CVE-2024-39821

Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of service via local access...

Indian Software Firm's Products Hacked to Spread Data-Stealing Malware

Installers for three different software products developed by an Indian company named Conceptworld have been trojanized to distribute information-stealing malware. The installers correspond to Notezilla, RecentX, and Copywhiz, according to cybersecurity firm Rapid7, which discovered the supply...

Supply Chain Compromise Leads to Trojanized Installers for Notezilla, RecentX, Copywhiz

The following Rapid7 analysts contributed to this research: Leo Gutierrez, Tyler McGraw, Sarah Lee, and Thomas Elkins. Executive Summary On Tuesday, June 18th, 2024, Rapid7 initiated an investigation into suspicious activity in a customer environment. Our investigation identified that the...

Oyster Backdoor Spreading via Trojanized Popular Software Downloads

A malvertising campaign is leveraging trojanized installers for popular software such as Google Chrome and Microsoft Teams to drop a backdoor called Oyster aka Broomstick and CleanUpLoader. That's according to findings from Rapid7, which identified lookalike websites hosting the malicious payload...

New Threat Actor 'Void Arachne' Targets Chinese Users with Malicious VPN Installers

Chinese-speaking users are the target of a never-before-seen threat activity cluster codenamed Void Arachne that employs malicious Windows Installer MSI files for virtual private networks VPNs to deliver a command-and-control C&C framework called Winos 4.0. "The campaign also promotes compromised...

Malvertising Campaign Leads to Execution of Oyster Backdoor

The following analysts contributed to this blog: Thomas Elkins, Daniel Thiede, Josh Lockwood, Tyler McGraw, and Sasha Kovalev. Executive Summary Rapid7 has observed a recent malvertising campaign that lures users into downloading malicious installers for popular software such as Google Chrome and...

Malvertising Campaign Leads to Execution of Oyster Backdoor

The following analysts contributed to this blog: Thomas Elkins, Daniel Thiede, Josh Lockwood, Tyler McGraw, and Sasha Kovalev. Executive Summary Rapid7 has observed a recent malvertising campaign that lures users into downloading malicious installers for popular software such as Google Chrome and...

PT-2024-24991 · Utau · Utau

Name of the Vulnerable Software and Affected Versions: UTAU versions prior to v0.4.19 Description: A path traversal issue exists, allowing an arbitrary file to be placed if a user installs a crafted UTAU voicebank installer, such as a .uar or .zip file, to UTAU. Recommendations: For versions prio...

Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern

Ransomware attacks targeting VMware ESXi infrastructure follow an established pattern regardless of the file-encrypting malware deployed, new findings show. "Virtualization platforms are a core component of organizational IT infrastructure, yet they often suffer from inherent misconfigurations an...

CVE-2023-43748

Improper access control in some IntelR GPA Framework software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-40071

Improper access control in some IntelR GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-24460

Incorrect default permissions in some IntelR GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-40071

Improper access control in some IntelR GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-43629

Incorrect default permissions in some IntelR GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-42433

Incorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-42433

The CVE-2023-42433 affects Endurance Gaming Mode software installers prior to version 1.3.937.0. Root cause: incorrect default permissions in the installers, enabling an authenticated local user to potentially escalate privileges. Impact: local privilege escalation with a base CVSS 3.1 score of 6...

CVE-2024-21813

Exposure of resource to wrong sphere in some IntelR DTT software installers may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2024-10053 · Intel · Intel Dtt

Name of the Vulnerable Software and Affected Versions: Intel DTT software affected versions not specified Description: The issue is related to the exposure of resources to the wrong sphere in some Intel DTT software installers, potentially allowing an authenticated user to enable escalation of...

Ongoing Malvertising Campaign leads to Ransomware

Executive Summary Rapid7 has observed an ongoing campaign to distribute trojanized installers for WinSCP and PuTTY via malicious ads on commonly used search engines, where clicking on the ad leads to typo squatted domains. In at least one observed case, the infection has led to the attempted...

FIN7 Hacker Group Leverages Malicious Google Ads to Deliver NetSupport RAT

The financially motivated threat actor known as FIN7 has been observed leveraging malicious Google ads spoofing legitimate brands as a means to deliver MSIX installers that culminate in the deployment of NetSupport RAT. "The threat actors used malicious websites to impersonate well-known brands,...