4177 matches found
Chinese Hackers Launch Covert Espionage Attacks on 24 Cambodian Organizations
Cybersecurity researchers have discovered what they say is malicious cyber activity orchestrated by two prominent Chinese nation-state hacking groups targeting 24 Cambodian government organizations. "This activity is believed to be part of a long-term espionage campaign," Palo Alto Networks Unit ...
Microsoft Warns of Fake Skills Assessment Portals Targeting IT Job Seekers
A sub-cluster within the infamous Lazarus Group has established new infrastructure that impersonates skills assessment portals as part of its social engineering campaigns. Microsoft attributed the activity to a threat actor it calls Sapphire Sleet, describing it as a "shift in the persistent...
Farnetwork the Mastermind of Five Ransomware Strains
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Farnetwork, a highly skilled threat actor fluent in Russian, has played a key role in five distinct ransomware-as-a-service RaaS programs, assuming diverse roles such as orchestrator and contributor to...
BlazeStealer Malware Uncovered in Python Packages on PyPI
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Python Package Index PyPI repository is infiltrated with number of malicious python packages. These packages masquerade as obfuscation tools, however they harbor BlazeStealer malware, which initiates a...
Chinese APT Masquerading as Cloud Services in Cambodia
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Chinese APT targets Cambodian government via disguised cloud services, aiming to access sensitive data, aligning with Chinas regional interests. Actors adapt work hours, signaling Chinese origin, urging...
Millenium RAT the $30 Access Ticket to Data Theft
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Millenium RAT, a Win32 executable built on .NET, specifically version 2.4, is available on GitHub for a one-time fee of $30, granting lifetime access. Notably, this RAT is actively developed and has...
SideCopy Leverages Multi-platform RAT, Assaults Indian Government Entities
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A threat actor linked to Pakistan named SideCopy is capitalizing on WinRARs CVE-2023-38831 vulnerability to target Indian government agencies. This security vulnerability facilitates distribution of...
BlueNoroff Unleashes New macOS Malware ObjCShellz
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new macOS malware variant linked to the financially motivated BlueNoroff APT group, named "ObjCShellz,“ featuring remote shell capabilities and suspicious domain communication. The malware, written in...
Socks5Systemz Proxy Botnet Infects 10,000 Systems
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A sophisticated proxy botnet known as Socks5Systemz has insidiously infiltrated over 10,000 computers by employing the PrivateLoader and Amadey malware loaders. The masterminds behind this botnet offer...
CVE-2023-46822
Unauth. Reflected Cross-Site Scripting' vulnerability in Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin = 2.7.2 versions...
CVE-2023-46822
Unauth. Reflected Cross-Site Scripting' vulnerability in Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin = 2.7.2 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting' vulnerability in Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin = 2.7.2 versions...
CVE-2023-46822
CVE-2023-46822 affects the WordPress Store Exporter for WooCommerce plugin (Visser Labs Store Exporter for WooCommerce) version ≤ 2.7.2. The issue is an unauthenticated, reflected Cross-Site Scripting (XSS) vulnerability in the plugin, with root cause identified as improper input handling/exposur...
CVE-2023-46822 WordPress WooCommerce – Store Exporter Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting' vulnerability in Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin = 2.7.2 versions...
A week in security (October 30 – November 5)
Last week on Malwarebytes Labs: Apache ActiveMQ vulnerability used in ransomware attacks YouTube launches "global effort" to block ad blockers Should you allow your browser to remember your passwords? Atlassian: "Take immediate action" to patch your Confluence Data Center and Server instances Wha...
PT-2023-30237 · Visser · Visser Labs Store Exporter For Woocommerce
Name of the Vulnerable Software and Affected Versions: Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin versions = 2.7.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting vulnerability. This vulnerabili...
Rocky Linux 8 : unbound (RLSA-2022:7622)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7622 advisory. - NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by...
Rocky Linux 9 : unbound (RLSA-2022:8062)
The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8062 advisory. - NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by...
Rocky Linux 8 : unbound (RLSA-2021:1853)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1853 advisory. - DISPUTED Unbound before 1.9.5 allows an integer overflow in the regional allocator via regionalalloc. NOTE: The vendor disputes that this is a...
Grafana Labs Stored XSS (CVE-2022-31097)
According to its self-reported version number, the version of Grafana Labs running on the remote host is affected by a stored cross-site scripting vulnerability: - XSS vulnerability in the Unified Alerting feature of Grafana. After analysis, this stored XSS could be used to elevate privileges fro...