United States Cyber Command issued a warning Tuesday about hackers using a security flaw in Microsoft's Outlook email program, while also uploading new malware to an archive used by cybersecurity researchers that one expert believes is connected to an infamous Iranian attack.
The big picture: The malware appears to be connected to Shamoon 2, a disk-wiping attack used against Saudi entities in 2016, said Brandon Levene, head of applied intelligence at Chronicle. Shamoon 2 is widely believed to be the work of Iran.
Why it matters: If the malware and warnings are linked, two things may be true:
- Iran may be using the Outlook security vulnerability in an active hacking campaign.
- "[T]his sheds some light on how the Shamoon attackers were able to compromise their targets," Levene said. "It was highly speculated that spear phishes were involved, but not a lot of information [more specific than that] was published."
What needs to happen: The flaw in Outlook was patched in 2017. If you have updated outlook since then, Outlook is secure to that attack.
- Cyber Command tweeted a web address used in the attack that IT pros could use to further keep Outlook users safe.
