Cybersecurity and Risk Insights and Alerts

Learn about the new software patches Microsoft released on April 14, 2021 to address 19 critical vulnerabilities as well as a new Zoom vulnerability discovered at the Pwn2Own white hat hacker event.

​​​​​​​When Microsoft announced patches for the four “zero-days” that were revealed on March 2, 2021, the full extent of the vulnerability was not known. Security experts continue to notify victims, coordinate remediation, and suggest remaining vigilant for “stage 2” of this attack, i.e., further exploitation of the backdoors left on the already-compromised servers.

Apple has issued urgent updates for its iPhone, iPad, and iWatch devices. According to Apple, these updates patch a discovered “cross site scripting” vulnerability that allows bad actors to inject malicious code into web pages. The code could be enabled when users access these pages using browsers on Apple devices. This vulnerability may already have been exploited.

Multiple firms have reported receiving emails from an organization posing as the International Fund Manager Regulator (IFMR). There is no legitimate international global regulatory authority for fund managers. This email is a phishing attempt.

The Financial Industry Regulatory Authority (FINRA) has issued an alert warning of reported phishing attempts using fake FINRA credentials. Per the notice, an ongoing email phishing campaign has been reported, in which the fake FINRA domain name of supports @finra-online.com is being used.

The NFA issued a notice to members warning of reported phishing attempts using fake NFA credentials. The phishing campaign includes emails using a fake domain that mimics the NFA’s domain name.