Cybersecurity Bulletin: Server Threats and Advanced Malware

The content provided related security topics in the area of ​​servers and malware. The main categories are "Malware" and "Vulnerabilities".

First of all, "Operation Ebury" stands out, a malware campaign targeting Linux servers. This campaign is considered sophisticated and represents a threat to the security of Linux servers.

Another relevant issue is attacks on Microsoft Exchange servers, which involve the use of keyloggers and ransomware. These attacks represent a significant vulnerability in Microsoft Exchange servers and can compromise the security of data stored on them.

The SolarMarker malware is also mentioned, which is characterized by its evolution and resistance.  Regarding the vulnerabilities, one stands out related to GitHub Enterprise Server, which allows SAML authentication bypass. This vulnerability can be exploited by attackers to gain unauthorized access to systems protected by GitHub Enterprise Server.

Another vulnerability mentioned is the so-called "Linguistic Lumberjack Vulnerability in Fluent Bit", which affects this event logging software. This vulnerability can be exploited by attackers to compromise the integrity and confidentiality of data stored on systems using Fluent Bit.

Additionally, an urgent warning issued by CISA regarding attacks on NextGen Healthcare Mirth Connect is mentioned. As for malware, the Metamorfo banking trojan stands out, which spreads through deceptive emails. This malware aims to steal financial information from users and can cause serious financial damage.

For more details of the weekly newsletter: Click here