Microsoft Patch Tuesday February release delayed by a month

In other news:

• A new malware that targets Mac OS X users is linked to the APT28 group, also known as Fancy Bear, which has been accused of hacking the Democratic National Committee and influencing the 2016 U.S. presidential election. Discovered by security researchers at Bitdefender, the malware, dubbed Xagent, steals passwords, grabs screens and steals iPhone backups stored on Macs. The attacks have been happening since September 2016 and, according to Bitdefender, show similarities to previous malware campaigns run by APT28, like the malware dropper used and command-and-control URLs. Bitdefender also found that the Xagent Mac OS binary shares identical strings to a downloader previously used by APT28 -- Komplex. "We conclude this brief teaser with the assertion that the Komplex component discovered in September has been exclusively used as a downloader and installer for the Xagent binary," Bitdefender wrote. "The investigation is ongoing, so there is much we can't say yet." The APT28 group is also attributed to using mobile malware to track the Ukraine military and has been linked with the Russian government.
• The Lazarus gang is at it again -- this time, primarily targeting Polish banks in a malware campaign that reached financial organizations in 30 other countries. In a blog post, Symantec said, since October 2016, a malware campaign has been using watering-hole attacks to infect "preselected targets with previously unknown malware." While attacks were uncovered by a bank in Poland and other financial institutions have confirmed that they were also targeted, no money has actually been stolen yet. "The attackers appear to be using compromised websites to redirect visitors to a customized exploit kit, which is preconfigured to only infect visitors from approximately 150 different IP addresses," Symantec explained in a blog post. "These IP addresses belong to 104 different organizations located in 31 different countries. The vast majority of these organizations are banks, with a small number of telecoms and internet firms also on the list." The malware, now known as Ratankba, is still being analyzed by Symantec, but appears to share "commonalities with code" previously seen in malware used by Lazarus. The Lazarus group has been active since 2009, and it's known for targeting banks and other institutions in the U.S. and South Korea. More recently, the group has been linked to attacks on banks in Bangladesh, Vietnam and the Philippines, including the attempted billion-dollar theft from the Bangladesh central bank's account at the Federal Reserve Bank of New York.
• After secretly patching it in January 2017, attackers have started to exploit a WordPress REST API vulnerability. The privilege escalation flaw is now being exploited and used to gain full access to servers by installing a backdoor. WordPress patched the flaw in a security release on Jan. 26, along with three others, but did so without informing the public until Feb. 1, in an attempt to "ensure the safety of millions of additional WordPress sites." Despite these best efforts, hackers started targeting unpatched WordPress sites shortly after the flaw was publicly released, and BleepingComputer reported over 2 million pages have been defaced so far. Sucuri, the security research firm that discovered the original vulnerability, has found that attackers are going beyond the privilege escalation flaw and are now also using remote command execution to send their own PHP code to the WordPress sites with the REST API flaw and effectively create a backdoor that allows the attacker access to the site's underlying server. According to Sucuri, attackers are looking to make money off of this exploit. "Defacements don't offer economic returns, so that will likely die soon," said Sucuri's founder and CTO Daniel Cid in a blog post. "What will remain are attempts to execute commands (RCE) as it gives the attackers full control of a site -- and offers multiple ways to monetize -- and SPAM SEO / affiliate link / ad injections."