1270 matches found
Finding Attack Paths in Cloud Environments
The mass adoption of cloud infrastructure is fully justified by innumerable advantages. As a result, today, organizations' most sensitive business applications, workloads, and data are in the cloud. Hackers, good and bad, have noticed that trend and effectively evolved their attack techniques to...
ScheduleRunner - A C# Tool With More Flexibility To Customize Scheduled Task For Both Persistence And Lateral Movement In Red Team Operation
Scheduled task is one of the most popular attack technique in the past decade and now it is still commonly used by hackers/red teamers for persistence and lateral movement. A number of C tools were already developed to simulate the attack using scheduled task. I have been playing around with some...
CVE-2022-27049
Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive is installed...
CVE-2022-27049
Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive is installed...
OpenBoxLab Raidrive 安全漏洞
OpenBoxLab Raidrive is a remote file management system from OpenBoxLab Korea. Allows mapping of WebDAV/FTP/SFTP, routers, Google Drive Team Drive, Photos, OneDrive and Dropbox to network drives on File Explorer. A security vulnerability previously existed in OpenBoxLab Raidrive v2021.12.35, which...
Muhstik botnet adds another vulnerability exploit to its arsenal
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Muhstik malware has begun attacking Redis Servers by exploiting a recently reported vulnerability, CVE-2022-0543. This flaw can be found in several Redis Debian packages. The attack began on March 11, 2022, and was carried out...
New Report on Okta Hack Reveals the Entire Episode LAPSUS$ Attack
An independent security researcher has shared what's a detailed timeline of events that transpired as the notorious LAPSUS$ extortion gang broke into a third-party provider linked to the cyber incident at Okta in late January 2022. In a set of screenshots posted on Twitter, Bill Demirkapi publish...
North Korean state-sponsored threat actor Lazarus Group exploiting Chrome Zero-day vulnerability
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here For more than a month before a fix was available, North Korean state hackers known as Lazarus group exploited a zero-day, remote code execution vulnerability CVE-2022-0609 in Google Chromes web browser. The attack mainly targe...
NaN/INF in serverbound movement packets can crash clients and servers
Impact A malicious client may send a MovePlayerPacket to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play. - The server may crash in various ways if this exploit is use...
Russian threat actors leveraging misconfigured multifactor authentication to exploit PrintNightmare vulnerability
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI have issued an alert for enterprises that Russian state-sponsored cyber attackers have obtained network access by exploiting...
Attackers Escape Kubernetes Containers using “cr8escape” Vulnerability in CRI-O
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. A flaw in CRI-O, an open-source Linux implementation of Kubernetes Container Runtime Interface CRI, was discovered that may allow an attacker to gain remote control of servers and potentially poison the container with attack...
WMEye - A Post Exploitation Tool That Uses WMI Event Filter And MSBuild Execution For Lateral Movement
WMEye is an experimental tool that was developed when exploring about Windows WMI. The tool is developed for performing Lateral Movement using WMI and remote MSBuild Execution. It uploads the encoded/encrypted shellcode into remote targets WMI Class Property, create an event filter that when...
PT-2022-3216 · Intel +1 · Intel Sgx +1
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to uncontrolled resource consumption in the Linux kernel drivers for IntelR SGX. This may allow an authenticated user to potentially enable denial of service via...
Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for March Patch Tuesday
Microsoft has addressed 71 security vulnerabilities in its scheduled March Patch Tuesday update – only three of which are rated critical in severity. The other 68 are all rated “important.” Three of the bugs are listed as publicly known zero-days, but none of them are listed as having been...
Phishing Campaign Targeted Those Aiding Ukraine Refugees
Cyberattackers used a compromised Ukrainian military email address to phish EU government employees who’ve been involved in managing the logistics of refugees fleeing Ukraine, according to a new report. Ukraine has been at the center of an unprecedented wave of cyberattacks in recent weeks and...
Hackers Try to Target European Officials to Get Info on Ukrainian Refugees, Supplies
Details of a new nation-state sponsored phishing campaign have been uncovered setting its sights on European governmental entities in what's seen as an attempt to obtain intelligence on refugee and supply movement in the region. Enterprise security company Proofpoint, which detected the malicious...
Multiple government entities targeted by China-linked Daxin malware
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here A technologically advanced and previously undocumented malware Daxin was used as the advanced persistent threat APT weapon by China-linked actor against government critical infrastructures across the globe. This malware can re...
Microsoft Exchange Server Bugs Exploited by ‘Cuba’ Ransomware Gang
The ransomware gang known as “Cuba” is increasingly shifting to exploiting Microsoft Exchange vulnerabilities – including ProxyShell and ProxyLogon – as initial infection vectors, researchers have found. The group has likely been prying open these chinks in victims’ armor as early as last August,...
Docker Desktop has an unspecified vulnerability
Docker Desktop is a container-based desktop software for lightweight deployment of applications from Docker, Inc. Docker Desktop has a security vulnerability that could be exploited by attackers to move arbitrary files...