New BlackSnake Ransomware Performs Clipper Operations on Cryptocurrency Users

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary BlackSnake ransomware has been discovered with clipper functionality that intercepts and replaces the cryptocurrency wallet addresses of victims with those of attacke...

IceFire Ransomware Exploits IBM Aspera Faspex to Attack Linux-Powered Enterprise Networks

A previously known Windows-based ransomware strain known as IceFire has expanded its focus to target Linux enterprise networks belonging to several media and entertainment sector organizations across the world. The intrusions entail the exploitation of a recently disclosed deserialization...

New HiatusRAT Malware Targets Business-Grade Routers to Covertly Spy on Victims

A never-before-seen complex malware is targeting business-grade routers to covertly spy on victims in Latin America, Europe, and North America at least since July 2022. The elusive campaign, dubbed Hiatus by Lumen Black Lotus Labs, has been found to deploy two malicious binaries, a remote access...

Actors, Threats and Vulnerabilities 27 February to 5 March 2023

For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here HiveForce Labs discovered six actors that have been active in the past week. TA866, APT-C-61, and DEV-0569 are cybercrime groups that focus on Financial gain. The other three...

Snip3 Crypter an Advanced RAT Loader Targeting Multiple Industries

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary A multi-stage remote access trojan RAT loader called Snip3 crypter was recently discovered deploying RAT families, including QuasarRAT and DcRAT, to target victims...

Bitdefender Releases Free Decryptor for MortalKombat Ransomware Strain

Romanian cybersecurity company Bitdefender has released a free decryptor for a new ransomware strain known as MortalKombat. MortalKombat is a new ransomware strain that emerged in January 2023. It's based on commodity ransomware dubbed Xorist and has been observed in attacks targeting entities in...

CISA Issues Warning on Active Exploitation of ZK Java Web Framework Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a high-severity flaw affecting the ZK Framework to its Known Exploited Vulnerabilities KEV catalog based on evidence of active exploitation. Tracked as CVE-2022-36537 CVSS score: 7.5, the issue impacts ZK Framework versions...

CVE-2023-24253

Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability...

CVE-2023-24253

Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability...

Sql injection

Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability...

CVE-2023-24253

Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability...

CVE-2023-24253

CVE-2023-24253 affects the Ikon Server from Domotica Labs srl, with vulnerable versions prior to 2.8.6. The issue is a SQL injection in Ikon Server prior to 2.8.6, as reported across multiple sources. The available connected documents confirm the vulnerability and point to a remediation: upgrade ...

CVE-2023-24253

Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability...

Hydrochasma: New Threat Actor Targets Shipping Companies and Medical Labs in Asia

Shipping companies and medical laboratories in Asia have been the subject of a suspected espionage campaign carried out by a never-before-seen threat actor dubbed Hydrochasma. The activity, which has been ongoing since October 2022, "relies exclusively on publicly available and living-off-the-lan...

Hydrochasma: New Threat Actor Targets Shipping Companies and Medical Labs in Asia

Shipping companies and medical laboratories in Asia have been the subject of a suspected espionage campaign carried out by a never-before-seen threat actor dubbed Hydrochasma. The activity, which has been ongoing since October 2022, "relies exclusively on publicly available and living-off-the-lan...

K7005: Overview of MNIN/NNL-Labs Advisory

Security Advisory Description A January 2007 security advisory by Michael Ligh and Greg Sinclair describes several security issues present in some versions of FirePass software. The advisory can be found at the following location: http://mnin.org/advisories/2007firepass.pdf F5 has issued a series...

Microsoft Defender for Office 365 named Best Email Security Service of 2023 by SE Labs

In todays world where hybrid and remote work are on the rise, and companies rely on email now more than ever, phishing remains one of the most prominent and sophisticated techniques that malicious actors utilize to attack organizations and gain access to their most sensitive information...

Microsoft Defender for Office 365 named Best Email Security Service of 2023 by SE Labs

In todays world where hybrid and remote work are on the rise, and companies rely on email now more than ever, phishing remains one of the most prominent and sophisticated techniques that malicious actors utilize to attack organizations and gain access to their most sensitive information...

Actors, Threats and Vulnerabilities 13 February to 19 February 2023

For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here HiveForce Labs identified seven active actors over the past week. There were three prominent Russian actors, namely TA505, Nodaria, and KillNet. Additionally, three Chinese...

SUSE CVE-2014-9568

puppetlabs-rabbitmq 3.0 through 4.1 stores the RabbitMQ Erlang cookie value in the facts of a node, which allows local users to obtain sensitive information as demonstrated by using Facter...