Malicious Package

datagrid is a malicious package. The package contains a backdoor similar to the bootstrap-sass malware, as seen in datagrid-1.0.6/lib/datagrid/drivers/abstractdriver.rb...

CVE-2019-14282

The simplecaptcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14281

The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14281

The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

Code injection

The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14282

The simplecaptcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14282

The simplecaptcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14282

The simplecaptcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14282

CVE-2019-14282 affects the Ruby gem simple_captcha2 (version 0.2.3) distributed on RubyGems.org. A third party inserted a code-execution backdoor into the package, enabling remote arbitrary code execution as described across multiple connected sources (e.g., Red Hat, Ubuntu, RubySec, GHSA). The d...

CVE-2019-14281

The CVE-2019-14281 entry concerns the Ruby datagrid gem (version 1.0.6) distributed on RubyGems.org, which includes a code-execution backdoor inserted by a third party. Multiple connected records (Red Hat, GitHub advisory GHSA, OSV, RubySec) corroborate a malicious backdoor in datagrid-1.0.6. The...

CVE-2019-14281

The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

A week in security (July 15 – 21)

Last week on Malwarebytes Labs, we took an extensive look at Sodinokibi, one of the new ransomware strains found in the wild that many believe picked up where GandCrab left off. We also profiled Extenbro, a Trojan that protects adware; reported on the UK's new Facebook reporting tool, homed in on...

Malicious Package

libpeshka is a malicious package. The package contains a hidden backdoor which would activate when the libraries are installed on Linux systems...

Malicious Package

libari is a malicious package. The package contains a hidden backdoor which would activate when the libraries are installed on Linux systems...

Malicious Package

libpeshnx is a malicious package. The package contains a hidden backdoor which would activate when the libraries are installed on Linux systems...

Ke3chang APT Linked to Previously Undocumented Backdoor

The Ke3chang cyberespionage group, a.k.a. APT15, Mirage, Playful Dragon or Vixen Panda, has been tied to a backdoor called Okrum that has been used to target diplomatic missions throughout Europe and Latin America. The attribution widens the scope of known Ke3chang activity, an APT believed to be...

No man’s land: How a Magecart group is running a web skimming operation from a war zone

Our Threat Intelligence team has been monitoring the activities of a number of threat actors involved in the theft of credit card data. Often referred to under the Magecart moniker, these groups use simple pieces of JavaScript code skimmers typically injected into compromised e-commerce websites ...

EvilGnomes Linux malware record activities & spy on users

By Uzair Amir The EvilGnomes Linux malware has been linked to infamous Russian threat actors from the Gamaredon Group. The IT security researchers at Intezar Labs have discovered a sophisticated new backdoor Linux malware in the wild that has been developed to target Linux devices. Dubbed...

EvilGnome: A New Backdoor Implant Spies On Linux Desktop Users

Security researchers have discovered a rare piece of Linux spyware that's currently fully undetected across all major antivirus security software products, and includes rarely seen functionalities with regards to most Linux malware, The Hacker News learned. It's a known fact that there are a very...

paranoid2 gem Code backdoor

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5...