Kaspersky Archives

Winsage

April 13, 2025

Microsoft is digging its own grave with Windows 11, and it has to stop

Microsoft is actively encouraging users to upgrade to Windows 11 through advertisements and reminders, which raises sustainability concerns. The upgrade requires a Trusted Platform Module (TPM) 2.0 chip, and while upgrading without it is technically possible, it is not recommended. The end of life for Windows 10 may lead to increased e-waste as many devices could be discarded. Users desire a stable, continuously updated operating system without disruptive upgrades, similar to macOS. A 2021 Kaspersky report indicated that 73% of healthcare providers globally still use outdated operating systems for critical medical equipment, highlighting financial constraints that hinder upgrades. Users are frustrated with the increasing presence of ads and notifications in Windows, feeling that Windows 11 operates more like a service they pay for but do not fully own. The dissatisfaction extends to Windows 10 users, who anticipate the end of life for the OS as a way to regain control over their digital experience.

Tech Optimizer

April 13, 2025

Panda Dome review

Panda Security, a Spanish antivirus company, has introduced various cybersecurity innovations since its founding, including daily signature updates in 1998, behavioral monitoring in 2004, and cloud scanning in 2007. It offers several plans for home users: Panda Dome Essential, Advanced, Complete, and Premium, each with increasing features such as firewall protection, WiFi security, online shopping safeguards, and a Dark Web Scanner. All plans include a 30-day free trial. Panda Dome received an AAA award from SE Labs for a Total Accuracy Rating of 99% without false positives between October and December 2024, outperforming Microsoft Defender and Webroot but not achieving the perfect scores of Avast, Kaspersky, and McAfee. The AV-Test Product Review awarded Panda a score of 6/6 for protection and usability, and 5.5/6 for performance. However, Panda Free Antivirus had a higher number of false alarms in AV-Comparatives’ False Alarm Test. The Panda Dome Advanced plan, priced at .99 for the first year, includes parental controls and enhanced ransomware protection. It offers multiple scanning options and reasonable scan times. Its anti-ransomware features include behavior-based detection, file access control, and backup capabilities. Panda Dome Complete, priced at .99 for the first year, adds system cleanup tools and a password manager, allowing users to optimize system performance and securely manage passwords. It also includes file encryption and shredding features. Panda Dome Premium, priced at .99 for the first year, provides unrestricted VPN access, an update manager, and unlimited premium technical support. It allows secure browsing across over 60 countries for up to five devices and includes features to keep systems updated and secure.

Tech Optimizer

April 9, 2025

Flaw in ESET Security Software Used to Spread Malware From ToddyCat Group

A vulnerability in ESET's software, designated as CVE-2024-11859, allows state-backed hackers to introduce a malicious dynamic-link library (DLL) that can be executed via the ESET antivirus scanner. This malicious code operates discreetly, avoiding detection by system alerts. ESET classified the issue as medium severity with a CVSS score of 6.8 out of 10 and urged users to update their systems promptly to mitigate risks.

Winsage

April 9, 2025

Exploitation of CLFS zero-day leads to ransomware activity

The Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) identified a zero-day elevation of privilege vulnerability in the Windows Common Log File System (CLFS), designated as CVE-2025-29824. This vulnerability has been exploited by the PipeMagic malware, attributed to the group Storm-2460, affecting organizations in various sectors across the U.S., Venezuela, Spain, and Saudi Arabia. Microsoft released security updates on April 8, 2025, to address this vulnerability. The exploit allows attackers with standard user privileges to escalate their access, and it was executed from a dllhost.exe process. The exploit utilizes memory corruption techniques and the RtlSetAllBits API to gain all privileges and inject processes into SYSTEM processes. Post-exploitation, the attackers injected a payload into winlogon.exe, leading to ransomware activity characterized by file encryption and the creation of ransom notes. Indicators of compromise include the creation of a CLFS BLF file at C:ProgramDataSkyPDFPDUDrv.blf, command lines associated with ransomware activities, and specific domains linked to PipeMagic. Microsoft advises applying security updates promptly and recommends strategies for mitigating ransomware threats, including enabling cloud-delivered protection and utilizing device discovery.

Winsage

April 9, 2025

Microsoft: Windows CLFS zero-day exploited by ransomware gang

Microsoft reported that the RansomEXX ransomware gang has been exploiting a critical zero-day vulnerability in the Windows Common Log File System, identified as CVE-2025-29824, allowing them to gain SYSTEM privileges on targeted systems. This vulnerability stems from a use-after-free flaw and affects organizations in various sectors, including IT and real estate in the US, financial institutions in Venezuela, a Spanish software company, and the retail sector in Saudi Arabia. Microsoft has released security updates for most affected Windows versions but has postponed patches for Windows 10 x64 and 32-bit systems. Customers running Windows 11, version 24H2, are not vulnerable to the exploitation. The RansomEXX group, also known as Storm-2460, uses the PipeMagic backdoor malware to facilitate the exploitation of CVE-2025-29824, alongside ransomware payloads. The group has targeted high-profile organizations, including GIGABYTE, Konica Minolta, the Texas Department of Transportation, Brazil's court system, Montreal's STM public transport system, and government software provider Tyler Technologies.

Winsage

March 28, 2025

Windows Users at Risk: New Zero-Day Exploit Steals Passwords Without Interaction

A newly uncovered zero-day vulnerability in Windows allows hackers to steal NTLM credentials simply by previewing a malicious file, affecting multiple Windows versions, including Windows 7 and Windows 11 v24H2. Microsoft has not yet issued a patch for this vulnerability, leaving millions of users exposed. The flaw was reported by security researcher Mitja Kolsek from ACROS Security, who noted that stolen credentials could lead to unauthorized access to networks. ACROS Security has created a temporary micro-patch available through its 0patch platform, which users are encouraged to implement. Additionally, a separate zero-day vulnerability identified in Google Chrome and other Chromium-based browsers allows attackers to bypass sandbox protection with a click on a malicious link, primarily targeting media organizations and government agencies in Russia. Users are advised to install the 0patch fix, avoid interacting with unfamiliar files, and update their browsers to protect against these threats.

Winsage

March 28, 2025

Mozilla warns Windows users of critical Firefox sandbox escape flaw

Mozilla released Firefox version 136.0.4 to address a critical security vulnerability, CVE-2025-2857, which could allow attackers to escape the browser's sandbox on Windows systems. This flaw, identified by developer Andrew McCreight, affects both standard and extended support releases of Firefox. Mozilla patched this issue in Firefox 136.0.4 and Firefox ESR versions 115.21.1 and 128.8.1. The vulnerability is similar to a recent zero-day exploit in Google Chrome, CVE-2025-2783, which was used in cyber-espionage campaigns against Russian entities. Additionally, Mozilla previously addressed another zero-day vulnerability, CVE-2024-9680, exploited by the RomCom cybercrime group, allowing code execution within Firefox's sandbox. Earlier in the year, Mozilla responded to two zero-day vulnerabilities exploited during the Pwn2Own Vancouver 2024 hacking competition.

Tech Optimizer

March 25, 2025

Kapersky Internet Security and Antivirus Review 2025

Kaspersky Anti-Virus features a user-friendly interface organized into four main sections: scan, database update, reports, and an on-screen keyboard. The on-screen keyboard enhances privacy when entering sensitive data, protecting against keyloggers. The Reports section provides an overview of scanning activities and includes data from the System Watcher feature, which can mitigate malware attacks. The Database Update section allows for automatic updates to keep the software current with the latest threats, with options for manual scheduling. The scan menu includes a Quick Scan that completes in about seven minutes and a Full Scan that can take several hours; both scans detected all actual malware during testing. Additional scanning options include selective scans and removable drive scans. The software allows for high customization, including a "Gamer Mode" that defers scheduled scans during full-screen applications. It also postpones tasks during battery operation or high disk activity and offers an option to opt out of promotional offers.

Winsage

March 12, 2025

Microsoft patches Windows Kernel zero-day exploited since 2023

ESET has identified a zero-day vulnerability in the Windows Win32 Kernel Subsystem, designated as CVE-2025-24983, which has been exploited since March 2023. This vulnerability, stemming from a use-after-free weakness, allows low-privileged attackers to escalate access to SYSTEM privileges without user interaction. It primarily affects older Windows versions, including Windows Server 2012 R2 and Windows 8.1, but also poses risks to newer versions like Windows Server 2016 and Windows 10 (build 1809 and earlier). The exploit was first seen in the wild in March 2023, targeting systems compromised by the PipeMagic malware. Microsoft has addressed this vulnerability in the recent Patch Tuesday updates. Additionally, five other zero-day vulnerabilities were also patched, and CISA has mandated that Federal Civilian Executive Branch agencies secure their systems by April 1st.

Tech Optimizer

March 12, 2025

Malware steals bank cards and passwords from millions of devices

Infostealer malware has become a major cybersecurity threat, with around 25 million users targeted between early 2023 and the end of 2024. These malware variants capture sensitive information, including bank card details and passwords, with nearly 26 million devices affected during this period, resulting in over 2 million unique bank card details leaked. One in every 14 infections compromised bank card data, passwords, and second-factor authentication cookies. In 2024, infections increased significantly, with RisePro's share rising from 1.4% to 22.45% and Stealc from 2.65% to 13.33%. Redline remained the most prevalent infostealer, responsible for 34.36% of infections. By August 2024, an estimated 15.9 million devices had been affected in 2023, increasing to 16.49 million by March 2025. Over 9 million infections were tracked in 2024, with final counts expected to exceed those of 2023. To protect sensitive information, it is recommended to invest in robust antivirus software, use virtual cards for online transactions, set up transaction alerts and spending limits, avoid storing card details in browsers, use strong and unique passwords, and consider personal data removal services.