About this tag
The attack tag on WindowsForum.com covers a range of cybersecurity threats and vulnerabilities affecting Windows systems and networks. Discussions include malware like TrickBot and Dopplepaymer ransomware, DNS infrastructure hijacking campaigns, and side-channel CPU vulnerabilities such as Meltdown and Spectre. Users also share experiences with brute force attacks on Windows via OpenSSH, remote desktop app compromises, and analyzing attack logs in Event Viewer. The content emphasizes detection, analysis, and mitigation of various attack vectors, including phishing, credential theft, and exploitation of system weaknesses. Topics are relevant to IT professionals, security researchers, and Windows users seeking to understand and defend against real-world cyberattacks.
-
AA21-076A: TrickBot Malware
Original release date: March 17, 2021 Summary This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. The Cybersecurity and Infrastructure Security Agency...- News
- Thread
- antivirus attack cisa command and control credential theft cybersecurity data exfiltration email security fbi malware mitigation mitre att&ck network security phishing spear phishing threat intelligence trickbot trojan windows
- Replies: 0
- Forum: Security Alerts
-
C
Windows 10 Analysing attacks made in Windows
I am currently in the middle of testing a hack on a Windows 10 virtual machine via brute force attack. I successfully hacked into the Windows 10 (victim) machine via OpenSSH port which I opened myself I have looked on Windows Event viewer and have noticed that it shows the attack attempts and...- Cmann
- Thread
- attack attack techniques brute force cybersecurity event log event viewer hacking impersonation ip address kali linux logging machine identification network openssh penetration testing security monitoring user data virtual machine windows 10
- Replies: 1
- Forum: Windows Help and Support
-
Customer Guidance for the Dopplepaymer Ransomware
Microsoft has been investigating recent attacks by malicious actors using the Dopplepaymer ransomware. There is misleading information circulating about Microsoft Teams, along with references to RDP (BlueKeep), as ways in which this malware spreads. Our security research teams have investigated...- News
- Thread
- actors attack bluekeep cybersecurity dopplepaymer guidance information investigation malware microsoft misleading prevention protection ransomware rdp research security teams threats vulnerability
- Replies: 0
- Forum: Security Alerts
-
AA19-024A: DNS Infrastructure Hijacking Campaign
Original release date: January 24, 2019 Summary The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a global Domain Name System (DNS) infrastructure hijacking campaign. Using compromised...- News
- Thread
- attack best practices campaign cisa credentials cybersecurity dns encryption hijack infrastructure inspection malware manipulation mitigation network phishing security threats traffic validation
- Replies: 0
- Forum: Security Alerts
-
S
Windows 8 Windows Remote Desktop app hacked
I have got a second computer in my house and was going to have it up as much as possible for a Minecraft server. Both PCs Win 10 Pro x64 1809. I installed from the windows store the remote desktop app and started noticing Kaspersky blocking some attacks. (attached picture, mid-Oct) I...- spook84
- Thread
- antivirus attack compromise computer issues encryption hacks home server kaspersky malware minecraft network security reformat remote desktop rsa-2048 security teamviewer user concerns windows 10
- Replies: 3
- Forum: Windows Help and Support
-
TA18-141A: Side-Channel Vulnerability Variants 3a and 4
Original release date: May 21, 2018 Systems Affected CPU hardware implementations Overview On May 21, 2018, new variants—known as 3A and 4—of the side-channel central processing unit (CPU) hardware vulnerability were Link Removed. These variants can allow an attacker to obtain access to...- News
- Thread
- attack cpu cve-2017-5715 cve-2017-5753 cve-2017-5754 cve-2018-3639 cve-2018-3640 exfiltration hardware impact meltdown mitigation patch security side-channel software spectre variant variant 3a vulnerability
- Replies: 0
- Forum: Security Alerts
-
TA18-004A: Meltdown and Spectre Side-Channel Vulnerability Guidance
Original release date: January 04, 2018 Systems Affected CPU hardware implementations Overview On January 3, 2018, the National Cybersecurity and Communications Integration Center (NCCIC) became aware of a set of security vulnerabilities—known as Meltdown and Spectre— that affect modern...- News
- Thread
- advisory amazon architecture attack cloud solutions cpu cybersecurity guidance information kernel linux meltdown mitigation nccic patch performance security spectre vulnerability
- Replies: 0
- Forum: Security Alerts
-
TA17-163A: CrashOverride Malware
Original release date: June 12, 2017 | Last revised: July 27, 2017 Systems Affected Industrial Control Systems Overview The National Cybersecurity and Communications Integration Center (NCCIC) is aware of public reports from ESET and Dragos outlining a new, highly capable Industrial...- News
- Thread
- attack authentication crashoverride cybersecurity detection exploitation ics industrial control systems infrastructure malware mitigation monitoring nccic remote access response risk assessment threats ttps vulnerability
- Replies: 0
- Forum: Security Alerts
-
MS17-021 - Important: Security Update for Windows DirectShow (4010318) - Version: 1.0
Severity Rating: Important Revision Note: V1.0 (March 14, 2017): Bulletin published. Summary: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow an Information Disclosure if Windows DirectShow opens specially crafted media content that is hosted on...- News
- Thread
- 4010318 attack bulletin directshow exploitation information disclosure malicious website march media content microsoft patch revision note security security bulletin system compromise update version 1.0 vulnerability windows
- Replies: 0
- Forum: Security Alerts
-
MS16-144 - Critical: Cumulative Security Update for Internet Explorer (3204059) - Version: 1.0
Severity Rating: Critical Revision Note: V1.0 (December 13, 2016): Bulletin published. Summary: This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet...- News
- Thread
- account management admin rights attack bulletin control critical cumulative data security december 2016 exploit internet explorer ms16-144 remote code execution revision note security update user rights vulnerability webpage
- Replies: 0
- Forum: Security Alerts
-
MS16-144 - Critical: Cumulative Security Update for Internet Explorer (3204059) - Version: 1.0
Severity Rating: Critical Revision Note: V1.0 (December 13, 2016): Bulletin published. Summary: This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet...- News
- Thread
- admin rights attack critical cumulative update data security december 2016 extended security updates information security internet explorer microsoft ms16-144 patch remote code execution software security system control user account control user rights vulnerability web attack
- Replies: 0
- Forum: Security Alerts
-
TA16-288A: Heightened DDoS Threat Posed by Mirai and Other Botnets
Original release date: October 14, 2016 Systems Affected Internet of Things (IoT)—an emerging network of devices (e.g., printers, routers, video cameras, smart TVs) that connect to one another via the Internet, often automatically sending and receiving data Overview Recently, IoT devices...- News
- Thread
- attack bashlite botnet cybersecurity data security ddos default passwords harden networks internet of things iot iot security malware mirai mitigation network prevention reboot security threats vulnerability
- Replies: 0
- Forum: Security Alerts
-
MS16-075 - Important: Security Update for Windows SMB Server (3164038) - Version: 1.0
Severity Rating: Important Revision Note: V1.0 (June 14, 2016): Bulletin published. Summary: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application...- News
- Thread
- application attack bulletin crafted elevate important june microsoft ms16-075 patch privilege revision security server smb technet update vulnerability windows
- Replies: 0
- Forum: Security Alerts
-
TA16-144A: WPAD Name Collision Vulnerability
Original release date: May 23, 2016 Systems Affected Windows, OS X, Linux systems, and web browsers with WPAD enabled Overview Web Proxy Auto-Discovery (WPAD) Domain Name System (DNS) queries that are intended for resolution on private or enterprise DNS servers have been observed reaching...- News
- Thread
- attack browser collision configuration dns enterprise gtld internal linux mac mitm network proxy public dns recommendations security traffic vulnerability windows wpad
- Replies: 0
- Forum: Security Alerts
-
2880823 - Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program -...
Revision Note: V2.0 (May 18, 2016): Advisory updated to provide links to the current information regarding the use of the SHA1 hashing algorithm for the purposes of SSL and code signing. For more information, see Windows Enforcement of Authenticode Code Signing and Timestamping. Summary...- News
- Thread
- attack authenticode certificate certification code signing digital certificates man-in-the-middle microsoft phishing policy change policy enforcement revision root certificate security sha1 ssl update v2.0 x.509
- Replies: 0
- Forum: Security Alerts
-
MS16-065 - Important: Security Update for .NET Framework (3156757) - Version: 1.0
Severity Rating: Important Revision Note: V1.0 (May 10, 2016): Bulletin published. Summary: This security update resolves a vulnerability in Microsoft .NET Framework. The vulnerability could cause information disclosure if an attacker injects unencrypted data into the target secure channel and...- News
- Thread
- attack important information disclosure microsoft mitm ms16-065 net framework revision note security update vulnerability
- Replies: 0
- Forum: Security Alerts
-
Real-time Threat traffic
Just a cool site that shows real-time attacks on honeypots deployed across the world. Link Removed- Neemobeer
- Thread
- attack cybersecurity honeypots monitoring real time security threats traffic
- Replies: 2
- Forum: Windows Security
-
3123479 - Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program -...
Revision Note: V1.0 (January 12, 2016): Advisory published. Summary: Microsoft is announcing a policy change to the Microsoft Root Certificate Program. The new policy no longer allows root certificate authorities to issue X.509 certificates using the SHA-1 hashing algorithm for the purposes of...- News
- Thread
- 2016 advisory attack certificate code signing deprecation digital certificates man-in-the-middle microsoft phishing policy change revision note root certificate security sha1 spoofing ssl technet v1.0 x.509
- Replies: 0
- Forum: Security Alerts
-
MS16-008 - Important: Security Update for Windows Kernel to Address Elevation of Privilege...
Severity Rating: Important Revision Note: V1.0 (January 12, 2016): Bulletin published. Summary: This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted...- News
- Thread
- 2016 application attack bulletin crafted elevation important kernel microsoft ms16-008 privilege revision security system update vulnerability windows
- Replies: 0
- Forum: Security Alerts
-
MS16-002 - Critical: Cumulative Security Update for Microsoft Edge (3124904) - Version: 1.0
Severity Rating: Critical Revision Note: V1.0 (January 12, 2016): Bulletin published. Summary: This security update resolves vulnerabilities in Microsoft Edge. The vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who...- News
- Thread
- 2016 administrative attack bulletin critical cumulative execution exploit impact microsoft edge ms16-002 remote code execution revision note security summary update user rights vulnerability webpage
- Replies: 0
- Forum: Security Alerts