MemTracer - Memory Scaner

MemTracer is a tool that offers live memory analysis capabilities, allowing digital forensic practitioners to discover and investigate stealthy attack traces hidden in memory. The MemTracer is implemented in Python language, aiming to detect reflectively loaded native .NET framework Dynamic-Link...

LummaC2 Malware Deploys New Trigonometry-Based Anti-Sandbox Technique

The stealer malware known as LummaC2 aka Lumma Stealer now features a new anti-sandbox technique that leverages the mathematical principle of trigonometry to evade detection and exfiltrate valuable information from infected hosts. The method is designed to "delay detonation of the sample until...

The vulnerability of the Splunk Enterprise platform for operational analysis, related to errors in processing XML requests, allows a perpetrator to execute arbitrary code.

The vulnerability of the Splunk Enterprise platform for operational analysis is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Malicious code in ifl-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15d842c50e1aff05fb5874d61c1f60e5a803cc51a39cda09deb405e5c6935bce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8535 Malicious code in frontend-components-react-transpiled (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 463e9359f450d451e47eef2a46a82e6d6fe266ffa312c37239b9e2fda0a440fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discomusic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d5ae86bb92ecda0b9d67bf6bcb933e00f57e91de9916d1b3a3ad5a68993c0778 The OpenSSF Package Analysis project identified 'discomusic' @ 0.0.3 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8527 Malicious code in jerrytestjerry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis afcd6612db745033b56fd846df2a95e2611a705900675bdd152150c2518fc2ed The OpenSSF Package Analysis project identified 'jerrytestjerry' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

A deep dive into Phobos ransomware, recently deployed by 8Base group

Cisco Talos has recently observed an increase in activity conducted by 8Base, a ransomware group that uses a variant of the Phobos ransomware and other publicly available tools to facilitate their operations. Most of the groups Phobos variants are distributed by SmokeLoader, a backdoor trojan. Th...

Understanding the Phobos affiliate structure and activity

Cisco Talos recently identified the most prolific Phobos variants, common affiliate tactics, techniques and procedures TTPs, and characteristics of the Phobos affiliate structure, based on observed Phobos activity and analysis of over 1,000 Phobos samples from VirusTotal dating back to 2019. We...

MAL-2023-8526 Malicious code in carvana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 954bdf3d35f93afe84019ba5192564e1e4538bac34eafa80b8b581db0a7c8d86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-43177

creationtimestamp| type| source ---|---|--- 2023-11-17 08:00:07+00:00| published-proof-of-concept| https://t.me/TopCyberTechNews/404 2023-11-18 06:12:36+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9413 2023-12-12 09:30:14+00:00| published-proof-of-concept|...

Potential Race Condition in Rewards Calculation

Lines of code Vulnerability details Impact If exploited, this race condition could allow an attacker to manipulate rewards in transactions involving the buy, sell, mintNFT, or burnNFT functions. The attacker may gain an advantage in claiming rewards before the rewards calculation is updated. Proo...

Exploit for Out-of-bounds Write in Linux Linux_Kernel

iouringLPE-CVE-2023-2598 LPE exploit for CVE-2023-2598. My...

MAL-2023-8521 Malicious code in bds-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb86d6e10a764d9de055f1e941aaabd3c07c262bd4182f27d8258212ed8c0169 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

7 common mistakes companies make when creating an incident response plan and how to avoid them

Cisco Talos recently covered the basics of NIS2, a new set of requirements for cybersecurity and security incident disclosures set to take effect next year in the European Union. As part of these new guidelines, organizations with operations in the EU must have up-to-date "incident handling"...

New SSH Vulnerability

This is interesting: For the first time, researchers have demonstrated that a large portion of cryptographic keys used to protect data in computer-to-server SSH traffic are vulnerable to complete compromise when naturally occurring computational errors occur while the connection is being...

Atlassian Confluence Broken Access Control Vulnerability (CVE-2023-22515)

Atlassian issued an Advisory on October 4, 2023, for CVE-2023-22515, a critical severity vulnerability affecting Confluence Server and Data Center. According to the advisory, the vulnerability was initially published as a Privilege Escalation vulnerability but was later updated to a Broken Access...

Attacker can Grief The Call to depositAsset Making It Impossible For The Victim To Deposit

Lines of code Vulnerability details Impact The attacker can grief the victim , making him unable to deposit asset into the pool. Proof of Concept The attack flow is as follows - Alice decides to deposit assets into the LRTDepositPool.sol , she calls depositPool here At L152 the function makes the...

PT-2023-35588 · Git +1 · Clamav

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A crash was reported due to a Memcpy-param-overlap issue. The crash state includes repeat, p ere, and p ere. Recommendations: At the moment, there is no information about a newer versio...

MAL-2023-8514 Malicious code in frontend-style-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2950942ff85300d3cee0a0eed9f373eaaa043ef93e942089421c5a5586e209e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...