CVE-2024-25376

An issue discovered in Thesycon Software Solutions Gmbh & Co. KG TUSBAudio MSI-based installers before 5.68.0 allows a local attacker to execute arbitrary code via the msiexec.exe repair mode...

WiX based installers are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...

FakeBat delivered via several active malvertising campaigns

February was a particularly busy month for search-based malvertising with the number of incidents we documented almost doubling. We saw similar payloads being dropped but also a few new ones that were particularly good at evading detection. One malware family we have been tracking on this blog is...

Xeno RAT Open-Source Trojan Sparks Alarm

Summary: The Xeno RAT, a remote access trojan RAT available on GitHub, has gained attention in the threat landscape due to its open-source nature. This C-based malware is compatible with both Windows 10 and 11, specifically targeting consumers by presenting itself as disguised binaries that...

Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM-focused malware campaigns

Google Cloud Run is currently being abused in high-volume malware distribution campaigns, spreading several banking trojans such as Astaroth aka Guildma, Mekotio and Ousaban to targets across Latin America and Europe. The volume of emails associated with these campaigns has significantly increase...

CVE-2023-32618

Uncontrolled search path in some IntelR oneAPI Toolkit and component software installers before version 4.3.2 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-28715

Improper access control in some IntelR oneAPI Toolkit and component software installers before version 4.3.2 may allow an authenticated user to potentially enable denial of service via local access...

Intel oneAPI Toolkit and component software installers security vulnerability

Intel oneAPI Toolkit and component software installers is an application from Intel Corporation USA. A security vulnerability previously existed in Intel oneAPI Toolkit and component software installers version 4.3.2, which stemmed from improper access control in the affected product. It could...

PT-2024-2728 · Intel · Intel Oneapi Toolkit

Name of the Vulnerable Software and Affected Versions: Intel oneAPI Toolkit versions prior to 4.3.2 Description: The issue is related to improper access control in some Intel oneAPI Toolkit and component software installers. This could potentially allow an authenticated user to enable denial of...

AllaKore RAT’s Grip Tightens on Mexican Financial Institutions

Summary: A threat actor has been targeting Mexican banks and cryptocurrency trading since at least 2021. Using custom installers, the actor distributes a modified version of the AllaKore RAT, an open-source remote access tool. The campaign cleverly mimics the Mexican Social Security Institute IMS...

CVE-2023-38541

Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

Improper access control

Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers before version 1.1.45 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2023-32272

Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0.0.6 may allow an authenticated user to potentially enable denial of service via local access...

PT-2024-1329 · Intel · Intel Nuc Pro Software Suite

Name of the Vulnerable Software and Affected Versions: Intel NUC Pro Software Suite versions prior to 3.0.0.6 Description: The issue is related to an uncontrolled search path element in the Intel NUC Pro Software Suite Configuration Tool software installers. This could potentially allow an...

CVE-2021-26735

The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges...

Attacks, Vulnerabilities and Actors 25 September to 1 October 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eight executed attacks, three instances of adversary activity, and four zero-day...

Cybercriminals target graphic designers with GPU miners

Cybercriminals are abusing Advanced Installer, a legitimate Windows tool used for creating software packages, to drop cryptocurrency-mining malware on infected machines. This activity has been ongoing since at least November 2021. The attacker uses Advanced Installer to package other legitimate...

CVE-2023-27509

Improper access control in some IntelR ISPC software installers before version 1.19.0 may allow an authenticated user to potentially enable escalation of privileges via local access...

Improper access control

Improper access control in some IntelR oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially enable escalation of privilege via local access...

Improper access control

Improper access control in some IntelR ISPC software installers before version 1.19.0 may allow an authenticated user to potentially enable escalation of privileges via local access...