Kaspersky Lab unveils third hole in Windows that exploits cyberattacks in three months

Microsoft Windows

Kaspersky Lab's technologies have automatically revealed a new flaw in the heart of the Windows operating system. This vulnerability is the third vulnerability exploited in the Microsoft system in three months. These are used by subversives to launch attacks known as zero-day attacks. The latest exploits (CVE-2018-8611) have been discovered in malware targeting a small number of victims in countries in the Middle East and Asia. Exploitation is dangerous because of the vulnerability in the core of the operating system and can be used to bypass the operating mechanisms contained in modern web browsers, such as Chrome and Edge. Microsoft has been notified of the vulnerability and has rushed to a hotfix release.

This type of vulnerability remains unknown, and therefore uncontrolled, until discovered, allowing attackers to exploit it to access victim systems and devices. It therefore represents a considerable value for subversive networks in the world of cyber threats and is difficult to detect.

Kaspersky Lab has been able to detect the three exploits of automatic anti-exploits prevention technology, integrated with most of the company's security products. The last loophole exploited victims in the Middle East and Africa, such as the two previously exploited and discovered exploits (CVE-2018-8589 and CVE-2018-8453), before being corrected by Microsoft in October and November. The malware authors named Alice on the first CVE-2018-8589 interval, while referring to the new space named Jasmine. Researchers at Kaspersky Lab believe that many subversive networks have exploited this new space, including a new entity called Sandcat, which specializes in persistent threats.

"The discovery of three holes in the heart of Windows in a few months proves that our products use the best technologies to detect such sophisticated threats," said Anton Ivanov, security expert at Kaspersky Lab. "It's important for businesses to understand that, in order to protect its perimeter, use an integrated solution, such as terminal protection, with an advanced platform to detect threats.

Kaspersky Lab recommends the following security measures:

• Download the hotfix for the new vulnerability in the Windows system from Microsoft.
• Be sure to regularly update all software used in the company and when posting any new security patches. Security products with vulnerability assessment capabilities and corrective software management can help automate these processes.
• The choice of a secure security solution such as Kaspersky Endpoint Security is endowed with behavior-based detection capabilities to provide effective protection against known and unknown threats, including security threats. exploitation.
• Use advanced security tools such as Kaspersky Anti-Targeted Attack Platform, if the company becomes vulnerable to targeted attacks.
• Provide the company's security team with a reliable source of up-to-date information on cyber-threats. Kaspersky Intelligence Reporting customers have access to special reports on the latest developments in the threat landscape. You can contact the company via [email protected] for more details.
• Ensure that staff are trained in the basics of electronic security.