Researchers Shed Light on APT31's Advanced Backdoors and Data Exfiltration Tactics

The Chinese threat actor known as APT31 aka Bronze Vinewood, Judgement Panda, or Violet Typhoon has been linked to a set of advanced backdoors that are capable of exfiltrating harvested sensitive information to Dropbox. The malware is part of a broader collection of more than 15 implants that hav...

New SEC Cybersecurity Rules: What You Need to Know

The US Securities and Exchange Commission SEC recently adopted rules regarding mandatory cybersecurity disclosure. Explore what this announcement means for you and your organization...

Liferay Portal 7.4.3.81 < 7.4.3.86 Information Disclosure

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported versio...

Midnight Blizzard conducts targeted social engineering over Microsoft Teams

Microsoft Threat Intelligence has identified highly targeted social engineering attacks using credential theft phishing lures sent as Microsoft Teams chats by the threat actor that Microsoft tracks as Midnight Blizzard previously tracked as NOBELIUM. This latest attack, combined with past activit...

GHSA-XPH3-VJCQ-G488 Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions

The organization selector before 4.0.14 from Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

The Bug Report - July 2023 Edition

The Bug Report – July 2023 Edition By Trellix · August 02, 2023 This story was also written by John Dunlap. A Storm is Brewing! Why am I here? Summer is now in full swing, and our July Bug Report is similarly coming out swinging. This month comes with a red-hot list of software vulnerabilities...

PT-2023-24782

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.81 through 7.4.3.85 Liferay DXP 7.4 update 81 through 85 Description The organization selector does not check user permission, allowing remote authenticated users to obtain a list of all organizations...

Chinese APT Group Hits Air-Gapped Systems in Europe with Malware

By Deeba Ahmed Industrial organizations in Eastern Europe are the prime targets of this data-harvesting campaign. This is a post from HackRead.com Read the original post: Chinese APT Group Hits Air-Gapped Systems in Europe with Malware...

China's APT31 Suspected in Attacks on Air-Gapped Systems in Eastern Europe

A nation-state actor with links to China is suspected of being behind a series of attacks against industrial organizations in Eastern Europe that took place last year to siphon data stored on air-gapped systems. Cybersecurity company Kaspersky attributed the intrusions with medium to high...

Cybercriminals Renting WikiLoader to Target Italian Organizations with Banking Trojan

Organizations in Italy are the target of a new phishing campaign that leverages a new strain of malware called WikiLoader with an ultimate aim to install a banking trojan, stealer, and spyware referred to as Ursnif aka Gozi. "It is a sophisticated downloader with the objective of installing a...

Patchwork Hackers Target Chinese Research Organizations Using EyeShell Backdoor

Threat actors associated with the hacking crew known as Patchwork have been spotted targeting universities and research organizations in China as part of a recently observed campaign. The activity, according to KnownSec 404 Team, entailed the use of a backdoor codenamed EyeShell. Patchwork, also...

Uncover the Hidden Story of Ransomware Victims – They’re Not Who You Think

Uncover the Hidden Story of Ransomware Victims – They’re Not Who You Think By Trellix Advanced Research Center · July 31, 2023 Ransomware attacks against large corporations often dominate headlines. High-profile attacks against organizations like Kaseya, Colonial Pipeline, and MOVEit might make y...

Uncover the Hidden Story of Ransomware Victims – They’re Not Who You Think

Uncover the Hidden Story of Ransomware Victims – They’re Not Who You Think By Trellix Advanced Research Center · July 31, 2023 Ransomware attacks against large corporations often dominate headlines. High-profile attacks against organizations like Kaseya, Colonial Pipeline, and MOVEit might make y...

How a Cyber Security Platform Addresses the 3 “S”

Explore how a security platform can help organizations address the 3 "S" impacting cybersecurity: stealth, sustainability, and shortage...

GHSA-M4HC-M2V6-HFW8 Improper authorization on debug and artifact file downloads

Impact An authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. Patches A patch was issued to ensure authorization checks are proper...

Sentry 安全漏洞

Mobileiron Sentry is a Smart Gateway product from Mobileiron, Inc. A security vulnerability exists in versions of Sentry prior to 23.5.2, which can be exploited by authenticated users to download debugging or artifact bundles from arbitrary organizations and projects using a known bundle ID...

Compromised Microsoft Key: More Impactful Than We Thought

Our investigation of the security incident disclosed by Microsoft and CISA and attributed to Chinese threat actor Storm-0558, found that this incident seems to have a broader scope than originally assumed. Organizations using Microsoft and Azure services should take steps to assess potential impa...

The XDR Payoff: Better Security Posture

As the extended detection and response XDR market grows and evolves, it’s a great opportunity to learn about the positive outcomes like better security posture experienced by organizations that have invested in these capabilities...

Microsoft Bug Allowed Hackers to Breach Over Two Dozen Organizations via Forged Azure AD Tokens

Microsoft on Friday said a validation error in its source code allowed for Azure Active Directory Azure AD tokens to be forged by a malicious actor known as Storm-0558 using a Microsoft account MSA consumer signing key to breach two dozen organizations. "Storm-0558 acquired an inactive MSA consum...

Analysis of Storm-0558 techniques for unauthorized email access

Executive summary On July 11, 2023, Microsoft published two blogs detailing a malicious campaign by a threat actor tracked as Storm-0558 that targeted customer email that weve detected and mitigated: Microsoft Security Response Center and Microsoft on the Issues. As we continue our investigation...