Hackers Infiltrate Russian Government and Industrial Entities

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Numerous governmental and pivotal industrial entities in Russia fell victim to a sophisticated Go-based custom backdoor. This malicious software was specifically crafted for data theft, suggesting its...

Analysis: A Ransomware Attack on a PostgreSQL Database

In 2017, we reported on a database ransomware campaign targeting MySQL and MongoDB. Since then, we’ve observed similar attack tactics on a PostgreSQL database in Imperva Threat Research lab. In general, the attack flow contained: A brute force attack on the database for known users and weak...

Cross-Site Request Forgery (CSRF)

modoboa is vulnerable to Cross-Site Request Forgery CSRF. An attacker could exploit this vulnerability by sending a specially crafted email or link to a victim. The email or link would contain a malicious CSRF token that would allow the attacker to perform actions on the victim's modoboa account,...

PT-2023-29720 · Unknown · Leadsquared Suite

Name of the Vulnerable Software and Affected Versions: LeadSquared Suite plugin versions 0.7.4 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This vulnerability allows for malicious scripts to be stored o...

PT-2023-29823 · Emmanuel Georjon · Eg-Attachments

Name of the Vulnerable Software and Affected Versions: Emmanuel GEORJON EG-Attachments plugin versions = 2.1.3 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them ...

PT-2023-29679 · WordPress · Gopi Ramasamy Scroll Post Excerpt Plugin

Name of the Vulnerable Software and Affected Versions: Gopi Ramasamy Scroll post excerpt plugin versions = 8.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This type of vulnerability allows an attacker to inject...

PT-2023-29815 · Unknown · Geeklog-Core

Name of the Vulnerable Software and Affected Versions: Geeklog-Core geeklog version 2.2.2 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via a crafted payload to the grp desc parameter of the "admin/group.php" component. This enables the attacker ...

ExelaStealer: A New Low-Cost Cybercrime Weapon Emerges

A new information stealer named ExelaStealer has become the latest entrant to an already crowded landscape filled with various off-the-shelf malware designed to capture sensitive data from compromised Windows systems. "ExelaStealer is a largely open-source infostealer with paid customizations...

D-Link DAR-7000 mailrecvview.php File SQL Injection Vulnerability

D-Link DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. A SQL injection vulnerability exists in the D-Link DAR-7000 mailrecvview.php file, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

Money-making scripts attack organizations

In April of this year, the FBI published an advisory on attacks targeting government, law enforcement, and non-profit organizations. Attackers download scripts onto victims devices, delivering several types of malware all at once. The main aim is to utilize company resources for mining, steal dat...

Kimsuky Unveils New Addition to Its Malware Arsenal

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Kimsuky, a cyber-espionage group, is known for infiltrating via spear-phishing attacks, and is recognized for its versatility in using various types of malware and tools to facilitate remote control durin...

Multiple State-Sponsored Groups Exploit WinRAR Vulnerability in Phishing Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A series of phishing attacks linked to a Russian state-sponsored group, leveraging a WinRAR vulnerability to steal data, including browser credentials via PowerShell commands and exfiltrating it through ...

Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability

Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793, a remote-code execution vulnerability affecting multiple versions of JetBrains TeamCity server. TeamCity is a continuous integration/continuous...

PT-2023-20094 · Ezoic · Ezoic Ampedsense – Adsense Split Tester

Name of the Vulnerable Software and Affected Versions: Ezoic AmpedSense – AdSense Split Tester plugin versions = 4.68 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowin...

D-Link DAR-7000 SQL注入漏洞

D-Link DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. A SQL injection vulnerability exists in the D-Link DAR-7000 mailrecvview.php file, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

PT-2023-29346 · Castos · Castos Seriously Simple Stats Plugin

Name of the Vulnerable Software and Affected Versions: Castos Seriously Simple Stats plugin versions = 1.5.1 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

D-Link DAR-7000 SQL注入漏洞

D-Link DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. A SQL injection vulnerability exists in the D-Link DAR-7000 importexport.php file. An attacker can exploit this vulnerability to execute illegal SQL commands to steal sensitive database data...

Customer data stolen from gaming cloud host Shadow

Cloud infrastructure provider Shadow has warned of the data theft of over 500,000 customers. The customers were informed by a breach notification which was posted online. Cloud is known in the gaming world and, among other things, allows gamers to play resource heavy games on lower-end devices, T...

A week in security (October 9 - October 15)

Last week on Malwarebytes Labs: Explained: Quishing Update now! Atlassian Confluence vulnerability is being actively exploited Giant health insurer struck by ransomware didn't have antivirus protection Ransomware review: October 2023 Stalkerware activity drops as glaring spying problem is reveale...

Nextcloud: HTML injection in search UI when selecting a circle with HTML in the display name

An HTML injection vulnerability was discovered in the search user interface of a cloud application. When selecting a circle with HTML in the display name, this could allow redirection to malicious websites or other adverse impacts such as data theft, phishing, or malware distribution...