Weekly Intelligence Bulletin – Week 50

Security researchers at SentinelOne published a report highlighting activity of a new TrickBot derivative dubbed Anchor with links to known Lazarus Group resources, implying the threat actor became a customer of TrickBot operators. In separate incidents, researchers at CybeReason observed unnamed attackers leveraging Anchor in targeted attacks targeting Point-of-Sale systems of organizations in the financial, manufacturing, and retail sectors based in Europe and the US beginning in October.

Microsoft’s Patch Tuesday release includes fixes for 36 vulnerabilities across multiple, widely used products, with one vulnerability impacting a Win32k component in Windows currently being exploited in the wild. Adobe’s release includes 21 vulnerabilities for Adobe Acrobat and Reader.

The US imposed sanctions on companies involved in constructing the Nord Stream 2 pipeline which transfers gas from Russia to Germany. These sanctions can be seen as part of the ongoing deterioration of regulations protecting open global trade, which will likely damage all companies to some extent due to the reliance on globalized supply chains and international trade.