Threat actors are disseminating malware through the ms-appinstaller URI scheme, which Microsoft has now disabled by default. This method was chosen because it can evade security precautions like Microsoft Defender SmartScreen. Microsoft’s Threat Intelligence team has identified it as an entry point for ransomware, used by threat actors like Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674. The actors spoof legitimate apps, trick users into installing malicious packages, and avoid early detection. Microsoft is advising users to implement phishing-resistant authentication to safeguard against these attacks.
News – Kansas healthcare provider Sunflower Medical Group reports major data breach – TEISS
Kansas-based healthcare provider, Sunflower Medical Group, has reported a major data breach.
