redtail-ioc

redtail-ioc 我运行的一台 Linux 服务器在 2026 年 7 月被攻破，这里是我整理的失陷指标（IoC）和一份排查脚本。这并非什么精英级失败，而是一个低级错误；我公开认领，因为带着日志的羞耻更有用。 如果不是他们也犯了个愚蠢的错误（把我锁在 ssh 之外，否则我可能根本不会注意到），我不会发现这次入侵。我在某些方面知道自己在做什么，但在这方面经验很少。我不得不请教机器人。Fable 漏掉了它，但 Codex 5.5 发现了正在进行的入侵；当两个方案放在一起评估后，仍然有几点是三者（包括我）都没发现的。...

PHP Vulnerability Exploited to Spread Malware and Launch DDoS Attacks

Multiple threat actors have been observed exploiting a recently disclosed security flaw in PHP to deliver remote access trojans, cryptocurrency miners, and distributed denial-of-service DDoS botnets. The vulnerability in question is CVE-2024-4577 CVSS score: 9.8, which allows an attacker to...

RedTail Crypto-Mining Malware Exploiting Palo Alto Networks Firewall Vulnerability

The threat actors behind the RedTail cryptocurrency mining malware have added a recently disclosed security flaw impacting Palo Alto Networks firewalls to its exploit arsenal. The addition of the PAN-OS vulnerability to its toolkit has been complemented by updates to the malware, which now...

RedTail Cryptominer Threat Actors Adopt PAN-OS CVE-2024-3400 Exploit

...

CVE-2023-26219

The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence Hawk RedTail, and TIBCO Runtime Agent contain a vulnerability that theoretically allows an attacker with access to the Hawk Console’s and...

CVE-2023-26219 TIBCO Operational Intelligence Hawk RedTail Credential Exposure Vulnerability

The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence Hawk RedTail, and TIBCO Runtime Agent contain a vulnerability that theoretically allows an attacker with access to the Hawk Console’s and...

CVE-2023-26219

The CVE-2023-26219 issue affects TIBCO Hawk family components: TIBCO Hawk, Hawk Distribution for Silver Fabric, Operational Intelligence Hawk RedTail, and Runtime Agent. The vulnerability allows an attacker who can read the Hawk Console/Agent logs to obtain credentials used to access EMS servers....

PT-2023-20546 · Tibco Software · Tibco Hawk Distribution For Tibco Silver Fabric +3

Name of the Vulnerable Software and Affected Versions: TIBCO Hawk versions 6.2.2 and below TIBCO Hawk Distribution for TIBCO Silver Fabric versions 6.2.2 and below TIBCO Operational Intelligence Hawk RedTail versions 7.2.1 and below TIBCO Runtime Agent versions 5.12.2 and below Description: The...

CVE-2022-41564

The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.1.0...

CVE-2022-41564

The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.1.0...

Design/Logic Flaw

The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.1.0...

CVE-2022-41564 TIBCO Operational Intelligence Hawk Redtail Credential Exposure Vulnerability

The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.1.0...

TIBCO Software Hawk 安全漏洞

TIBCO Software Hawk is a software product from TIBCO Software that allows monitoring and management of distributed computing applications. A security vulnerability exists in TIBCO Software Hawk versions 6.2.1 and earlier and TIBCO Operational Intelligence Hawk RedTail versions 7.2.0 and earlier,...

CVE-2022-41564

CVE-2022-41564 affects TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail; the Hawk Console component exposes EMS transport and EMS SSL passwords to a privileged user. Affected releases: TIBCO Hawk 6.1.0–6.2.1 and Hawk RedTail 7.0.0–7.2.0. Root cause and exact exploit path are not detaile...

MAL-2022-5725 Malicious code in redtail-embeddable-ringcentral-phone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37e5c999eca221f2f5469510f6d07da2dbc50c0975f465433eaa4eaccbc506c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redtail-embeddable-ringcentral-phone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37e5c999eca221f2f5469510f6d07da2dbc50c0975f465433eaa4eaccbc506c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...