Azure Serial Console Attack and Defense - Part 2

This is the second installment of the Azure Serial Console blog, which provides insights to improve defenders’ preparedness when investigating Azure Serial Console activity on Azure Linux virtual machines. While the first blog post discussed various tracing activities, such as using Azure activit...

Attacks, Vulnerabilities and Actors 11 December to 17 December 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eleven executed attacks, six instances of adversary activity, and five exploited...

CVE-2023-49706

Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges, thereby allowing them to act as and with the permissions of another user. Attackers must generate repeated API requests to trigger a race condition with...

CVE-2023-50713

Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17.6 affects users who: authorized an application which requested a 'token write' scope or, using frontend-2, created a Personal Access Toke...

CVE-2023-50713 Speckle Server API Token Privilege Escalation

Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17.6 affects users who: authorized an application which requested a 'token write' scope or, using frontend-2, created a Personal Access Toke...

CVE-2023-50713 Speckle Server API Token Privilege Escalation

Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17.6 affects users who: authorized an application which requested a 'token write' scope or, using frontend-2, created a Personal Access Toke...

Imperva Detects Undocumented 8220 Gang Activities

Imperva Threat Research has detected previously undocumented activity from the 8220 gang, which is known for the mass deployment of malware using a variety of continuously evolving TTPs. This threat actor has been known to target both Windows and Linux web servers with cryptojacking malware. In...

Recommendations that defenders can use from Talos’ Year in Review Report

The Talos Year in Review is available now and contains a wealth of insights about how the threat landscape has shifted in 2023. With new ransomware strains emerging from leaked source code, commodity loaders adding more reconnaissance measures to their belts, and geopolitical events influencing A...

Shanghai Zhongyun Digital Win Cloud Computing Technology Co., Ltd Shanghai Old Cadre APP has Logic Flaw Vulnerability

Shanghai Old Cadre app is a senior activity software specially created for some party members and old cadres in Shanghai. Shanghai Zhongyun Digital Win Cloud Computing Technology Co. Shanghai Old Cadre App has a logic flaw vulnerability that can be exploited by attackers to cause SMS bombing...

Malicious code in @dle-clo-bento-component/dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a652e8cb279a3db5d1420008c3f3fc8c11aab4463f7ed61925ca409f18066b19 The OpenSSF Package Analysis project identified '@dle-clo-bento-component/dist' @ 13.0.0 npm as malicious. It is considered malicious because: -...

MAL-2023-8691 Malicious code in @dle-clo-bento-component/dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a652e8cb279a3db5d1420008c3f3fc8c11aab4463f7ed61925ca409f18066b19 The OpenSSF Package Analysis project identified '@dle-clo-bento-component/dist' @ 13.0.0 npm as malicious. It is considered malicious because: -...

Threat actors misuse OAuth applications to automate financially driven attacks

Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromi...

Threat actors misuse OAuth applications to automate financially driven attacks

Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromi...

CVE-2023-6553

creationtimestamp| type| source ---|---|--- 2023-12-12 17:10:05+00:00| seen| https://t.me/truesecator/5192 2023-12-14 07:38:31+00:00| published-proof-of-concept| https://t.me/proxybar/1866 2023-12-15 07:34:50+00:00| published-proof-of-concept| https://t.me/darkcommunityofficial/193 2023-12-15...

Malicious code in npm_package_babel_plugins_3_1_pragma (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3632cb4fe4754d272e86ef810873600bf47c3e8c42733de77bf10571a80fc675 The OpenSSF Package Analysis project identified 'npmpackagebabelplugins31pragma' @ 99.99.99 npm as malicious. It is considered malicious because...

Different numbers of launches reported in the Dashboard vs. Activity Manager views of Director

The number of application instances displayed in Director under 'Sessions' 'Applications' and in 'User' 'Activity Manager' doesn't match, with higher numbers reported in 'Activity Manager'...

MAL-2023-8686 Malicious code in rechtspraak.insolventies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1e0d29af84c44aed4e022517fdf4ddc15b112789794ec5460c0e9acb30bd90c6 The OpenSSF Package Analysis project identified 'rechtspraak.insolventies' @ 0.9.0 npm as malicious. It is considered malicious because: - The...

Malicious code in rechtspraak.insolventies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1e0d29af84c44aed4e022517fdf4ddc15b112789794ec5460c0e9acb30bd90c6 The OpenSSF Package Analysis project identified 'rechtspraak.insolventies' @ 0.9.0 npm as malicious. It is considered malicious because: - The...

CVE-2016-4464

creationtimestamp| type| source ---|---|--- 2023-12-11 13:51:50+00:00| seen| https://t.me/arpsyndicate/1748...

Douglas-042 - Powershell Script To Help Speed ​​Up Threat Hunting Incident Response Processes

DOUGLAS-042 stands as an ingenious embodiment of a PowerShell script meticulously designed to expedite the triage process and facilitate the meticulous collection of crucial evidence derived from both forensic artifacts and the ephemeral landscape of volatile data. Its fundamental mission revolve...