Attacks, Vulnerabilities and Actors 20 November to 26 November 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eight executed attacks, six instances of adversary activity, and one exploited...

N. Korean Hackers 'Mixing' macOS Malware Tactics to Evade Detection

The North Korean threat actors behind macOS malware strains such as RustBucket and KANDYKORN have been observed "mixing and matching" different elements of the two disparate attack chains, leveraging RustBucket droppers to deliver KANDYKORN. The findings come from cybersecurity firm SentinelOne,...

Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to a remote attacker causing integrity impacts due to the libraries component (CVE-2023-22049).

Summary IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i are vulnerable to a remote attacker causing a low integrity impact due to an unspecified vulnerability in the libraries component as described in the vulnerability details section. The vulnerability is fixe...

The Rise of DarkCasino APT Group Exploiting WinRAR 0-Day

Summary: DarkCasino, an APT group with economic motivations, was initially identified in 2021. The group introduced DarkMe, a Trojan Horse program based on Visual Basic. Recently, DarkCasino has been linked to the zero-day exploitation of CVE-2023-38831, an arbitrary code execution vulnerability...

Lazarus Group Orchestrates Supply Chain Attack on CyberLink Corp

Summary: The Lazarus Group Labyrinth Chollima orchestrated a supply chain attack on CyberLink Corp., manipulating a legitimate application installer to impact over 100 devices globally. The attack involves a second-stage payload, labeled LambLoad, communicating with compromised infrastructure and...

chasehotelgroup.com Improper Access Control vulnerability OBB-3795523

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-7938

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be...

ablggroup.com Improper Access Control vulnerability OBB-3791337

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Konni Group Using Russian-Language Malicious Word Docs in Latest Attacks

A new phishing attack has been observed leveraging a Russian-language Microsoft Word document to deliver malware capable of harvesting sensitive information from compromised Windows hosts. The activity has been attributed to a threat actor called Konni, which is assessed to share overlaps with a...

CVE-2023-4406

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS.This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2023-4406 XSS in KC Group's E-Commerce Software

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

CVE-2023-4406

CVE-2023-4406 is a Reflected XSS vulnerability in KC Group E-Commerce Software affecting versions through 20231123. The root cause is improper neutralization of input during web page generation. Multiple sources (NVD, Red Hat, CNNVD, PRION, CVELIST, VulnEnrichment) corroborate that the issue exis...

CVE-2023-4406 XSS in KC Group's E-Commerce Software

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

N. Korean Hackers Distribute Trojanized CyberLink Software in Supply Chain Attack

A North Korean state-sponsored threat actor tracked as Diamond Sleet is distributing a trojanized version of a legitimate application developed by a Taiwanese multimedia software developer called CyberLink to target downstream customers via a supply chain attack. "This malicious file is a...

PT-2023-8340 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The issue is related to a use-after-free problem in the implementation of the IGMPv2 protocol in the Linux kernel, specifically in the igmp start timer function in net/ipv4/igmp.c. Thi...

KC Group E-Commerce Software Cross-Site Scripting Vulnerability

KC Group E-Commerce Software is an e-commerce software from the Turkish company KC Group. A cross-site scripting vulnerability exists in KC Group E-Commerce Software version 20231123 and prior versions, which arises from improper input neutralization during web page generation...

PT-2023-29084 · Unknown · Kc Group E-Commerce

Name of the Vulnerable Software and Affected Versions: KC Group E-Commerce Software versions through 20231123 Description: The issue affects the KC Group E-Commerce Software, allowing for Reflected XSS due to improper neutralization of input during web page generation. The vendor was contacted...

CVE-2023-4406: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa...

FBI Alert: Silent Ransom Group Utilizes Callback Phishing for Network Hacks

By Deeba Ahmed The culprit behind these callback phishing attacks, known as Silent Ransom Group SRG, is also identified as Luna Moth. This is a post from HackRead.com Read the original post: FBI Alert: Silent Ransom Group Utilizes Callback Phishing for Network Hacks...

OverlayFS Heap Buffer Overflow Privilege Escalation

The vulnerability of the ovlcopyupone function in the fs/overlayfs/copyup.c file of the OverlayFS file system in the Linux operating system is related to incorrect handling of stuid and stgid. Exploiting this vulnerability can allow an attacker to increase their privileges...