Dell DM5500 Information Disclosure Vulnerability

The Dell DM5500 is an integrated solution from Dell, Inc. It provides industry-leading deduplication, data protection solutions and multi-cloud capabilities. The Dell DM5500 suffers from an information disclosure vulnerability that originates from the inclusion of a plain text password in the PPO...

MAL-2023-8559 Malicious code in autocomplete-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9655da8503f9549c9411d13c7b5306dd5b29247b41ee5857561d74aa7c118dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

How to catch a wild triangle

In the beginning of 2023, thanks to our Kaspersky Unified Monitoring and Analysis Platform KUMA SIEM system, we noticed suspicious network activity that turned out to be an ongoing attack targeting the iPhones and iPads of our colleagues. The moment we understood that there was a clear pattern in...

The main causes of ransomware reinfection

A few months ago, we wrote about a ransomware reinfection incident. Ransomware reinfection arguably could be even worse than being a first time victim. Unfortunately it happens more often than you may think. Research shows that in 2022, more than a third 38% of surveyed organizations fell victim ...

Global Domains International 2.0 Cross Site Scripting

==================================================================================================================================== | Title : Global Domains International v2.0 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3...

Malicious code in corporate-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d338cc997e0f56baeafd5773af498e1e559144af5aa4319bb9f939aa7f3c934b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CMSUsina 2.2.3 Cross Site Request Forgery

==================================================================================================================================== | Title : CMSUsina V2.2.3 CSRF Add Admin Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.332-bit | |...

Microsoft 365 MSO 2306 Build 16.0.16529.20100 Remote Code Execution

Title: Microsoft Outlook ®Microsoft 365 MSO Version 2306 Build 16.0.16529.20100 32-bit RCE Author: nu11secur1ty Date: 07.07.2023 Vendor: https://www.microsoft.com/ Software: https://outlook.live.com/owa/ Reference: https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/...

Allhandsmarketing LMS 2.0 Cross Site Request Forgery

==================================================================================================================================== | Title : Allhandsmarketing LMS v2.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | |...

Stealth Soldier: A New Custom Backdoor Targets North Africa with Espionage Attacks

A new custom backdoor dubbed Stealth Soldier has been deployed as part of a set of highly-targeted espionage attacks in North Africa. "Stealth Soldier malware is an undocumented backdoor that primarily operates surveillance functions such as file exfiltration, screen and microphone recording,...

Syncthing 跨站脚本漏洞

Syncthing is an open source continuous file synchronization program from The Syncthing Project. A cross-site scripting vulnerability exists in versions prior to Syncthing 1.23.5, which stems from an infected instance with a shared folder that can synchronize malicious files with arbitrary HTML an...

Rocket.Chat Authorization Issues Vulnerability (CNVD-2023-43229)

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat. An attacker exploited the vulnerability to maintain access to an infected account...

This Cybercrime Syndicate Pre-Infected Over 8.9 Million Android Phones Worldwide

A cybercrime enterprise known as Lemon Group is leveraging millions of pre-infected Android smartphones worldwide to carry out their malicious operations, posing significant supply chain risks. "The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages,...

Rocket.Chat 授权问题漏洞

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat. An attacker exploited the vulnerability to maintain access to an infected account...

Google takes CryptBot to the wood shed

Google is in the midst of a legal campaign designed to take down the creators of a very persistent piece of malware called CryptBot. This malware, which Google claims compromised roughly 670k computers, set about infecting users of the Chrome browser. Unfortunately for the malware campaign...

Google Gets Court Order to Take Down CryptBot That Infected Over 670,000 Computers

Google on Wednesday said it obtained a temporary court order in the U.S. to disrupt the distribution of a Windows-based information-stealing malware called CryptBot and "decelerate" its growth. The tech giant's Mike Trinh and Pierre-Marc Bureau said the efforts are part of steps it takes to "not...

Prometei botnet improves modules and exhibits new capabilities in recent updates

Prometei botnet continued its activity since Cisco Talos first reported about it in 2020. Since November 2022, we have observed Prometei improving the infrastructure components and capabilities. More specifically, the botnet operators updated certain submodules of the execution chain to automate...

MAL-2023-4064 Malicious code in libhackedstr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4f8d02193fa8d06ad40c638b3cd90bad1e6eac7081c083c33fb95ad4e1b1ab92 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-3848 Malicious code in lgtbpep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e2eb1b15323c431c044d51ffef01745174eaef211541a12ba6c778b68e32c8b4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Mylobot: A Sophisticated Botnet Malware Targeting Computers Worldwide

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Mylobot is a Windows-targeting malware and was first discovered in 2017. It has not received much attention since then, but it is noteworthy for its ability to transform the infected system into a proxy...