Russian Hacker “Wazawaka” Indicted for Ransomware

A Russian man identified by KrebsOnSecurity in January 2022 as a prolific and vocal member of several top ransomware groups was the subject of two indictments unsealed by the Justice Department today. U.S. prosecutors say Mikhail Pavolovich Matveev, a.k.a. "Wazawaka" and "Boriselcin" worked with...

Actors, Threats and Vulnerabilities 08 to 14 May 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries related to cybersecurity threats. Over the past week, identified a total of nine attacks that were executed. Additionally, HiveForce Labs identified four different...

Former Ubiquiti Employee Gets 6 Years in Jail for $2 Million Crypto Extortion Case

A former employee of Ubiquiti has been sentenced to six years in jail after he pleaded guilty to posing as an anonymous hacker and a whistleblower in an attempt to extort almost $2 million worth of cryptocurrency while working at the company. Nickolas Sharp, 37, was arrested in December 2021 for...

Authorization

An improper authorization vulnerability exists in Rocket.Chat 6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room...

British hacker pleads guilty to hacking schemes, faces 77 years in prison

By Habiba Rashid Joseph James O'Connor was part of a hacking group that hacked over 130 Twitter accounts in July 2020. This is a post from HackRead.com Read the original post: British hacker pleads guilty to hacking schemes, faces 77 years in prison...

CVE-2023-28325

An improper authorization vulnerability exists in Rocket.Chat 6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room...

A Mysterious New Hacker Group, Red Stinger, Is Lurking in Ukraine’s Cyberspace

The unidentified attackers have targeted people on both sides of Russia’s war against Ukraine, carrying out espionage operations that suggest state funding...

Join Our Webinar: Learn How to Defeat Ransomware with Identity-Focused Protection

Are you concerned about ransomware attacks? You're not alone. In recent years, these attacks have become increasingly common and can cause significant damage to organizations of all sizes. But there's good news - with the right security measures in place, such as real-time MFA and service account...

Integer Overflow in Endian Library

Lines of code Vulnerability details Impact An integer overflow can lead to unexpected behavior in a smart contract, potentially causing financial loss or disruption of the contract's intended functionality. Proof of Concept If the input value passed to the function exceeds 64 bits, an integer...

The vulnerability of cloud-based software for creating and using Nextcloud data storage allows a hacker to induce a service failure.

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions is related to the use of a name with an incorrect reference. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Exploit for Injection in Git-Scm Git

CVE-2023-29007 PoC repository for CVE-2023-29007https://vu...

Exploit for Command Injection in Sophos Web_Appliance

CVE-2023-1671 Vulnerability Scanner !GitHub last commit...

Hacker Group Names Are Now Absurdly Out of Control

Pumpkin Sandstorm. Spandex Tempest. Charming Kitten. Is this really how we want to name the hackers wreaking havoc worldwide?...

The Hacker Who Hijacked Matt Walsh’s Twitter Was Just ‘Bored’

The breach of the right-wing provocateur was simply a way of “stirring up some drama,” the attacker tells WIRED. But the damage could have been much worse...

Google Releases Urgent Chrome Update to Fix Actively Exploited Zero-Day Vulnerability

Google on Friday released out-of-band updates to resolve an actively exploited zero-day flaw in its Chrome web browser, making it the first such bug to be addressed since the start of the year. Tracked as CVE-2023-2033, the high-severity vulnerability has been described as a type confusion issue ...

Alcasec Hacker, aka “Robin Hood of Spanish Hackers,” Arrested

By Waqas Alcasec boasted about his hacks in a YouTube podcast. This is a post from HackRead.com Read the original post: Alcasec Hacker, aka "Robin Hood of Spanish Hackers," Arrested...

ENTAB ERP 1.0 - Username PII leak Vulnerability

Exploit Title: ENTAB ERP 1.0 - Username PII leak Exploit Author: Deb Prasad Banerjee Vendor Homepage: https://www.entab.in Version: Entab ERP 1.0 Tested on: Windows IIS CVE: CVE-2022-30076 Vulnerability Name: Broken Access control via Rate Limits Description: In the entab software in...

North Korea Hacking Cryptocurrency Sites with 3CX Exploit

News: Researchers at Russian cybersecurity firm Kaspersky today revealed that they identified a small number of cryptocurrency-focused firms as at least some of the victims of the 3CX software supply-chain attack thats unfolded over the past week. Kaspersky declined to name any of those victim...

20-Year-Old BreachForums Founder Faces Up to 5 Years in Prison

Conor Brian Fitzpatrick, the 20-year-old founder and the administrator of the now-defunct BreachForums has been formally charged in the U.S. with conspiracy to commit access device fraud. If proven guilty, Fitzpatrick, who went by the online moniker "pompompurin," faces a maximum penalty of up to...

anti-hacker-alliance.com Cross Site Scripting vulnerability OBB-3236548

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...