Threat actor abuses Gophish to deliver new PowerRAT and DCRAT

Cisco Talos recently discovered a phishing campaign using an open-source phishing toolkit called Gophish by an unknown threat actor. The campaign involves modular infection chains that are either Maldoc or HTML-based infections and require the victim's intervention to trigger the infection chain...

Attackers Target Exposed Docker Remote API Servers With perfctl Malware

We observed an unknown threat actor abusing exposed Docker remote API servers to deploy the perfctl malware...

Russian RomCom Attacks Target Ukrainian Government with New SingleCamper RAT Variant

The Russian threat actor known as RomCom has been linked to a new wave of cyber attacks aimed at Ukrainian government agencies and unknown Polish entities since at least late 2023. The intrusions are characterized by the use of a variant of the RomCom RAT dubbed SingleCamper aka SnipBot or RomCom...

Researchers Uncover Cicada3301 Ransomware Operations and Its Affiliate Program

Cybersecurity researchers have gleaned additional insights into a nascent ransomware-as-a-service RaaS called Cicada3301 after successfully gaining access to the group's affiliate panel on the dark web. Singapore-headquartered Group-IB said it contacted the threat actor behind the Cicada3301...

CVE-2024-7993

CVE-2024-7993 affects Autodesk Revit via a PDF parsing Out-of-Bounds Write. The vulnerability allows a malicious PDF to cause a crash, data corruption, or arbitrary code execution within the process. Impact : high (data confidentiality, integrity, availability affected). Access/Exploit : local at...

CVE-2024-7993 Out-of-Bounds Write Vulnerability in Autodesk Revit

A maliciously crafted PDF file, when parsed through Autodesk Revit, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

Amazon Linux 2 : unbound (ALAS-2024-2650)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2650 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that i...

The vulnerability of the Simple Certificate Enrollment Protocol (SCEP) implementation in Windows operating systems allows a perpetrator to trigger a service failure.

The vulnerability of the Simple Certificate Enrollment Protocol SCEP implementation in Windows operating systems is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Qnap QTS Exposure of Sensitive Information to an Unauthorized Actor (CVE-2017-7630)

QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information firmware version and running services via a request to sysinfoReq.cgi. This plugin only works with Tenable.ot. Please visit...

Qnap QTS Exposure of Sensitive Information to an Unauthorized Actor (CVE-2017-5227)

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file. This plugin only works with Tenable.ot. Please visit...

CVE-2024-6207

CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted CIP message to the device. If exploited, a threat actor could help prevent access to the legitimate user and end connections to connected devices including th...

CVE-2024-6207

CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted CIP message to the device. If exploited, a threat actor could help prevent access to the legitimate user and end connections to connected devices including th...

CVE-2024-6207

CVE-2024-6207 affects Rockwell Automation ControlLogix/CompactLogix families (ControlLogix 5580 and 5580 Process; GuardLogix 5580; CompactLogix 5380 and Compact GuardLogix 5380 SIL 2/3; CompactLogix 5480; FactoryTalk Logix Echo). Root cause: improper input validation in CIP Message Handler, explo...

CVE-2024-7847 RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script

VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected products enables users to prepare a...

CVE-2024-39527

CVE-2024-39527 describes an exposure of sensitive information vulnerability in the CLI of Juniper Networks Junos OS on SRX Series devices. A local, low-privileged user with CLI access can view protected files on the file system through crafted CLI commands, enabling information disclosure as desc...

VulnCheck KEV: CVE-2024-22254

VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox...

OpenAI Blocks 20 Global Malicious Campaigns Using AI for Cybercrime and Disinformation

OpenAI on Wednesday said it has disrupted more than 20 operations and deceptive networks across the world that attempted to use its platform for malicious purposes since the start of the year. This activity encompassed debugging malware, writing articles for websites, generating biographies for...

SpyCloud Adds Identity Analytics to Cybercrime Investigation Solution for Insider Risk

Austin, TX, USA, 10th October 2024, CyberNewsWire...

CVE-2024-38817

VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root...

CVE-2024-38818

VMware NSX contains a local privilege escalation vulnerability. An authenticated malicious actor may exploit this vulnerability to obtain permissions from a separate group role than previously assigned...