New SOHO Router Botnet AVrecon Spreads to 70,000 Devices Across 20 Countries

A new malware strain has been found covertly targeting small office/home office SOHO routers for more than two years, infiltrating over 70,000 devices and creating a botnet with 40,000 nodes spanning 20 countries. Lumen Black Lotus Labs has dubbed the malware AVrecon, making it the third such...

Storm-0978 actively exploited the unpatched Office zero-day

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Storm-0978 is a Russian cybercriminal group that specializes in executing sophisticated phishing campaigns. Storm-0978 was found to be engaged in a new wave of attacks, leveraging the exploitation of...

New Python-Based Fileless Malware Named ‘PyLoose’ Targeting Cloud Environments

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new fileless attack called PyLoose targets cloud workloads by loading an XMRig Miner directly into memory using Python code and the memfd technique. This evasive attack highlights the need for advanced...

Exploit found in the wild for Critical VMware Aria Operations Bug

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary An exploit has surfaced for CVE-2023-20864, a highly significant security vulnerability within the VMware Aria Operations for Logs analysis tool utilized in cloud management. This exploit empowers...

Apple Addresses A Zero-Day Vulnerability Which Is Actively Exploited in Wild

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The zero-day vulnerability CVE-2023-37450 discovered in multiple Apple products is being actively exploited in the wild, specifically when processing web content. This vulnerability can potentially resul...

Beware of Big Head Ransomware: Spreading Through Fake Windows Updates

A developing piece of ransomware called Big Head is being distributed as part of a malvertising campaign that takes the form of bogus Microsoft Windows updates and Word installers. Big Head was first documented by Fortinet FortiGuard Labs last month, when it discovered multiple variants of the...

Unveiling New Big Head Ransomware Variants and Their Stealthy Tactics

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The emergence of Big Head ransomware and its variants suggests a shared source, distributed through deceptive Windows update and Word installer disguises. The threat actor engages via email and Telegram,...

Charming Kitten’s Latest Malware Arsenal and Targeting Strategies

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Charming Kitten, an adaptable threat actor, has shifted to new malware tactics and targets by employing LNK infection chains and utilizing cloud hosting providers. This evolution in their approach poses ...

stats.labs.apnic.net Cross Site Scripting vulnerability OBB-3491653

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Crysis Threat Actors Unleash Venus Ransomware via RDP

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The threat actors behind the Crysis ransomware are currently utilizing the Venus ransomware as a component of their attack strategy, with a primary focus on targeting vulnerable systems through active...

Surge in 8Base Ransomware Group Activity

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary 8Base Ransomware group define themselves as “honest and simple pentesters”, have spiked their activities recently and was observed to be within the top 2 performing ransom groups. To receive real-time...

New Variant of RUSTBUCKET Malware Targeting Cryptocurrency Providers

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary RUSTBUCKET malware family is actively developing, adding persistence capabilities, while the REF9135 operation by the DPRK targets cryptocurrency service providers. To receive real-time threat advisories...

Vulnerability in WordPress Plugin threatens Website takeover

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary WordPress Ultimate Member Plugin, with over 200K installations helps in streamlining user registration and login processes. It has been found vulnerable to unauthenticated privilege escalation,...

Lockbit Ransomware strikes, demands $70-million Ransom

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Lockbit sub-group, National Hazard Agency, claims of data exfiltration from TSMC systems, allegedly deployed Ransomware and demands 70-million-dollar ransom. TSMC has clarified that their system is...

Andariel Group unleashes New EarlyRAT malware

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Andariel is a sub-group of Lazarus and is remarkably stealthy in its operation. Recently they have developed new malware called EarlyRAT. To receive real-time threat advisories, please follow HiveForce La...

PindOS malware deploying Bumblebee and IcedID

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary PindOS, new JavaScript dropper has been spotted in the wild. It is specifically engineered to deliver next-stage payloads and is currently deploying infamous malwares like deploying Bumblebee and IcedID...

JokerSpy macOS Backdoor Attacks Japanese Cryptocurrency Exchange

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary An unknown cryptocurrency exchange in Japan became the target of a precise attack employing an intricate Apple macOS backdoor called JokerSpy. References to JokerSpy can be traced back to as early as Apr...

smartdata-labs.com Cross Site Scripting vulnerability OBB-3474940

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

MULTI#STORM Campaign Sets Sights on India and U.S. with RAT

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The MULTISTORM phishing campaign employs JavaScript files to disseminate RATs throughout compromised systems. This intricate attack utilizes a multi-stage procedure that commences when the victim engages...

Millions of Github Repository susceptible to Repojacking

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Millions of GitHub repositories may be vulnerable to Repojacking, which could lead to large-scale supply chain attacks. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...