Exploit for Embedded Malicious Code in Tukaani Xz

How to detect the CVE-2024-3094 I'll walk through the step-by...

Trend Micro Worry-Free Business Security (WFBS) Command Execution Vulnerability (000294994)

The remote host is running a version of the Trend Micro WFBS which is affected by a command execution vulnerability in the 3rd party AV uninstaller module contained in Worry-Free Business Security which could allow an attacker to manipulate the module to execute arbitrary commands on an affected...

Trend Micro Apex One Command Execution (000294994)

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to SP1 Server Build 12380 and Agent Build 12380. It is, therefore, affected by a vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One,...

RedCurl Cybercrime Group Abuses Windows PCA Tool for Corporate Espionage

The Russian-speaking cybercrime group called RedCurl is leveraging a legitimate Microsoft Windows component called the Program Compatibility Assistant PCA to execute malicious commands. "The Program Compatibility Assistant Service pcalua.exe is a Windows service designed to identify and address...

Softing edgeConnector

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION : Low attack complexity Vendor : Softing Equipment : edgeConnector Vulnerabilities : Cleartext Transmission of Sensitive Information, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities could create conditions...

DarkGate Malware Exploited Recently Patched Microsoft Flaw in Zero-Day Attack

A DarkGate malware campaign observed in mid-January 2024 leveraged a recently patched security flaw in Microsoft Windows as a zero-day using bogus software installers. "During this campaign, users were lured using PDFs that contained Google DoubleClick Digital Marketing DDM open redirects that le...

Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence

This blog entry will examine Trend Micro MDR team's investigation that successfully uncovered the intrusion sets employed by Earth Kapre in a recent incident, as well as how the team leveraged threat intelligence to attribute the extracted evidence to the cyberespionage threat group...

Multistage RA World Ransomware Uses Anti-AV Tactics, Exploits GPO

The Trend Micro threat hunting team came across an RA World attack involving multistage components designed to ensure maximum impact...

ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection

Impact This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. Patches The algorithm to detect SQL injection has been improved. Workarounds None. References - https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2 -...

GHSA-6927-3VR9-FXF2 ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection

Impact This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. Patches The algorithm to detect SQL injection has been improved. Workarounds None. References - https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2 -...

Delta Electronics CNCSoft-B

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low attack complexity Vendor : Delta Electronics Equipment : CNCSoft-B Vulnerability : Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3...

Trend Micro and INTERPOL Join Forces Again for Operation Synergia

Trend and other private entities recently contributed to INTERPOL’s Operation Synergia, a global operation that successfully took down over 1,000 C&C servers and identified suspects related to phishing, banking malware, and ransomware activity...

The vulnerability in the modDLPTemplateMatch_drildown.php script of the monitoring and security management tool Trend Micro Apex Central allows an attacker to execute XSS attacks.

The vulnerability in the modDLPTemplateMatchdrildown.php script of the monitoring and security management tool Trend Micro Apex Central exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks from a...

DarkMe Malware Targets Traders Using Microsoft SmartScreen Zero-Day Vulnerability

A newly disclosed security flaw in the Microsoft Defender SmartScreen has been exploited as a zero-day by an advanced persistent threat actor called Water Hydra aka DarkCasino targeting financial market traders. Trend Micro, which began tracking the campaign in late December 2023, said it entails...

Fat Patch Tuesday, February 2024 Edition

Microsoft Corp. today pushed software updates to plug more than 70 security holes in its Windows operating systems and related products, including two zero-day vulnerabilities that are already being exploited in active attacks. Top of the heap on this Fat Patch Tuesday is CVE-2024-21412, a...

Global Cybersecurity Trends: AI, Geopolitical Risks, and Zero Trust

Trend Micro’s Chief Technology Strategy Officer discusses the biggest cybersecurity trends and what to watch for in 2024...

CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

The APT group Water Hydra has been exploiting the zero-day Microsoft Defender SmartScreen vulnerability CVE-2024-21412 in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day...

CVE-2024-21412: Water Hydra Targets Traders With Microsoft Defender SmartScreen Zero-Day

The APT group Water Hydra has been exploiting the Microsoft Defender SmartScreen vulnerability CVE-2024-21412 in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day Initiative...

Trend Micro Apex One Multiple Vulnerabilities (000293322)

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to SP1 Server Build 12033 and Agent Build 12033. It is, therefore, affected by multiple vulnerabilities: - Untrusted search path vulnerabilities in the Trend Micro Apex One and...

Trend Micro Apex One Multiple Vulnerabilities (000295652)

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to SP1 Server Build 12526 and Agent Build 12526. It is, therefore, affected by multiple vulnerabilities: - An agent link vulnerability in the Trend Micro Apex One security agen...