Chinese Tonto Team Hackers' Second Attempt to Target Cybersecurity Firm Group-IB Fails

The advanced persistent threat APT actor known as Tonto Team carried out an unsuccessful attack on cybersecurity company Group-IB in June 2022. The Singapore-headquartered firm said that it detected and blocked malicious phishing emails originating from the group targeting its employees. It's als...

PT-2023-19946 · Nextcloud · Nextcloud Mail

Name of the Vulnerable Software and Affected Versions: Nextcloud Mail versions prior to 2.2.1 Nextcloud Mail versions prior to 1.14.5 Nextcloud Mail versions prior to 1.12.9 Nextcloud Mail versions prior to 1.11.8 Description: Nextcloud Mail is an email app for the Nextcloud home server platform...

Leaktopus - Keep Your Source Code Under Control

Keep your source code under control. Key Features Plug &Play - one line installation with Docker. Scan various sources containing a set of keywords, e.g. ORGANIZATION-NAME.com. Currently supports: GitHub Repositories Gists coming soon Paste sites e.g., PasteBin coming soon Filter results with a...

USN-5824-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing,...

USN-5824-1: Thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing,...

Iranian OilRig Hackers Using New Backdoor to Exfiltrate Data from Govt. Organizations

The Iranian nation-state hacking group known as OilRig has continued to target government organizations in the Middle East as part of a cyber espionage campaign that leverages a new backdoor to exfiltrate data. "The campaign abuses legitimate but compromised email accounts to send stolen data to...

The Menace of TrickGate Packer-as-a-Service Spreading Malware Globally

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary TrickGate has bundled several of the most well-known top-distribution malware families, including Trickbot, Maze, Emotet, REvil, CoinMiner, Cobalt Strike, Formbook, Remcos, AgentTesla, and many others...

WordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection

Software Commenter Emails Type Plugin Vulnerable versions = 2.6.1 Fixed in N/A OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45360 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 7afa84e72c95 Credits Mika Required privilege Unauthenticated Published ...

Researchers Uncover Packer Used by Several Malware to Evade Detection for 6 Years

A shellcode-based packer dubbed TrickGate has been successfully operating without attracting notice for over six years, while enabling threat actors to deploy a wide range of malware such as TrickBot, Emotet, AZORult, Agent Tesla, FormBook, Cerber, Maze, and REvil over the years. "TrickGate manag...

Protecting Against Malicious Use of Remote Monitoring and Management Software

Summary The Cybersecurity and Infrastructure Security Agency CISA, National Security Agency NSA, and Multi-State Information Sharing and Analysis Center MS-ISAC hereafter referred to as the “authoring organizations” are releasing this joint Cybersecurity Advisory CSA to warn network defenders abo...

"2.6 million DuoLingo account entries" up for sale

Not a week goes by where we dont see an example of data scraping causing concern for both business and folks at home. The latest target happens to be popular language platform DuoLingo, who is currently digging into a forum post concerning data related to its customer accounts. Scraping data for...

CrySIS Ransomware A Long-Standing Threat with a New Twist

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The ransomware family CrySIS, dubbed Dharma, has been advancing since 2016. Its source code was made available to the public, enabling others to customize it for their use. The criminals behind the malwa...

Earth Bogle Campaign Unleashes NjRAT Trojan on Middle East and North Africa

An ongoing campaign dubbed Earth Bogle is leveraging geopolitical-themed lures to deliver the NjRAT remote access trojan to victims across the Middle East and North Africa. "The threat actor uses public cloud storage services such as files.fm and failiem.lv to host malware, while compromised web...

Rhadamanthys: A New Evasive Information Stealer

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Rhadamanthys Evasive Infostealer is spread through phishing emails and prevalent Google ads that lead to fake download pages for popular workforce software...

PT-2023-18391 · M-Filter · M-Filter

Name of the Vulnerable Software and Affected Versions: m-FILTER versions prior to 5.70R01 Ver.5 Series m-FILTER versions prior to 4.87R04 Ver.4 Series Description: The issue allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent...

CVE-2023-22278

The email security product m-FILTER by Digital Arts Inc. contains an improper authentication vulnerability (CWE-287). Under certain conditions, a remote unauthenticated attacker can bypass authentication to send unintended emails. Reported impacts include the blacklisting of the source IP address...

CVE-2023-22489

Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lock status. This includes users that...

WordPress WP Better Emails Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS)

Software WP Better Emails Type Plugin Vulnerable versions = 0.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22679 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8921f81e46cb Credits Mika Required privilege...

Flarum notifications can leak restricted content

Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the receiver, and proceeds to send notifications through...

Italian Users Warned of Malware Attack Targeting Sensitive Information

A new malware campaign has been observed targeting Italy with phishing emails designed to deploy an information stealer on compromised Windows systems. "The info-stealer malware steals sensitive information like system info, crypto wallet and browser histories, cookies, and credentials of crypto...