Microsoft recently warned that more cybercriminals have started to incorporate exploit code for the ZeroLogon vulnerability in their attacks.  Threat actor TA505, a financially motivated threat group that has been active since at least 2014, is now exploiting this vulnerability. The group is known for frequently changing malware and driving global trends in criminal malware distribution, according to MITRE. In a tweet, Microsoft Security Intelligence said, “A new campaign shrewdly poses as software updates that connect to known CHIMBORAZO (TA505) C2 infrastructure.

Read full article on Security Magazine