Suspected Exploitation of Apache ActiveMQ CVE-2023-46604

Tom Elkins, John Fenninger, Evan McCann, Matthew Smith, and Micah Young contributed attacker behavior insights to this blog. Beginning Friday, October 27, Rapid7 Managed Detection and Response MDR identified suspected exploitation of Apache ActiveMQ CVE-2023-46604 in two different customer...

MAL-2023-8426 Malicious code in discordstreams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3ecd29a8cad2b5a03c4966ae6e4e1f9879d9a26bcf5b48b620074ac2e65d197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Turla Updates Kazuar Backdoor with Advanced Anti-Analysis to Evade Detection

The Russia-linked hacking crew known as Turla has been observed using an updated version of a known second-stage backdoor referred to as Kazuar. The new findings come from Palo Alto Networks Unit 42, which is tracking the adversary under its constellation-themed moniker Pensive Ursa. "As the code...

MAL-2023-8413 Malicious code in xterm-addon-unicode-graphemes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1e517091262ed409fb53011792754e279673a300f5e9abf2377eec73ed814f9c The OpenSSF Package Analysis project identified 'xterm-addon-unicode-graphemes' @ 6.0.6 npm as malicious. It is considered malicious because: -...

Malicious code in discordwebutils1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 452374f38af0c10a3f6a1685be6c9360de86f61dd65604fb6fbd5a7c55455e5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8407 Malicious code in hydradx-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0abec8f2cef143387e4657c22d48e41efac43c4f4d8c40ea5712f19d7d7f9270 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Redefining the StripedFly Malware Framework

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary An intricate cross-platform malware framework, known as StripedFly, operated discreetly for five years, surreptitiously compromising over a million Windows and Linux systems. It skillfully evaded in-dept...

Malicious code in eslint-plugin-blade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aae9177af783553501be9b3995cd5eebfa3a3aaef47e65237aa9f29e4630b64d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-34833

An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component...

CVE-2022-34833

An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component...

CVE-2022-34832

An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component...

CVE-2022-34832

An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component...

CVE-2022-34832

An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component...

CVE-2022-34833

An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component...

Cross site scripting

An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component...

Design/Logic Flaw

An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component...

Malicious code in fuzzer-gui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b32a7fd36a831bd074988f7054a6dca65651d07aafc8d97dc75c6f907a59895 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fadam-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 02e81c60df4cba570ba561c45c4e1f48fe798f16078ef1a7c2c601cdb3edf1f7 The OpenSSF Package Analysis project identified 'fadam-frontend' @ 101.0.0 npm as malicious. It is considered malicious because: - The package...

How Kopeechka, an Automated Social Media Accounts Creation Service, Can Facilitate Cybercrime

This report explores the Kopeechka service and gives a detailed technical analysis of the service’s features and capabilities and how it can help cybercriminals to achieve their goals...

VERMEG Agile Reporter Security Breach

VERMEG Agile Reporter is a hybrid of pre-packaged modules from VERMEG. A security vulnerability exists in VERMEG Agile Reporter version 21.3, which stems from an XML document via the Analysis component that can cause XML External Entity Injection XXE...