Threat actors are disseminating malware through the ms-appinstaller URI scheme, which Microsoft has now disabled by default. This method was chosen because it can evade security precautions like Microsoft Defender SmartScreen. Microsoft’s Threat Intelligence team has identified it as an entry point for ransomware, used by threat actors like Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674. The actors spoof legitimate apps, trick users into installing malicious packages, and avoid early detection. Microsoft is advising users to implement phishing-resistant authentication to safeguard against these attacks.
Decrypting Linux/ESXi Akira Ransomware Files Without Paying Ransomware
A cybersecurity researcher has decrypted the Linux/ESXI variant of Akira ransomware, allowing data recovery without ransom. The method exploits a flaw in the malware’s encryption
