<!doctypehtml PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang=en xml:lang=en xmlns=http://www.w3.org/1999/xhtml><meta content="text/html; charset=utf-8"http-equiv=Content-Type><title>
   Russian Hackers Exploiting Recently Patched VMware Flaw, NSA Warns | SecurityWeek.Com
  </title><meta content=en http-equiv=content-language><meta content="text/html; charset=utf-8"http-equiv=Content-Type><script src=/cdn-cgi/apps/head/MtZjAddKzhFJoLq5xYGl1vZkDn8.js></script><link rel="shortcut icon"href=/sites/default/files/securityweek_favicon.ico type=image/x-icon><meta content="Russian state-sponsored hackers are exploiting a recently patched vulnerability affecting VMware Workspace ONE Access, the NSA warns."name=description><meta content="Russian hackers are exploiting a VMware Workspace ONE vulnerability"name=abstract><meta content="Russian,state sponsored,exploiting,VMware Workstation ONE,vulnerability,CVE-2020-4006,NSA"name=keywords><meta content="SecurityWeek - A Wired Business Media Publication"name=copyright><link href=https://www.securityweek.com/russian-hackers-exploiting-recently-patched-vmware-flaw-nsa-warns rel=canonical><meta content="1 day"name=revisit-after><link href=/sites/default/files/css/css_b1dc3201b1d161bd1f69e54e829f2d86.css media=all rel=stylesheet><link href=/sites/default/files/css/css_48d1da3c71246d34552ede6ca6e1c2de.css media=screen,projection rel=stylesheet><script src=/sites/default/files/js/js_105180c2e9622f8c4a12a8590aafb8fe.js></script><script><!--//--><![CDATA[//><!--
jQuery.extend(Drupal.settings, { "basePath": "/", "thickbox": { "close": "Close", "next": "Next \x3e", "prev": "\x3c Prev", "esc_key": "or Esc Key", "next_close": "Next / Close on last", "image_count": "Image !current of !total" }, "disqus": { "url": "https://www.securityweek.com/russian-hackers-exploiting-recently-patched-vmware-flaw-nsa-warns", "title": "Russian Hackers Exploiting Recently Patched VMware Flaw, NSA Warns", "identifier": "node/21473", "shortname": "securityweek" }, "CToolsUrlIsAjaxTrusted": { "/search/google": true }, "quicktabs": { "qt_1": { "tabs": [ 0, 0 ] } } });
//--><!]]></script><script>var googletag = googletag || {};
googletag.cmd = googletag.cmd || [];
(function() {
var gads = document.createElement('script');
gads.async = true;
gads.type = 'text/javascript';
var useSSL = 'https:' == document.location.protocol;
gads.src = (useSSL ? 'https:' : 'http:') + 
'//www.googletagservices.com/tag/js/gpt.js';
var node = document.getElementsByTagName('script')[0];
node.parentNode.insertBefore(gads, node);
})();</script><script>googletag.cmd.push(function() {
googletag.defineSlot('/1009451/300x250-Lower', [300, 250], 'div-gpt-ad-1415848531926-0').addService(googletag.pubads());
googletag.defineSlot('/1009451/300x600-Right-Side', [300, 600], 'div-gpt-ad-1415848531926-1').addService(googletag.pubads());
googletag.defineSlot('/1009451/728x90-Bottom', [728, 90], 'div-gpt-ad-1415848531926-2').addService(googletag.pubads());
googletag.defineSlot('/1009451/SecurityWeek-Splash-640x480', [640, 480], 'div-gpt-ad-1415848531926-3').addService(googletag.pubads());
googletag.defineSlot('/1009451/SecurityWeek_Home_Top_728x90', [728, 90], 'div-gpt-ad-1415848531926-4').addService(googletag.pubads());
googletag.defineSlot('/1009451/SecurityWeek_Home_Top_Right_300x250', [300, 250], 'div-gpt-ad-1415848531926-5').addService(googletag.pubads());
googletag.defineSlot('/1009451/RSA-ThreatInsights-300x600', [300, 600], 'div-gpt-ad-1497322929502-0').addService(googletag.pubads());
    googletag.defineSlot('/1009451/RSA-ThreatInsights-728x90', [728, 90], 'div-gpt-ad-1497322929502-1').addService(googletag.pubads());
googletag.pubads().enableSingleRequest();
googletag.enableServices();
});</script><script>(function (w, d) {
w.biJsUrl = "//app.brightinfo.com/BrightInfoVersion.aspx"; w._biq = w._biq || []; _biq.push("wiredbusinessmedia-14532-1");
function go() { setTimeout(function () {
var bi = document.createElement('script'); bi.type = 'text/javascript'; bi.async = true; bi.src = biJsUrl;
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(bi, s); }, 500); }
if (w.addEventListener) { w.addEventListener("load", go, false); }
else if (w.attachEvent) { w.attachEvent("onload", go); }
}(window, document));</script><body><div class="admin right-col"id=container><div id=top><div class="block block-menu region-odd odd region-count-1 count-1"id=block-menu-menu-top-menu><h3 class=title>SECURITYWEEK NETWORK:</h3><div class=content><ul class=menu><li class="leaf first"><a title="Information Security News"href=https://www.securityweek.com> Information Security News </a><li class=leaf><a title="Infosec Island Commumity"href=http://www.infosecisland.com/> Infosec Island </a><li class="leaf last"><a title="Virtual Cybersecurity Events"href=https://www.securitysummits.com/> Virtual Events </a></ul></div></div><div class="block block-block region-even even region-count-2 count-2"id=block-block-2><h3 class=title>Security Experts:</h3><div class=content><a href=https://securityweek.formstack.com/forms/contact style=color:#FFF> WRITE FOR US </a></div></div></div><div class=clearfix></div><div id=wrapper><div id=header><h1 id=logo><a title="Information Security News, IT Security News and Cybersecurity Insights: SecurityWeek"href=/> <img alt="Information Security News, IT Security News and Cybersecurity Insights: SecurityWeek"src=/sites/default/files/securityweek_logo.jpg> </a></h1><div class="block block-menu region-odd odd region-count-1 count-3"id=block-menu-menu-header-menu><div class=content><ul class=menu><li class="leaf first"><a title="IT Security Newsletter"href=https://www.securityweek.com/subscribe> Subscribe </a><li class=leaf><a title="CISO Forum exclusive event"href=https://www.cisoforum.com> 2020 CISO Forum </a><li class=leaf><a title="ICS/SCADA Cyber Security Conference 2018"href=https://www.icscybersecurityconference.com/> ICS Cyber Security Conference </a><li class="leaf last"><a title="Contact SecurityWeek Team"href=https://securityweek.formstack.com/forms/contact> Contact </a></ul></div></div></div><div class=clearfix></div><div id=navigation><div class="block block-menu region-odd even region-count-1 count-4"id=block-menu-menu-main-navigation><div class=content><ul class=menu><li class="expanded first"><a title="Malware & Threats"href=/virus-threats> Malware & Threats </a> <ul class=menu><li class="leaf first"><a href=/virus-threats/vulnerabilities title=Vulnerabilities> Vulnerabilities </a><li class=leaf><a title="Email Security"href=/virus-threats/email-security> Email Security </a><li class=leaf><a title="Virus & Malware"href=/virus-threats/virus-malware> Virus & Malware </a><li class=leaf><a title="Internet of Things (IoT) Security"href=/virus-threats/white-papers> IoT Security </a><li class=leaf><a title="Threat Intelligence articles"href=/cybercrime/whitepapers> Threat Intelligence </a><li class="leaf last"><a title="Information on Endpoint security"href=/virus-threats/endpoint-security> Endpoint Security </a></ul><li class=expanded><a href=/cybercrime title=Cybercrime> Cybercrime </a> <ul class=menu><li class="leaf first"><a href=/cybercrime/cyberwarfare title=Cyberwarfare> Cyberwarfare </a><li class=leaf><a title="Fraud & Identity Theft"href=/cybercrime/fraud-identity-theft> Fraud & Identity Theft </a><li class=leaf><a href=/cybercrime/phishing title=Phishing> Phishing </a><li class=leaf><a href=/cybercrime/malware title=Malware> Malware </a><li class="leaf last"><a title="Tracking & Law Enforcement"href=/cybercrime/tracking-law-enforcement> Tracking & Law Enforcement </a></ul><li class=expanded><a title="Mobile & Wireless"href=/mobile-wireless> Mobile & Wireless </a> <ul class=menu><li class="leaf first"><a title="Mobile Security"href=/mobile-wireless/mobile-security> Mobile Security </a><li class="leaf last"><a title="Wireless Security"href=/mobile-wireless/wireless-security> Wireless Security </a></ul><li class=expanded><a title="Risk Management & Compliance"href=/privacy-compliance> Risk & Compliance </a> <ul class=menu><li class="leaf first"><a title="Risk Management"href=/privacy-compliance/audits> Risk Management </a><li class=leaf><a href=/privacy-compliance/compliance title=Compliance> Compliance </a><li class="leaf last"><a href=/privacy-compliance/privacy title=Privacy> Privacy </a></ul><li class=expanded><a title="Security Architecture"href=/security-infrastructure> Security Architecture </a> <ul class=menu><li class="leaf first"><a title="Cloud Security"href=/security-infrastructure/cloud-security> Cloud Security </a><li class=leaf><a title="Identity & Access"href=/security-infrastructure/identity-access> Identity & Access </a><li class=leaf><a title="Data Protection"href=/security-infrastructure/data-protection> Data Protection </a><li class=leaf><a title="Network Security"href=/security-infrastructure/network-security> Network Security </a><li class="leaf last"><a title="Application Security "href=/security-infrastructure/application-security> Application Security </a></ul><li class=expanded><a title="Information Security Management & Strategy"href=/management-strategy> Security Strategy </a> <ul class=menu><li class="leaf first"><a title="Risk Management"href=/management-strategy/risk-management> Risk Management </a><li class=leaf><a title="Security Architecture"href=/management-strategy/security-architecture> Security Architecture </a><li class=leaf><a title="Disaster Recovery"href=/management-strategy/disaster-recovery> Disaster Recovery </a><li class=leaf><a title="Training & Certification"href=/management-strategy/training-certification> Training & Certification </a><li class="leaf last"><a title="Incident Response"href=/management-strategy/incident-response> Incident Response </a></ul><li class=leaf><a title="SCADA / ICS"href=/scada-ics> SCADA / ICS </a><li class="leaf last"><a title="IoT Security"href=/iot-security> IoT Security </a></ul></div></div></div><div class=clearfix></div><div id=content><div id=center><div class=breadcrumb><a href=/> Home </a> › <a href=/virus-threats> Virus & Threats </a></div><div class=auth-picture><img class="imagecache imagecache-auth_story"alt height=80 src=https://www.securityweek.com/sites/default/files/imagecache/auth_story/pictures/picture-106.jpg width=68></div><h2 class=page-title>Russian Hackers Exploiting Recently Patched VMware Flaw, NSA Warns</h2><div class="node clear-block"id=node-21473><div class=meta><div class=submitted><div>By <a href=/authors/eduard-kovacs> Eduard Kovacs </a> on December 07, 2020</div><div style=margin-top:2px;><div style="float: left; margin: 1px 0pt 0pt 5px;"><script src=https://platform.linkedin.com/in.js></script><script data-counter=right type=in/share>
           </script></div><div style="float: left; width: 70px;"><g:plusone href=https://www.securityweek.com/russian-hackers-exploiting-recently-patched-vmware-flaw-nsa-warns size=medium> </g:plusone><script>(function() {
           var po = document.createElement("script"); po.type = "text/javascript"; po.async = true;
           po.src = "https://apis.google.com/js/plusone.js";
           var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(po, s);
           })();</script></div><div style="float: left;"><a class=twitter-share-button data-count=horizontal data-via=SecurityWeek href=https://twitter.com/share> Tweet </a><script src=https://platform.twitter.com/widgets.js></script></div><div style="float: left;"><iframe style="border:none; overflow:hidden; width:120px; height:21px;"allowtransparency frameborder=0 scrolling=no src=https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Frussian-hackers-exploiting-recently-patched-vmware-flaw-nsa-warns&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21></iframe></div><div style="float: left;margin-left:12px;"><a href=https://feeds.feedburner.com/securityweek target=_blank> <img style="margin-top: -7px; margin-left: 5px;"src=/images/RSS-Icon.png> </a></div></div></div></div><div class="content clear-block"><p><strong> <span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> Russian state-sponsored hackers have been exploiting a vulnerability that VMware patched recently in some of its products, the National Security Agency (NSA) warned on Monday. </span> </span> </strong><p><span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> The vulnerability is tracked as <a href=https://www.vmware.com/security/advisories/VMSA-2020-0027.html target=_blank> CVE-2020-4006 </a> and it has been found to impact the VMware Workspace ONE Access identity management product and some related components, including Identity Manager (vIDM) on Linux, vIDM Connector on Windows and Linux, VMware Cloud Foundation and vRealize Suite Lifecycle Manager. </span> </span><p><span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> An attacker who has gained access to the system’s web-based management interface can exploit the vulnerability to execute arbitrary commands with elevated privileges on the underlying operating system. </span> </span><p><img alt="NSA warning on CVE-2020-4006 exploitation"style="float: right; margin: 5px 10px;"title="NSA warning on CVE-2020-4006 exploitation"height=150 src=/sites/default/files/images/NSA_VMware.png width=300><p><span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> VMware first <a href=https://www.securityweek.com/vmware-working-patches-critical-workspace-one-access-vulnerability target=_blank> disclosed the vulnerability </a> on November 23, when it told customers that it had been working on a fix. A few days ago, when it announced the <a href=https://www.securityweek.com/vmware-patches-workspace-one-access-vulnerability-reported-nsa target=_blank> availability of patches </a> , the virtualization giant revealed that it learned of the flaw from the NSA, but without mentioning active exploitation. </span> </span><p><span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> In an advisory published on Monday, the NSA said “Russian state-sponsored malicious cyber actors” have been exploiting CVE-2020-4006, but it has not shared any information on the group (or groups) that launched the attacks or any of the targets. Based on the disclosure timeline, it’s likely that the security hole was being exploited before a patch was released. </span> </span><p><span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> The NSA did say that the vulnerability has been exploited as part of an attack that resulted in the attackers gaining access to sensitive data. </span> </span><p><span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> “The exploitation via command injection led to installation of a web shell and follow-on malicious activity where credentials in the form of SAML authentication assertions were generated and sent to Microsoft Active Directory Federation Services (ADFS), which in turn granted the actors access to protected data,” the NSA said in its <a href=https://media.defense.gov/2020/Dec/07/2002547071/-1/-1/0/CSA_VMWARE%20ACCESS_U_OO_195076_20.PDF target=_blank> advisory </a> . </span> </span><p><span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> The agency highlighted that setting a unique and strong password, as well as ensuring that the web-based management interface is not accessible from the internet, reduces the risk of exploitation. However, it noted that setting a strong password “would likely not mitigate an existing compromise.” </span> </span><p><span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> The NSA’s advisory also includes information that can help organizations detect attacks — an “exit” statement followed by a 3-digit number in the configurator.log file indicates an attack — but the agency has not shared other indicators of compromise (IOCs) that could be useful to defenders, such as hashes and IP addresses. </span> </span><p><span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> While the NSA’s advisory focuses on providing advice to government organizations, the U.S. government, through the DHS’s Cybersecurity and Infrastructure Security Agency (CISA), has also <a href=https://us-cert.cisa.gov/ncas/current-activity/2020/12/03/vmware-releases-security-updates-address-cve-2020-4006 target=_blank> alerted </a> the private sector about the risk posed by CVE-2020-4006. </span> </span><p><strong> <span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> Related: <a href=https://www.securityweek.com/microsoft-warns-russian-cybercriminals-exploiting-zerologon-vulnerability target=_blank> Microsoft Warns of Russian Cybercriminals Exploiting Zerologon Vulnerability </a> </span> </span> </strong><p><strong> <span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> Related: <a href=https://www.securityweek.com/russian-hackers-exploited-windows-flaws-attacks-european-firms target=_blank> Russian Hackers Exploited Windows Flaws in Attacks on European Firms </a> </span> </span> </strong><p><strong> <span style="font-size: medium;"> <span style='font-family: "trebuchet ms", geneva;'> Related: <a href=https://www.securityweek.com/several-exim-vulnerabilities-exploited-russia-linked-attacks target=_blank> Several Exim Vulnerabilities Exploited in Russia-Linked Attacks </a> </span> </span> </strong><div style="margin:5px 0;"class=ad_in_content><div class=image-advertisement id=ad-1296><a href=https://www.securityweek.com/ad/redirect/1296/t47?url=https://www.google.com/ rel=nofollow> </a></div><div class=ad-image-counter><img alt="view counter"height=0 src=https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=1296 width=0></div><div style=clear:both></div></div><div class=sharethis><div style="float: left; margin: 1px 0pt 0pt 5px;"><script src=https://platform.linkedin.com/in.js></script><script data-counter=right type=in/share>
          </script></div><div style="float: left; width: 70px;"><g:plusone href=https://www.securityweek.com/russian-hackers-exploiting-recently-patched-vmware-flaw-nsa-warns size=medium> </g:plusone><script>(function() {
           var po = document.createElement("script"); po.type = "text/javascript"; po.async = true;
           po.src = "https://apis.google.com/js/plusone.js";
           var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(po, s);
           })();</script></div><div style="float: left;"><a class=twitter-share-button data-count=horizontal data-via=SecurityWeek href=https://twitter.com/share> Tweet </a><script src=https://platform.twitter.com/widgets.js></script></div><div style="float: left;"><iframe style="border:none; overflow:hidden; width:120px; height:21px;"allowtransparency frameborder=0 scrolling=no src=https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Frussian-hackers-exploiting-recently-patched-vmware-flaw-nsa-warns&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21></iframe></div><div style="float: left;margin-left:12px;"><a href=https://feeds.feedburner.com/securityweek target=_blank> <img style="margin-top: -7px; margin-left: 5px;"src=/images/RSS-Icon.png> </a></div><div style=clear:both></div></div><div class=author_content><div class=author_text><div class=auth-picture><img class="imagecache imagecache-auth_story"alt height=80 src=https://www.securityweek.com/sites/default/files/imagecache/auth_story/pictures/picture-106.jpg width=68></div> Eduard Kovacs ( <a href=https://twitter.com/EduardKovacs> @EduardKovacs </a> ) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.</div><div class=author_title><span class=headline> Previous Columns by Eduard Kovacs: </span><div class=views-row><div class=views-field-title><span class=field-content> <a href=/vulnerability-ni-controller-can-allow-hackers-remotely-disrupt-production> Vulnerability in NI Controller Can Allow Hackers to Remotely Disrupt Production </a> </span></div></div><div class=views-row><div class=views-field-title><span class=field-content> <a href=/industry-reactions-fireeye-breach-feedback-friday> Industry Reactions to FireEye Breach: Feedback Friday </a> </span></div></div><div class=views-row><div class=views-field-title><span class=field-content> <a href=/poc-released-unpatched-windows-vulnerability-present-2006> PoC Released for Unpatched Windows Vulnerability Present Since 2006 </a> </span></div></div><div class=views-row><div class=views-field-title><span class=field-content> <a href=/venafi-becomes-unicorn-after-investment-thoma-bravo> Venafi Becomes Unicorn After Investment From Thoma Bravo </a> </span></div></div><div class=views-row><div class=views-field-title><span class=field-content> <a href=/application-intelligence-firm-bionic-emerges-stealth-17m-funding> Application Intelligence Firm Bionic Emerges From Stealth With $17M in Funding </a> </span></div></div></div><div style=clear:both></div></div><div class=sponsored_links_box><div style="float:left;font-size: 11px;width:500px"><div class=html-advertisement id=ad-1030><p><a href=http://www.cisoforum.com> 2020 CISO Forum: September 23-24, 2020 - A Virtual Event </a></div><div class=ad-image-counter><img alt="view counter"height=0 src=https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=1030 width=0></div><div class=advertisement-space id=space-t46-1></div><div class=html-advertisement id=ad-894><p><a href=https://www.securitysummits.com> Virtual Event Series - Security Summit Online Events by SecurityWeek </a></div><div class=ad-image-counter><img alt="view counter"height=0 src=https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=894 width=0></div><div class=advertisement-space id=space-t46-2></div><div class=html-advertisement id=ad-693><p><a href=http://www.icscybersecurityconference.com/> 2020 ICS Cyber Security Conference | USA [Oct. 19-22] </a></div><div class=ad-image-counter><img alt="view counter"height=0 src=https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=693 width=0></div><div class=advertisement-space id=space-t46-3></div><div class=html-advertisement id=ad-683><p><a href=http://www.icscybersecurityconference.com/singapore> 2020 Singapore ICS Cyber Security Conference [VIRTUAL- June 16-18, 2020] </a></div><div class=ad-image-counter><img alt="view counter"height=0 src=https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=683 width=0></div></div><div class=headline>sponsored links</div><div style=clear:both></div></div><div class=author-terms><div class=terms><img alt height=14 src=/images/tag_icon.jpg width=16><b> Tags: </b><ul class=links><li class="taxonomy_term_33 first"><a href=/news-industry rel=tag> NEWS & INDUSTRY </a><li class=taxonomy_term_1><a href=/virus-threats rel=tag> Virus & Threats </a><li class=taxonomy_term_39><a title="Risk Management"href=/management-strategy/risk-management rel=tag> Risk Management </a><li class=taxonomy_term_37><a href=/virus-threats/vulnerabilities rel=tag title=Vulnerabilities> Vulnerabilities </a><li class=taxonomy_term_3><a href=/cybercrime rel=tag> Cybercrime </a><li class="taxonomy_term_6 last"><a href=/management-strategy rel=tag> Management & Strategy </a></ul></div><div style=clear:both></div></div><div id=disqus_thread></div><noscript><div class=disqus-noscript><a href=http://securityweek.disqus.com/?url=https%3A%2F%2Fwww.securityweek.com%2Frussian-hackers-exploiting-recently-patched-vmware-flaw-nsa-warns> View the discussion thread. </a></div></noscript></div></div></div><div id=right><div class="block block-google_cse region-odd odd region-count-1 count-7"id=block-google_cse-0><div class=content><form accept-charset=UTF-8 action=/search/google id=google-cse-searchbox-form><div><input id=edit-cx name=cx type=hidden value=016540353864684098383:6mcx-eenlzi><input id=edit-cof name=cof type=hidden value=FORID:11><div class=form-item id=edit-query-wrapper><input title="Enter the terms you wish to search for."class=form-text id=edit-query maxlength=128 name=query size=15></div><input class=form-submit id=edit-sa name=op type=submit value=Search><input id=edit-safe name=safe type=hidden value=off><input id=form-bssOryCb8fndcV9CxxYGTctDnmRErbWKv6azC8op8Vs name=form_build_id type=hidden value=form-bssOryCb8fndcV9CxxYGTctDnmRErbWKv6azC8op8Vs><input id=edit-google-cse-searchbox-form name=form_id type=hidden value=google_cse_searchbox_form></div></form></div></div><div class="block block-block region-even even region-count-2 count-8"id=block-block-3><h3 class=title>Get the Daily Briefing</h3><div class=content><center> <img align=center src=https://www.securityweek.com/images/security_newsletter.gif> <br> <div class=form-subscribe><form action=https://visitor.constantcontact.com/d.jsp method=post name=ccoptin target=_blank><input name=m type=hidden value=1102592012458><input name=p type=hidden value=oi><div class=form-item><input class="form-text required"value="Business Email Address"maxlength=128 name=ea size=60><input class=submit name=go type=submit value=Subscribe></div></form></div> </center><center> <a href=https://twitter.com/securityweek target=_a> <img alt=subscribe_icon_54 border=0 height=41 src=/images/subscribe_icon_new_03.jpg width=42> </a>   <a href=https://www.facebook.com/pages/SecurityWeekCom/366251913615> <img alt="Become a Fan on Facebook"border=0 height=41 src=/images/subscribe_icon_new_05.jpg width=42> </a>   <a href=https://www.linkedin.com/groups?gid=2983767> <img alt="Join our Group on LinkedIn"title="Join our Group on LinkedIn"border=0 height=41 src=/images/subscribe_icon_new_07.jpg width=42> </a>   <a href=https://feeds.feedburner.com/securityweek> <img alt="Subscribe via RSS"border=0 height=41 src=/images/rss_icon_new_11.jpg width=42> </a> </center></div></div><div class="block block-block region-odd odd region-count-3 count-9"id=block-block-19><div class=content><div style="height:600px; width:300px;"id=div-gpt-ad-1415848531926-1><script>googletag.cmd.push(function() { googletag.display('div-gpt-ad-1415848531926-1'); });</script></div></div></div><div class="block block-quicktabs region-even even region-count-4 count-10"id=block-quicktabs-1><div class=content><div class="quicktabs_wrapper quicktabs-style-nostyle"id=quicktabs-1><ul class="quicktabs_tabs quicktabs-style-nostyle"><li class="qtab-0 active first"><a class="qt_tab active"href=/russian-hackers-exploiting-recently-patched-vmware-flaw-nsa-warns?quicktabs_1=0#quicktabs-1 id=quicktabs-tab-1-0> Most Recent </a><li class="qtab-1 last"><a class="qt_tab active"href=/russian-hackers-exploiting-recently-patched-vmware-flaw-nsa-warns?quicktabs_1=1#quicktabs-1 id=quicktabs-tab-1-1> Most Read </a></ul><div class="quicktabs_main quicktabs-style-nostyle"id=quicktabs_container_1><div class=quicktabs_tabpage id=quicktabs_tabpage_1_0><div class="block block-security_week region-odd odd region-count-1 count-5"id=block-security_week-1><div class=content><div class=item-list><ul><li class=first><a href=/fbi-cisa-and-ms-isac-warn-cyberattacks-targeting-k-12-schools> FBI, CISA and MS-ISAC Warn of Cyberattacks Targeting K-12 Schools </a><li><a href=/vulnerability-ni-controller-can-allow-hackers-remotely-disrupt-production> Vulnerability in NI Controller Can Allow Hackers to Remotely Disrupt Production </a><li><a href=/google-cloud-hires-first-ciso> Google Cloud Hires First CISO </a><li><a href=/security-predictions-new-year-budgets-will-suffer-2021> Security Predictions for the New Year: Budgets will Suffer in 2021 </a><li><a href=/operations-hacker-groups-vietnam-bangladesh-disrupted-facebook> Operations of Hacker Groups in Vietnam, Bangladesh Disrupted by Facebook </a><li><a href=/spotify-informs-users-personal-information-exposure> Spotify Informs Users of Personal Information Exposure </a><li><a href=/industry-reactions-fireeye-breach-feedback-friday> Industry Reactions to FireEye Breach: Feedback Friday </a><li><a href=/cisco-patches-wormable-zero-click-vulnerability-jabber> Cisco Patches Wormable, Zero-Click Vulnerability in Jabber </a><li><a href=/france-fines-google-amazon-135-mn-euros> France Fines Google, Amazon 135 Mn Euros </a><li class=last><a href=/poc-released-unpatched-windows-vulnerability-present-2006> PoC Released for Unpatched Windows Vulnerability Present Since 2006 </a></ul></div></div></div></div><div class="quicktabs_tabpage quicktabs-hide"id=quicktabs_tabpage_1_1><div class="block block-views region-even even region-count-2 count-6"id=block-views-most_read-block_1><div class=content><div class="view view-most-read view-id-most_read view-display-id-block_1 view-dom-id-1"><div class=view-content><div class="views-row views-row-1 views-row-odd views-row-first"><div class=views-field-title><span class=field-content> <a href=/content/looking-malware-all-wrong-places-0> Looking for Malware in All the Wrong Places? </a> </span></div></div><div class="views-row views-row-2 views-row-even"><div class=views-field-title><span class=field-content> <a href=/content/first-step-internets-next-25-years-adding-security-dns> First Step For The Internet's next 25 years: Adding Security to the DNS </a> </span></div></div><div class="views-row views-row-3 views-row-odd"><div class=views-field-title><span class=field-content> <a href=/content/tattle-tale-what-your-computer-says-about-you> Tattle Tale: What Your Computer Says About You </a> </span></div></div><div class="views-row views-row-4 views-row-even"><div class=views-field-title><span class=field-content> <a href=/content/be-position-act-through-cyber-situational-awareness> Be in a Position to Act Through Cyber Situational Awareness </a> </span></div></div><div class="views-row views-row-5 views-row-odd"><div class=views-field-title><span class=field-content> <a href=/report-shows-heavily-regulated-industries-letting-social-networking-apps-run-rampant> Report Shows Heavily Regulated Industries Letting Social Networking Apps Run Rampant </a> </span></div></div><div class="views-row views-row-6 views-row-even"><div class=views-field-title><span class=field-content> <a href=/2010-great-year-be-scammer> 2010, A Great Year To Be a Scammer. </a> </span></div></div><div class="views-row views-row-7 views-row-odd"><div class=views-field-title><span class=field-content> <a href=/content/dont-let-dns-be-your-single-point-failure> Don't Let DNS be Your Single Point of Failure </a> </span></div></div><div class="views-row views-row-8 views-row-even"><div class=views-field-title><span class=field-content> <a href=/content/how-identify-malware-blink> How to Identify Malware in a Blink </a> </span></div></div><div class="views-row views-row-9 views-row-odd"><div class=views-field-title><span class=field-content> <a href=/content/defining-and-debating-cyber-warfare> Defining and Debating Cyber Warfare </a> </span></div></div><div class="views-row views-row-10 views-row-even"><div class=views-field-title><span class=field-content> <a href=/five-a%E2%80%99s-make-cybercrime-so-attractive> The Five A’s that Make Cybercrime so Attractive </a> </span></div></div><div class="views-row views-row-11 views-row-odd"><div class=views-field-title><span class=field-content> <a href=/content/how-defend-against-ddos-attacks> How to Defend Against DDoS Attacks </a> </span></div></div><div class="views-row views-row-12 views-row-even"><div class=views-field-title><span class=field-content> <a href=/content/security-budgets-not-line-threats> Security Budgets Not in Line with Threats </a> </span></div></div><div class="views-row views-row-13 views-row-odd"><div class=views-field-title><span class=field-content> <a href=/content/anycast-three-reasons-why-your-dns-network-should-use-it> Anycast - Three Reasons Why Your DNS Network Should Use It </a> </span></div></div><div class="views-row views-row-14 views-row-even"><div class=views-field-title><span class=field-content> <a href=/content/evolution-enterprise-security-approaches-forward-thinking-organizations> The Evolution of the Extended Enterprise: Security Strategies for Forward Thinking Organizations </a> </span></div></div><div class="views-row views-row-15 views-row-odd views-row-last"><div class=views-field-title><span class=field-content> <a href=/using-dns-across-extended-enterprise-it%E2%80%99s-risky-business> Using DNS Across the Extended Enterprise: It’s Risky Business </a> </span></div></div></div></div></div></div></div></div></div></div></div><div class="block block-block region-odd odd region-count-5 count-11"id=block-block-12><div class=content><p><a href=https://bit.ly/OT-Threats target=_blank> <img alt="IoT-ICS Threat Atlas"title="Global IIoT Attacks"height=250 src=/sites/default/files/features/ICS_Threat_Atlas.jpg width=300> </a></div></div></div></div><div class=clearfix></div><div class=clear id=footer><div class="block block-menu region-odd even region-count-1 count-12"id=block-menu-menu-popular-topics><h3 class=title>Popular Topics</h3><div class=content><ul class=menu><li class="leaf first"><a title="Information Security News"href=/> Information Security News </a><li class=leaf><a title="IT Security News"href=/> IT Security News </a><li class=leaf><a title="IT Risk Management"href=/management-strategy/risk-management> Risk Management </a><li class=leaf><a title="Cybercrime News"href=https://www.securityweek.com/cybercrime> Cybercrime </a><li class=leaf><a href=https://www.securityweek.com/security-infrastructure/cloud-security> Cloud Security </a><li class=leaf><a href=/security-infrastructure/application-security> Application Security </a><li class="leaf last"><a title="Information on Securing Smart Devices"href=https://www.securityweek.com/smart-device-security> Smart Device Security </a></ul></div></div><div class="block block-menu region-even odd region-count-2 count-13"id=block-menu-menu-security-community><h3 class=title>Security Community</h3><div class=content><ul class=menu><li class="leaf first"><a title="IT Security Newsletters"href=https://www.securityweek.com/subscribe> IT Security Newsletters </a><li class=leaf><a title="ICS Cyber Security Conference Series"href=http://www.icscybersecurityconference.com/> ICS Cyber Security Conference </a><li class=leaf><a title="CISO Forum"href=http://www.cisoforum.com/> CISO Forum, Presented by Intel </a><li class="leaf last"><a title="Infosec Island Security Community Site"href=http://www.infosecisland.com/> InfosecIsland.Com </a></ul></div></div><div class="block block-menu region-odd even region-count-3 count-14"id=block-menu-menu-stay-intouch><h3 class=title>Stay Intouch</h3><div class=content><ul class=menu><li class="leaf first"><a title="Follow us on Twitter"href=https://twitter.com/securityweek> Twitter </a><li class=leaf><a title="Become a Fan on Facebook"href=https://www.facebook.com/pages/SecurityWeekCom/366251913615> Facebook </a><li class=leaf><a href=https://www.linkedin.com/groups?gid=2983767> LinkedIn Group </a><li class=leaf><a title="Cyber Weapon Discussion Global Discussion Group on LinkedIn"href=https://www.linkedin.com/groups?mostPopular=&gid=3551517> Cyber Weapon Discussion Group </a><li class=leaf><a href=https://feeds.feedburner.com/securityweek> RSS Feed </a><li class=leaf><a href=https://www.securityweek.com/contact-us> Submit Tip </a><li class="leaf last"><a title="Security Intelligence Group on LinkedIn"href=https://www.linkedin.com/groups?gid=4439585> Security Intelligence Group </a></ul></div></div><div class="block block-menu region-even odd region-count-4 count-15"id=block-menu-menu-about-securityweek><h3 class=title>About SecurityWeek</h3><div class=content><ul class=menu><li class="leaf first"><a href=/> Team </a><li class=leaf><a href=https://securityweek.formstack.com/forms/contact> Advertising </a><li class=leaf><a title="Cybersecurity event sponsorship opportunities"href=https://www.securitysummits.com/sponsors/> Event Sponsorships </a><li class=leaf><a href=https://securityweek.formstack.com/forms/contact> Writing Opportunities </a><li class=leaf><a href=https://securityweek.formstack.com/forms/contact> Feedback </a><li class="leaf last"><a href=https://securityweek.formstack.com/forms/contact> Contact Us </a></ul></div></div><div id=footer-message><div class=wired><img alt="Wired Business Media"border=0 src=/images/wired_publishing.jpg vspace=1></div><div class=copyright>Copyright © 2020 Wired Business Media. All Rights Reserved. <a href=https://www.securityweek.com/privacy-policy> Privacy Policy </a></div></div></div></div></div><script src=/sites/default/files/js/js_1ebf44b3392a0236988c806a44aaeec4.js></script><script src=/sites/all/modules/custom_control/misc/init.js?1607713550></script><script><!--//--><![CDATA[//><!--
jQuery.extend(Drupal.settings, { "googleCSE": { "language": "en" } });
//--><!]]></script><script>var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-11590534-1']);
  _gaq.push(['_setDomainName', '.securityweek.com']);
  _gaq.push(['_trackPageview']);

  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();</script>