Stealthy BLOODALCHEMY Malware Targeting ASEAN Government Networks

Cybersecurity researchers have discovered that the malware known as BLOODALCHEMY used in attacks targeting government organizations in Southern and Southeastern Asia is in fact an updated version of Deed RAT, which is believed to be a successor to ShadowPad. "The origin of BLOODALCHEMY and Deed R...

Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns

Cybersecurity researchers have observed a spike in email phishing campaigns starting early March 2024 that delivers Latrodectus, a nascent malware loader believed to be the successor to the IcedID malware. "These campaigns typically involve a recognizable infection chain involving oversized...

CVE-2021-22280

Improper DLL loading algorithms in B&R Automation Studio versions =4.0 and 4.12 may allow an authenticated local attacker to execute code in the context of the product...

CVE-2021-22280 DLL Hijacking Vulnerability in Automation Studio

Improper DLL loading algorithms in B&R Automation Studio versions =4.0 and 4.12 may allow an authenticated local attacker to execute code in the context of the product...

CVE-2021-22280

CVE-2021-22280 крат: B&R Automation Studio versions 4.0–4.11 suffer from improper DLL loading, enabling an authenticated local attacker to execute code in the product context. The issue is confirmed across multiple sources (PT-2024-10875, Red Hat/NVD records). Impact is local code execution with ...

CVE-2021-22280 DLL Hijacking Vulnerability in Automation Studio

Improper DLL loading algorithms in B&R Automation Studio versions =4.0 and 4.12 may allow an authenticated local attacker to execute code in the context of the product...

TrojanSpy.Win64.EMOTET.A MVID-2024-0684 Code Execution

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2024 Original source: https://malvuln.com/advisory/f917c77f60c3c1ac6dbbadbf366ddd30.txt Contact: [email protected] Media: twitter.com/malvuln Threat: TrojanSpy.Win64.EMOTET.A Vulnerability: Arbitrary Code Execution Description: The malware...

Backdoor.Win32.AsyncRat MVID-2024-0683 Code Execution

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2024 Original source: https://malvuln.com/advisory/2337b9a12ecf50b94fc95e6ac34b3ecc.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.AsyncRat Vulnerability: Arbitrary Code Execution Description: The malware...

Ongoing Malvertising Campaign leads to Ransomware

Executive Summary Rapid7 has observed an ongoing campaign to distribute trojanized installers for WinSCP and PuTTY via malicious ads on commonly used search engines, where clicking on the ad leads to typo squatted domains. In at least one observed case, the infection has led to the attempted...

Delta Electronics CNCSoft-B DOPSoft Uncontrolled Search Path Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-B. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2024-10081 · Sap · Sap Netweaver As For Abap/Abap Platform

The affected software is SAP NetWeaver AS for ABAP and ABAP Platform, specifically the Internet Communication Framework. This issue arises from weak access controls, allowing attackers to access restricted information and potentially compromising application integrity, confidentiality, and...

PT-2024-10234 · Sap · Sapsetup

Name of the Vulnerable Software and Affected Versions: SAP Setup affected versions not specified Description: The issue is related to a DLL injection vulnerability in SAPSetup, which could allow an attacker with local user privileges or access to a compromised corporate user's Windows account to...

CVE-2024-31954

CVE-2024-31954 affects the Samsung Portable SSD for T5 installer on Windows (version 1.6.10). The root cause is tampering with the installation directory and DLLs, enabling an attacker who already has user privileges to achieve arbitrary code execution and privilege escalation. The available sour...

Clario VPN client 安全漏洞

Clario VPN client is a VPN client for Mac from Clario. A security vulnerability exists in Clario VPN client version 2024-04-11 and earlier, which stems from the presence of weak privileges to load DLLs using system privileges...

CVE-2024-34474

Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM...

PT-2024-25925 · Clario · Clario

Name of the Vulnerable Software and Affected Versions: Clario through 2024-04-11 for Desktop Description: The issue is related to weak permissions for the %PROGRAMDATA%Clario directory and the attempt to load DLLs from this location as SYSTEM. Recommendations: For Clario through 2024-04-11 for...

Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications

Threat actors have been increasingly weaponizing Microsoft Graph API for malicious purposes with the aim of evading detection. This is done to "facilitate communications with command-and-control C&C infrastructure hosted on Microsoft cloud services," the Symantec Threat Hunter Team, part of...

Veritas Backup Exec Remote Agent 21.0.x, 21.1.x, 21,2.x, 21,3.x, 21.4.x, 22.0.x, 22.1.x, 22.2.x Multiple Vulnerabilities

The version of Vertias Backup Exec Remote Agent installed on the remote Windows host is 21.0.x, 21.1.x, 21,2.x, 21,3.x, 21.4.x, 22.0.x, 22.1.x or 22.2.x prior to 22.2 HotFix 917391. It is therefore affectewd by multiple vulnerabilities: - An issue was discovered in Veritas Backup Exec before 22.2...

CVE-2024-24912 Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file

A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system...

CVE-2024-24912 Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file

A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system...