1月11日每日安全热点 - 本田、阿库拉汽车遭遇Y2K22漏洞攻击

360安全客 安全资讯 35555 4

漏洞 Vulnerability
CVE-2021-38674:QNAP Systems QUTS Hero 跨站脚本漏洞
http://vulhub.org.cn/vuln/VHN-400252
安全事件 Security Incident
FinalSite遭受勒索软件攻击关闭数千个网站
https://heimdalsecurity.com/blog/ransomware-attack-suffered-by-finalsite-shuts-down-thousands-of-websites/
报告：2021年从DeFi平台被窃取了22亿美元的加密货币
https://www.zdnet.com/article/22-billion-in-cryptocurrency-stolen-from-defi-platforms-in-2021-report/
超过370万个帐户在FlexBooker数据泄露事件中遭到入侵
https://securityaffairs.co/wordpress/126409/data-breach/flexbooker-data-breach.html
Night Sky：一个新的勒索软件
https://securityaffairs.co/wordpress/126400/malware/night-sky-ransomware-operation.html
本田、阿库拉汽车遭遇Y2K22漏洞攻击
https://www.bleepingcomputer.com/news/technology/honda-acura-cars-hit-by-y2k22-bug-that-rolls-back-clocks-to-2002/
利用 Google 文档评论功能进行鱼叉式网络钓鱼
https://www.bleepingcomputer.com/news/security/google-docs-commenting-feature-exploited-for-spear-phishing/
不安全的 Amazon S3 存储桶暴露了 50万名加纳毕业生的个人数据
https://portswigger.net/daily-swig/insecure-amazon-s3-bucket-exposed-personal-data-on-500-000-ghanaian-graduates
被木马化的dnSpy应用程序向研究人员和开发者投放恶意软件
https://www.bleepingcomputer.com/news/security/trojanized-dnspy-app-drops-malware-cocktail-on-researchers-devs/
FBI：黑客使用BadUSB用勒索软件瞄准公司
https://www.bleepingcomputer.com/news/security/fbi-hackers-target-us-defense-firms-with-malicious-usb-packages/
FluBot恶意软件现在冒充Flash Player应用程序将欧洲作为
https://www.bleepingcomputer.com/news/security/flubot-malware-now-targets-europe-posing-as-flash-player-app/
美国在线药房Ravkoo数据泄露与AWS门户事件有关
https://www.bleepingcomputer.com/news/security/us-online-pharmacy-ravkoo-links-data-breach-to-aws-portal-incident/
SonicWall：Y2K22漏洞攻击电子邮件安全、防火墙产品
https://www.bleepingcomputer.com/news/security/sonicwall-y2k22-bug-hits-email-security-firewall-products/
Patchwork针对分子医学和生物科学研究人员的新攻击活动
https://blog.malwarebytes.com/threat-intelligence/2022/01/patchwork-apt-caught-in-its-own-web/
NOBELIUM利用EnvyScout攻击大使馆
https://www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/
（完）