PlugX: A Talisman to Behold

PlugX: A Talisman to Behold By Max Kersten, Marc Elias, Leandro Velasco, and Alexandre Mundo Alguacil · March 28, 2022 For over a decade, the PlugX malware has been observed internationally with different variants found around the world. This blog covers a PlugX variant that we have named Talisma...

Backdoor.Win32.Cafeini.b Hardcoded Credential

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/b24c56abb4bde960c2d51d4e509d2c68B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Cafeini.b Vulnerability: Weak Hardcoded Credentials Family: Cafeini Type: PE32 MD5:...

Backdoor.Win32.Cafeini.b Denial Of Service

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/b24c56abb4bde960c2d51d4e509d2c68.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Cafeini.b Vulnerability: Denial of Service Family: Cafeini Type: PE32 MD5:...

Another Chinese Hacking Group Spotted Targeting Ukraine Amid Russia Invasion

A Chinese-speaking threat actor called Scarab has been linked to a custom backdoor dubbed HeaderTip as part of a campaign targeting Ukraine since Russia embarked on an invasion last month, making it the second China-based hacking group after Mustang Panda to capitalize on the conflict. "The...

CVE-2021-40906

CheckMK Raw Edition software versions 1.5.0 to 1.6.0 does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other...

Authentication flaw

CheckMK Raw Edition software versions 1.5.0 to 1.6.0 does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other...

UBUNTU-CVE-2021-40906

CheckMK Raw Edition software versions 1.5.0 to 1.6.0 does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other...

CheckMK Raw Edition 跨站脚本漏洞

tribe29 CheckMK Raw Edition is a comprehensive and flexible IT monitoring system from tribe29 Germany. A security vulnerability exists in CheckMK Raw Edition that allows an attacker to open a backdoor on the device with HTML content that is interpreted by the browser e.g., JavaScript or other...

Chinese 'Mustang Panda' Hackers Spotted Deploying New 'Hodur' Malware

A China-based advanced persistent threat APT known as Mustang Panda has been linked to an ongoing cyber espionage campaign using a previously undocumented variant of the PlugX remote access trojan on infected machines. Slovak cybersecurity firm ESET dubbed the new version Hodur, owing to its...

New Threat Actor using Serpent Backdoor attacking French Entities

...

Serpent Backdoor Slithers into Orgs Using Chocolatey Installer

Researchers have discovered a cyberattack that uses unusual evasion tactics to backdoor French organizations with a novel malware dubbed Serpent, they said. A team from Proofpoint observed what they call an “advanced, targeted threat” that uses email-based lures and malicious files typical of man...

Backdoor.Win32.Agent.bxxn Open Proxy

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/dcbc237f21839a6514c8321d5fa631a4.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Agent.bxxn Vulnerability: Open Proxy Description: The malware listens on TCP port 108...

Backdoor.Win32.BirdSpy.b Hardcoded Credential

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/eba3dd81723ddf33621fd85ded577920.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.BirdSpy.b Vulnerability: Weak Hardcoded Credentials Family: BirdSpy Type: PE32 MD5:...

CVE-2022-0687

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...

Spoofing

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...

CVE-2022-0687

Affected software: Amelia WordPress plugin (prior to 1.0.47). Vulnerability summary: Stores image blobs into actual files with a user-controlled extension, which may allow uploading of PHP backdoors. Impact (as stated): PHP backdoors on the site when exploited by a logged-in user (Amelia Manager ...

New Backdoor Targets French Entities via Open-Source Package Installer

Researchers have exposed a new targeted email campaign aimed at French entities in the construction, real estate, and government sectors that leverages the Chocolatey Windows package manager to deliver a backdoor called Serpent on compromised systems. Enterprise security firm Proofpoint attribute...

WordPress plugin Amelia 代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A code issue exists in the WordPress plugin Amelia prior to...

BuilderOrcus Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/cc3670f1b3e60e00b43c86d787563a44.txt Contact: [email protected] Media: twitter.com/malvuln Threat: BuilderOrcus Orcus.Administration-cracked.exe Vulnerability: Insecure Permissions Description: When...

Increase In Malware Sightings on GoDaddy Managed Hosting

Today, March 15, 2022, The Wordfence Incident Response team alerted our Threat Intelligence team to an increase in infected websites hosted on GoDaddy’s Managed WordPress service, which includes MediaTemple, tsoHost, 123Reg, Domain Factory, Heart Internet, and Host Europe Managed WordPress sites...