the OS, it may reach out to a server to obtain further payloads.
• Additionally, the infection chain does not leave any evidence and works

Microsoft has warned that Windows and Azure customers should be on high alert after spotting state-sponsored and cyber-criminal hackers probing systems for a flaw in the Log4j. Microsoft says it spotted attackers using the Log4j flaw through December.

The Apache open source project disclosed on December 9 and will likely take a long time to fix the Log4j flaw. The problem is widespread because the open source project is used in many applications and services.

Microsoft says that this problem is not just in your organization; it’s everywhere. The company has released updates to its security software to help you identify the vulnerability and protect yourself from attackers.

“Exploitation attempts and testing have remained high during the last weeks of December. We have observed many existing attackers adding exploits of these vulnerabilities in their existing malware kits and tactics, from coin miners to hands-on-keyboard attacks,” the Microsoft 365 Defender Threat

On Tuesday, Microsoft revealed an alarming vulnerability in Internet Explorer, a bug that is being used to harm Windows users. The attack is enabled by a weaponized Office file and works like this: A victim receives an email with a link to a Word document inside. It is very important that you do not click on the link; instead, you should open the document directly.

The critical vulnerability has been found in Microsoft’s proprietary web rendering engine. The flaw, tracked as CVE-2021-40444, allows attackers to remotely execute code on a vulnerable system. The engine is used to render web content inside Word, Excel, and PowerPoint documents.

They have said. “Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents,”.

They also added: “An attacker could