Researchers Find Counterfeit Phones with Backdoor to Hack WhatsApp Accounts

Budget Android device models that are counterfeit versions associated with popular smartphone brands are harboring multiple trojans designed to target WhatsApp and WhatsApp Business messaging apps. The malware, which Doctor Web first came across in July 2022, were discovered in the system partiti...

Malicious code in yargs-parxe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfd542fba026c32cc65a6a7b1ea5d51d650de75248275d8463a485ffb37ffcaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in irmraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79003d7e88777d58f2bf060d4f054d2527e6c4ff77d970645be62920969ee1ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lodashdkbounce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d200ae5c8b1ad93591952a3cb282905f2c244b15c576610d88ac20016ad1f955 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jsnwebtokn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9288e8475ea1814b7f89fa819310919dde020cc928eda80644be29206fce3fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in d3isellction (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02b9a907b8021128b9ca40ad898622e9c7b6130ab3196e752f8e9bb309743463 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in comnader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05edfae7962125e7875be9674786069e6f0a06221445baace33167447f655c56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in codashop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccc6c66181152007bc17d58537f2fffb29c29a2367e6f92f30d2844189706f32 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Business Services industry targeted across the country for backdoor access

The presence of so many hacking tools in the detections for the Business Services industry tells a story about these organizations being targeted for not only infection, but to establish backdoors and likely gain access to customers of the organizations through the victims network. Just like...

Attackers waited until holidays to hit US government

The government industry in the United States dealt with heavy hitting breaches against local, federal, and state government networks, primarily during the first quarter of 2021. Our telemetry revealed a small spike in a generic backdoor detection, known as Backdoor.Agent, during March of 2021,...

Researchers Link Multi-Year Mass Credential Theft Campaign to Chinese Hackers

A Chinese state-sponsored threat activity group named RedAlpha has been attributed to a multi-year mass credential theft campaign aimed at global humanitarian, think tank, and government organizations. "In this activity, RedAlpha very likely sought to gain access to email accounts and other onlin...

Weblizar School Management Pro plugin backdoor

Added: 08/12/2022 CVE: CVE-2022-1609 Background Weblizar School Management is a WordPress plugin for management of school operations. Problem The license checking code in School Management Pro contains a backdoor which allows remote attackers to execute arbitrary commands. Resolution Upgrade to t...

Weblizar School Management Pro plugin backdoor

Added: 08/12/2022 CVE: CVE-2022-1609 Background Weblizar School Management is a WordPress plugin for management of school operations. Problem The license checking code in School Management Pro contains a backdoor which allows remote attackers to execute arbitrary commands. Resolution Upgrade to t...

Cisco Talos shares insights related to recent cyber attack on Cisco

Update History Date | Description of Updates ---|--- Aug. 10th 2022| Adding clarifying details on activity involving active directory. Aug. 10th 2022| Update made to the Cisco Response and Recommendations section related to MFA. Executive summary On May 24, 2022, Cisco became aware of a potential...

PHP Zerodium Backdoor

An attacker might upload a web shell backdoor to a PHP server via zerodium prefix. A successful exploitation might allow the attacker to run arbitrary code, or use the server as a bot for further attacks...

Iranian threat actor targets the Albanian government using ROADSWEEP ransomware

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary A cyberattack that took place in mid-July momentarily disrupted various Albanian government services and websites and was most likely the work of Iranian hackers. The attack used a new ransomware family called...

Chinese Hackers Targeted Dozens of Industrial Enterprises and Public Institutions

Over a dozen military-industrial complex enterprises and public institutions in Afghanistan and Europe have come under a wave of targeted attacks since January 2022 to steal confidential data by simultaneously making use of six different backdoors. Russian cybersecurity firm Kaspersky attributed...

Backdoor.Win32.Guptachar.20 MVID-2022-0631 Insecure Credential Storage

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/857999d2306f257b80d1b8f6a51ae8b0.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Guptachar.20 Vulnerability: Insecure Credential Storage Description: The...

Zimbra UnRAR Path Traversal Exploit

This Metasploit module creates a RAR file that can be emailed to a Zimbra server to exploit CVE-2022-30333. If successful, it plants a JSP-based backdoor in the public web directory, then executes that backdoor. The core vulnerability is a path-traversal issue in unRAR that can extract an arbitra...

Iranian Hackers Likely Behind Disruptive Cyberattacks Against Albanian Government

A threat actor working to further Iranian goals is said to have been behind a set of damaging cyberattacks against Albanian government services in mid-July 2022. Cybersecurity firm Mandiant said the malicious activity against a NATO state represented a "geographic expansion of Iranian disruptive...