{"id":7264,"date":"2022-08-09T08:37:25","date_gmt":"2022-08-09T15:37:25","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7264"},"modified":"2023-04-05T12:29:36","modified_gmt":"2023-04-05T19:29:36","slug":"securins-threat-intelligence-august-08-2022-august-12-2022","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/securins-threat-intelligence-august-08-2022-august-12-2022\/","title":{"rendered":"Securin&#8217;s Threat Intelligence Aug 8, 2022 &#8211; Aug 12, 2022"},"content":{"rendered":"<p dir=\"ltr\">This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><span style=\"font-size: 18px;\"><span style=\"color: #0000cd;\"><strong>Why play catch up when you can fix this now?<\/strong><\/span><\/span><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Watch David Rushton talk about the Top Three Threats of the Week in his Threat Intelligence Podcast!<\/strong><\/p>\n<div style=\"padding: 56.25% 0 0 0; position: relative;\"><iframe style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%;\" title=\"Cyber Threat Intelligence Ep: 07\" src=\"https:\/\/player.vimeo.com\/video\/738969563?h=b5e83cc6ba&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">Here are this week\u2019s threats to watch out for:<\/p>\n<p dir=\"ltr\"><a href=\"#A new threat actor deploying Cuba Ransomware\">A new threat actor deploying Cuba Ransomware<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#Maui ransomware linked to North Korean APT group Andariel\">Maui ransomware linked to North Korean APT group Andariel<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#CISA adds four new vulnerabilities to it\u2019s Known Exploited Vulnerabilities list\">CISA adds four new vulnerabilities to it\u2019s Known Exploited Vulnerabilities list<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#A new ransomware on the block: BlueSky\u00a0\">A new ransomware on the block: BlueSky<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#Cisco fixes a bug which allows RSA private key theft on ASA, FTD devices\">Cisco fixes a bug which allows RSA private key theft on ASA, FTD devices<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#SmokeLoader malware targeting old vulnerabilities\">SmokeLoader malware targeting old vulnerabilities<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#CISCO was the target of a cyber attack in May 2022\">CISCO was the target of a cyber attack in May 2022<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#ZIMBRA suffers multiple breaches due to CVE-2022-27925 and CVE-2022-37042\">ZIMBRA suffers multiple breaches due to CVE-2022-27925 and CVE-2022-37042<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#CISA warns of Zeppelin ransomware attacks\">CISA warns of Zeppelin ransomware attacks<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#PAN-OS firewall misconfiguration could lead to Potential DoS attacks\">PAN-OS firewall misconfiguration could lead to Potential DoS attacks<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#Microsoft patches 121 vulnerabilities including two zero-day vulnerabilities\">Microsoft patches 121 vulnerabilities including two zero-day vulnerabilities<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#High Severity critical vulnerability found in Django\">High Severity critical vulnerability found in Django<\/a><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"A new threat actor deploying Cuba Ransomware\" name=\"A new threat actor deploying Cuba Ransomware\"><\/a>A new threat actor deploying Cuba Ransomware<\/h2>\n<p dir=\"ltr\">In May 2022, a threat actor named Tropical Scorpius was observed deploying Cuba ransomware using new techniques and tools. According to the latest research conducted in June 2022, it was discovered that they\u2019ve been using a new malware variant of ROMCOM RAT, a weaponized local privilege escalation exploit, a kernel driver, and the ZeroLogan hacktool to launch attacks.<br \/>\nWhile the actual number of Tropical Scorpius\u2019s victims is unknown, they have published stolen files from four victims on their Onion site.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>CVE-2020-1472<\/strong> and <strong>CVE-2022-24521<\/strong> are the CVEs associated with the Cuba ransomware.<\/p>\n<p dir=\"ltr\">CVE-2020-1472 has been involved with <a href=\"https:\/\/cybersecurityworks.com\/blog\/ransomware\/all-about-conti.html\">Conti<\/a>, <a href=\"https:\/\/cybersecurityworks.com\/blog\/ransomware\/darkside-ransomware-threat-associations-unearthed.html\">DarkSide<\/a>, and <a href=\"https:\/\/cybersecurityworks.com\/blog\/ransomware\/all-about-ryuk.html\">Ryuk<\/a> groups.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2020-1472<\/p>\n<p dir=\"ltr\"><strong>CVSS<\/strong>: 10<\/p>\n<p dir=\"ltr\"><strong>Exploit Type<\/strong>:\u00a0\u00a0 \u00a0[&#8216;DoS&#8217;, &#8216;WebApp&#8217;,&#8217;PE&#8217;]<\/p>\n<p dir=\"ltr\"><strong>CWE ID<\/strong>: CWE-330, CWE-287<\/p>\n<p dir=\"ltr\"><strong>Ransomware Association<\/strong>s:\u00a0 Darkside, CryptoMix, Babuk, Ryuk, Conti, Epsilon Red, Thanos<\/p>\n<p dir=\"ltr\"><strong>APT Group Associations<\/strong>: Wizard Spider, Prophet Spider, MuddyWater, TA505, menuPass, Sandworm Team, FIN7<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count<\/strong>: 24<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-1472\" target=\"_blank\" rel=\"noopener\">Download<\/a><\/p>\n<h2 dir=\"ltr\"><a id=\"Maui ransomware linked to North Korean APT group Andariel\" name=\"Maui ransomware linked to North Korean APT group Andariel\"><\/a>Maui ransomware linked to North Korean APT group Andariel<\/h2>\n<p dir=\"ltr\">Maui ransomware, used extensively in targets against the healthcare sector is now found to be linked to the North Korean APT group, Andariel. The ransomware, first spotted in 2021, in Japan, could not be associated with any APT group at that time. CISA had also <a href=\"https:\/\/www.cisa.gov\/uscert\/ncas\/alerts\/aa22-187a\" target=\"_blank\" rel=\"noopener\">published an alert<\/a> regarding it on July 7, 2022, but there was no mention of Andariel. After research, it was concluded that\u00a0 a variant of the well-known DTrack malware was deployed in the target system before Maui ransomware in the 2021 attack by the group. 3 months prior to this, the targeted system was infected with a suspicious 3proxy tool. As this is the modus operandi of the Andariel group, researchers have concluded that Maui ransomware is used by the Andariel group.<\/p>\n<p dir=\"ltr\">Maui ransomware is also confirmed to be used in a <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/the-week-in-ransomware-july-22nd-2022-attacks-abound\/\" target=\"_blank\" rel=\"noopener\">healthcare attack in 2022<\/a>.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>CVE-2017-10271 is the CVE associated with this ransomware.<\/strong><\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2017-10271<\/p>\n<p dir=\"ltr\"><strong>CVSS<\/strong>: 7.5<\/p>\n<p dir=\"ltr\"><strong>Exploit Type<\/strong>: [&#8216;RCE&#8217;, &#8216;WebApp&#8217;]<\/p>\n<p dir=\"ltr\"><strong>Ransomware Associations<\/strong>: GandCrab, Stop, Satan, Satan, QNAPCrypt<\/p>\n<p dir=\"ltr\"><strong>APT Group Associations<\/strong>:\u00a0 Rocke<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count<\/strong>: 4<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"http:\/\/www.oracle.com\/technetwork\/security-advisory\/cpuoct2017-3236626.html\" target=\"_blank\" rel=\"noopener\">Download<\/a><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"CISA adds four new vulnerabilities to it\u2019s Known Exploited Vulnerabilities list\" name=\"CISA adds four new vulnerabilities to it\u2019s Known Exploited Vulnerabilities list\"><\/a>CISA adds four new vulnerabilities to it\u2019s Known Exploited Vulnerabilities list<\/h2>\n<p dir=\"ltr\">CVE-2022-30333, CVE-2022-34713, CVE-2022-27925, and CVE-2022-37042 are the latest vulnerabilities added to the KEV list. The first two were added on 9th, August 2022 and the latter two were added on 11th August, 2022..<\/p>\n<p dir=\"ltr\"><strong>CVE-2022-30333 <\/strong>is a\u00a0 path traversal vulnerability in RarLab&#8217;s UnRAR binary. It was exploited in ZIMRA devices. We had warned of this vulnerability to our users back in June when it was actively exploited and you can also <a href=\"https:\/\/cybersecurityworks.com\/blog\/cyber-risk\/csws-friday-threat-intelligence.html#UnRaR\" target=\"_blank\" rel=\"noopener\">find this in our threat blog<\/a>.<\/p>\n<p dir=\"ltr\"><strong>CVE-2022-34713<\/strong> is the <strong>DogWalk Zero-Day<\/strong> found in Windows Support Diagnostic Tool (MSDT). It is a remote code execution vulnerability wherein the attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. Although it was brought to Microsoft\u2019s attention back in June, they did not patch it until it was actively exploited in the wild. CISA has now added it to its KEV list and has warned federal organizations to patch it.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>We had warned our customers of this CVE back in June and helped them patch it.<\/strong><\/p>\n<p dir=\"ltr\"><strong>CVE-2022-27925 <\/strong>and <strong>CVE-2022-37042<\/strong> are unauthenticated RCE vulnerabilities that grant access to the ZCS email servers. There is evidence of mass exploitation of CVE-2022-27925, some of which have been in Government organizations. We\u2019ve covered more details of this CVE in<a href=\"#ZIMBRA suffers multiple breaches due to CVE-2022-27925 and CVE-2022-37042\"> our threat blog<\/a>.<\/p>\n<h2 dir=\"ltr\"><a id=\"A new ransomware on the block: BlueSky\u00a0\" name=\"A new ransomware on the block: BlueSky\u00a0\"><\/a>A new ransomware on the block: BlueSky<\/h2>\n<p dir=\"ltr\">BlueSky is the latest evolving threat in the cyber realm. So far, BlueSky has been observed to target Windows hosts and utilizes multithreading to encrypt files on the host for faster encryption. The attack methodologies bear many similarities with the Conti and Babuk ransomware families.<\/p>\n<p dir=\"ltr\"><strong>CVE-2020-0796<\/strong> and <strong>CVE-2021-1732<\/strong> are the two vulnerabilities this ransomware has exploited. Microsoft has released patches for both these vulnerabilities back in 2020 and 2021, respectively.<\/p>\n<p dir=\"ltr\">We had called \u00a0CVE-2021-1732 out as being one of the <a href=\"https:\/\/cybersecurityworks.com\/blog\/cisa\/top-5-affected-products-in-cisas-catalog-of-known-exploited-vulnerabilities-kev.html\">top exploited vulnerabilities in Microsoft<\/a>.<\/p>\n<p dir=\"ltr\">CVE-2020-0796 has been exploited by <a href=\"https:\/\/cybersecurityworks.com\/blog\/vulnerabilities\/cyberwar-bulletin-2-are-you-ready-for-this-cyberwar.html\">Conti in the Russia-Ukraine war<\/a> and by <a href=\"https:\/\/cybersecurityworks.com\/blog\/vulnerabilities\/back-to-back-air-india-attacks-indicating-more-than-just-a-data-breach.html\">APT 41<\/a>.<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrF7S0wIxcD2PVB1?backgroundColor=green&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"Cisco fixes a bug which allows RSA private key theft on ASA, FTD devices\" name=\"Cisco fixes a bug which allows RSA private key theft on ASA, FTD devices\"><\/a>Cisco fixes a bug which allows RSA private key theft on ASA, FTD devices<\/h2>\n<p dir=\"ltr\">CVE-2022-20866 is a highly critical vulnerability which allows an unauthenticated attacker to retrieve a RSA private key remotely. Using the private key, the attacker can\u00a0 decrypt the device traffic or impersonate Cisco ASA\/FTD devices. There is a possibility that the RSA private keys of Cisco ASA or FTD device administrators may have been stolen by attackers. However, there is no evidence of any exploitation in the wild.<\/p>\n<p dir=\"ltr\">CISCO <a href=\"https:\/\/tools.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-asaftd-rsa-key-leak-Ms7UEfZz\" target=\"_blank\" rel=\"noopener\">has released a patch<\/a> for this vulnerability on August 10, 2022.<\/p>\n<h2 dir=\"ltr\"><a id=\"SmokeLoader malware targeting old vulnerabilities\" name=\"SmokeLoader malware targeting old vulnerabilities\"><\/a>SmokeLoader malware targeting old vulnerabilities<\/h2>\n<p dir=\"ltr\">Old vulnerabilities have often taken many organizations by surprise. This week make sure you patch SmokeLpader &#8211; a malware that helps distribute other malware variants has been targeting CVEs that were discovered in 2017.<\/p>\n<p dir=\"ltr\">A Taiwanese telecommunications company was the victim of an email-phishing campaign in which CVE-2017-0199 and CVE-2017-11882 were exploited. SmokeLoader was used to deliver zgRAT malware in the targeted systems. Both these CVEs have been on <a href=\"https:\/\/www.cisa.gov\/uscert\/ncas\/alerts\/aa20-133a\" target=\"_blank\" rel=\"noopener\">CISA\u2019s top-10 most exploited vulnerabilities list for 2016-2019<\/a>.<\/p>\n<blockquote>\n<p dir=\"ltr\">CSW has been <a href=\"https:\/\/cybersecurityworks.com\/blog\/vulnerabilities\/google-trends-most-searched-top-10-vulnerabilities-in-2020.html\" target=\"_blank\" rel=\"noopener\">warning our customers of these two CVEs<\/a> since 2021.<\/p>\n<\/blockquote>\n<p dir=\"ltr\">CVE-2017-11882 is a Microsoft Office Memory Corruption Vulnerability that allows an attacker to run arbitrary code in the context of the user.<\/p>\n<p dir=\"ltr\">CVE-2017-0199 is a Microsoft Office\/WordPad Remote Code Execution Vulnerability w\/Windows API&#8221; that allows an attacker to execute arbitrary code via a crafted document.<\/p>\n<p dir=\"ltr\">CVE-2017-0199 and CVE-2017-11882 are <a href=\"https:\/\/cybersecurityworks.com\/blog\/vulnerabilities\/cyberwar-bulletin-1-russia-ukraine.html\" target=\"_blank\" rel=\"noopener\">actively used in the cyberwar<\/a> against Ukraine by Gamaredon, a Russian APT group. From <a href=\"https:\/\/cybersecurityworks.com\/blog\/vulnerabilities\/prevent-falling-victim-to-apt-groups-using-csws-ai-based-vulnerability-and-threat-intelligence.html\" target=\"_blank\" rel=\"noopener\">CSW\u2019s AI-based analysis<\/a>, it is clear that CVE-2017-11882 is the most favored vulnerability in 2022 with 22 APT groups actively exploiting it. 18 APT groups are exploiting CVE-2017-0199.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>If your organization is yet to patch these vulnerabilities, it is high-time to get it done.<\/strong><\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrYz4aZ2u1aU6gGw?backgroundColor=green&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<h2 dir=\"ltr\"><a id=\"CISCO was the target of a cyber attack in May 2022\" name=\"CISCO was the target of a cyber attack in May 2022\"><\/a>CISCO was the target of a cyber attack in May 2022<\/h2>\n<p dir=\"ltr\">On Wednesday, August, 10, CISCO announced that they had been a victim of a cyber attack in May 2022. A threat actor had gained access to an employee\u2019s personal Google account and stole the credentials from the victim\u2019s browser. The actor then used voice phishing to get the victim to successfully accept multi-factor authentication (MFA) push notifications initiated by the attacker.<\/p>\n<p dir=\"ltr\">CISCO was alerted to the threat actor\u2019s presence and revoked their access before they could access any critical systems or information. The actor is suspected to be an initial-access broker with links to the UNC2447 cybercrime gang, Lapsus$ threat actor group, and the Yanluowang ransomware operators.<\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"ZIMBRA suffers multiple breaches due to CVE-2022-27925 and CVE-2022-37042\" name=\"ZIMBRA suffers multiple breaches due to CVE-2022-27925 and CVE-2022-37042\"><\/a>ZIMBRA suffers multiple breaches due to CVE-2022-27925 and CVE-2022-37042<\/h2>\n<p dir=\"ltr\">There were multiple instances of serious breaches in the\u00a0 Zimbra Collaboration Suite (ZCS) email servers in July and August. The unauthenticated RCE CVE-2022-27925 was exploited during these attacks to compromise servers in several organizations including Government departments and ministries; military branches; worldwide businesses with billions of dollars of revenue, etc. This CVE does not need administrator credentials to access the victims\u2019 ZCS email servers because of the authentication bypass bug, CVE-2022-37042.<\/p>\n<p dir=\"ltr\">ZIMBRA had previously released a <a href=\"https:\/\/wiki.zimbra.com\/wiki\/Zimbra_Releases\/9.0.0\/P24\" target=\"_blank\" rel=\"noopener\">patch for CVE-2022-27925<\/a> in March 2022 but it did not address the authentication bypass flaw. In the latest patch released in August they have fixed it.<\/p>\n<p dir=\"ltr\">Zimbra has advised all organizations using versions that are older than Zimbra 8.8.15 patch 33 or Zimbra 9.0.0 patch 26 to update to the latest patch as soon as possible.<\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"CISA warns of Zeppelin ransomware attacks\" name=\"CISA warns of Zeppelin ransomware attacks\"><\/a>CISA warns of Zeppelin ransomware attacks<\/h2>\n<p dir=\"ltr\">CISA and the FBI released a joint <a href=\"https:\/\/www.ic3.gov\/Media\/News\/2022\/220811.pdf\" target=\"_blank\" rel=\"noopener\">Cybersecurity Advisory (CSA) announcement<\/a> on Thursday Aug 11th, 2022 in an effort to stop ransomware attacks. The focus of Thursday\u2019s announcement was the Zeppelin ransomware. The latest tactics and techniques undertaken by the ransomware group, indicators of compromise (IOCs), and mitigation measures were detailed in this announcement.<\/p>\n<p dir=\"ltr\">Zeppelin ransomware attacks are known to deploy multiple malware instances in a single victim\u2019s systems thereby creating different IDs or file extensions. In most cases, the victims need several unique decryption keys to recover their data. Zeppelin\u2019s last known attack had occurred as recently as June 2022.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>CVE-2020-0796, CVE-2020-1210, and CVE-2020-16875 are the CVEs associated with the Zeppelin ransomware.<\/strong><\/p>\n<h2 dir=\"ltr\"><a id=\"PAN-OS firewall misconfiguration could lead to Potential DoS attacks\" name=\"PAN-OS firewall misconfiguration could lead to Potential DoS attacks\"><\/a>PAN-OS firewall misconfiguration could lead to Potential DoS attacks<\/h2>\n<p dir=\"ltr\">CVE-2022-0028, a vulnerability caused by the misconfiguration in the URL filtering policy in Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.<\/p>\n<p dir=\"ltr\">The attack may not cause any loss in the availability of the PAN services or compromise the confidentiality or integrity of data. However, the attacker\u2019s identity may be undiscoverable and implicates the firewall as the source of attack.<\/p>\n<p dir=\"ltr\">Pal0 Alto Networks has addressed this issue and released a<a href=\"https:\/\/security.paloaltonetworks.com\/CVE-2022-0028\" target=\"_blank\" rel=\"noopener\"> patch for this misconfiguration<\/a> in August 2022 and urges all organizations to apply it in their PAN-OS products.<\/p>\n<p dir=\"ltr\">.<\/p>\n<h2 dir=\"ltr\"><a id=\"Microsoft patches 121 vulnerabilities including two zero-day vulnerabilities\" name=\"Microsoft patches 121 vulnerabilities including two zero-day vulnerabilities\"><\/a>Microsoft patches 121 vulnerabilities including two zero-day vulnerabilities<\/h2>\n<p dir=\"ltr\">On August\u2019s Patch Tuesday, <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/releaseNote\/2022-Aug\" target=\"_blank\" rel=\"noopener\">Microsoft announced patches for 121 vulnerabilities<\/a>, including two zero-day vulnerabilities: CVE-2022-34713 &amp; CVE-2022-30134. Seventeen of the 121 vulnerabilities fixed are classified as &#8216;Critical&#8217; as they allow remote code execution or elevation of privileges.<\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"High Severity critical vulnerability found in Django\" name=\"High Severity critical vulnerability found in Django\"><\/a>High Severity critical vulnerability found in Django<\/h2>\n<p dir=\"ltr\">A new high severity vulnerability in the Django project, an open-source Python-based web framework has been discovered. It could impact\u00a0 3rd party database backends using Django. Django has released a fix for it in\u00a0 in<strong> Django 4.0.6 and Django 3.2.14 versions<\/strong>.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><em><strong>Check out this section to track how these threats evolve!<\/strong><\/em><\/p>\n<p dir=\"ltr\">We use our Threat Intelligence Platform driven by Artificial Intelligence (AI) and Machine Learning (ML) models to analyze the vulnerabilities that hackers could potentially exploit. We warn our customers continuously about exposures and prioritize vulnerabilities to facilitate rapid remediation.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><em><strong>Follow our weekly blog and podcast to get proactive alerts on trending threats. Reach out to us if you need help managing your vulnerabilities and exposures.<\/strong><\/em><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><em><strong>Leverage our expertise and manage your threats continuously to stay safe from attackers.<\/strong><\/em><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><em><strong><a href=\"https:\/\/cybersecurityworks.com\/contact-us.php\">Talk to Us<\/a><\/strong><\/em><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[80,146],"tags":[212,107,214,210,124,217,116,213,150,215,211,103,216],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7264"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=7264"}],"version-history":[{"count":7,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7264\/revisions"}],"predecessor-version":[{"id":14314,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7264\/revisions\/14314"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=7264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=7264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=7264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}