1020 matches found
OilAlpha: Emerging Houthi-linked Cyber Threat Targets Arabian Android Users
A hacking group dubbed OilAlpha with suspected ties to Yemen's Houthi movement has been linked to a cyber espionage campaign targeting development, humanitarian, media, and non-governmental organizations in the Arabian peninsula. "OilAlpha used encrypted chat messengers like WhatsApp to launch...
China's Mustang Panda Hackers Exploit TP-Link Routers for Persistent Attacks
The Chinese nation-state actor known as Mustang Panda has been linked to a new set of sophisticated and targeted attacks aimed at European foreign affairs entities since January 2023. An analysis of these intrusions, per Check Point researchers Itay Cohen and Radoslaw Madej, has revealed a custom...
Lancefly APT Group Deploys Custom Backdoor ‘Merdoor’ in Targeted Attacks
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The Lancefly APT group targets South and Southeast Asia using the Merdoor backdoor and an updated ZXShell rootkit. Their attack chain involves credential theft, lateral movement, file staging, and...
Join Our Webinar: Learn How to Defeat Ransomware with Identity-Focused Protection
Are you concerned about ransomware attacks? You're not alone. In recent years, these attacks have become increasingly common and can cause significant damage to organizations of all sizes. But there's good news - with the right security measures in place, such as real-time MFA and service account...
Join Our Webinar: Learn How to Defeat Ransomware with Identity-Focused Protection
Are you concerned about ransomware attacks? You're not alone. In recent years, these attacks have become increasingly common and can cause significant damage to organizations of all sizes. But there's good news - with the right security measures in place, such as real-time MFA and service account...
AppDomain Manager Injection: New Techniques For Red Teams
AppDomain Manager Injection is a very versatile and useful technique for red team operators. This technique allows you to effectively turn any Microsoft.NET application on a Windows host into a lolbin Living Off the Land Binary by forcing the application to load a specially crafted .NET assembly,...
Wanted Dead or Alive: Real-Time Protection Against Lateral Movement
Just a few short years ago, lateral movement was a tactic confined to top APT cybercrime organizations and nation-state operators. Today, however, it has become a commoditized tool, well within the skillset of any ransomware threat actor. This makes real-time detection and prevention of lateral...
Wanted Dead or Alive: Real-Time Protection Against Lateral Movement
Just a few short years ago, lateral movement was a tactic confined to top APT cybercrime organizations and nation-state operators. Today, however, it has become a commoditized tool, well within the skillset of any ransomware threat actor. This makes real-time detection and prevention of lateral...
Microsoft Confirms PaperCut Servers Used to Deliver LockBit and Cl0p Ransomware
Microsoft has confirmed that the active exploitation of PaperCut servers is linked to attacks that are designed to deliver Cl0p and LockBit ransomware families. The tech giant's threat intelligence team is attributing a subset of the intrusions to a financially motivated actor it tracks under the...
Modernizing Vulnerability Management: The Move Toward Exposure Management
Managing vulnerabilities in the constantly evolving technological landscape is a difficult task. Although vulnerabilities emerge regularly, not all vulnerabilities present the same level of risk. Traditional metrics such as CVSS score or the number of vulnerabilities are insufficient for effectiv...
PowerMeUp - A Small Library Of Powershell Scripts For Post Exploitation That You May Need Or Use!
This is a powershell reverse shell that executes the commands and or scripts that you add to the powerreverse.ps1 file as well as a small library of Post-Exploitation scripts. This also can be used for post exploitation and lateral movement even. Please use at your own risk I am not and will not ...
CVE-2023-2112
Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0...
CVE-2023-2112
Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0...
CVE-2023-2112
Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0...
Design/Logic Flaw
Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0...
CVE-2023-2112 Desktop component allows lateral movement between sessions
Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0...
CVE-2023-2112
The CVE-2023-2112 issue affects M-Files’ Desktop component service, where versions prior to 23.4.12455.0 permit lateral movement between sessions. The vulnerability is tied to the desktop component, enabling session-to-session movement with local attack potential. According to the publicly docume...
PT-2023-17911 · M Files · My Files
Name of the Vulnerable Software and Affected Versions: M-Files versions prior to 23.4.12455.0 Description: The issue allows lateral movement between sessions in the desktop component service. Recommendations: For versions prior to 23.4.12455.0, update to version 23.4.12455.0 or later to resolve t...
M-Files 安全漏洞
M-Files is an innovative metadata-driven document management platform from M-Files, Inc. A security vulnerability exists in versions prior to M-Files 23.4.12455.0 that stems from a desktop component service that allows lateral movement between sessions...
Newly Discovered "By-Design" Flaw in Microsoft Azure Could Expose Storage Accounts to Hackers
A "by-design flaw" uncovered in Microsoft Azure could be exploited by attackers to gain access to storage accounts, move laterally in the environment, and even execute remote code. "It is possible to abuse and leverage Microsoft Storage Accounts by manipulating Azure Functions to steal...