Camaro Dragon Targets European Foreign Affairs with Malicious Firmware Implant

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Camaro Dragon is a Chinese state-sponsored advanced persistent threat APT group that has been targeting European foreign affairs entities. To receive real-time threat advisories, please follow HiveForce...

Apple Patches Three Exploited Zero-Day Vulnerabilities in macOS

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Apple addresses three exploited zero-day vulnerabilities in macOS, fixing sandbox escape and code execution issues in the WebKit browser engine. To receive real-time threat advisories, please foll...

RA Group’s Custom Ransomware Hits US & South Korea

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The emergence of the RA ransomware group highlights the utilization of the recently leaked Babuk ransomware source code as they employ it to develop their variant of the malware. To receive real-time...

XSS Vulnerability in Popular WordPress Plugin Affects 2 Million Sites

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A Cross-Site scripting vulnerability has been discovered in an Advanced Custom Fields plugin for WordPress which has put 2 Million websites at risk. To receive real-time threat advisories, please...

Greatness a Growing Threat to Microsoft 365 Users

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Phishing-as-a-Service PaaS platform named Greatness has experienced a surge in its operations, which target organizations utilizing Microsoft 365 in the United States, United Kingdom, Australia, Sout...

New Variant of BPFDoor Linux Malware Features Enhanced Encryption and Stealthy Communication

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new variant of the Linux malware BPFDoor has been discovered, featuring more robust encryption and reverse shell communication. It uses the BPF to bypass firewall restrictions, allowing threat actors t...

Uncovering the Latest Tactics of the SideWinder APT

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary SideWinder APT group uses advanced tactics like spear-phishing, DLL side-loading & more. A new server-side polymorphism technique, highlighting the need for multi-layered security measures. To receive...

Microsoft’s May 2023 update addresses two Zero-Day Vulnerabilities

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Microsoft released a security update in May 2023 to address 40 CVEs, including two zero-day vulnerabilities that have already been exploited in the wild. To receive real-time threat advisories,...

CVE-2023-31802

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedinurl parameters...

Fortinet addresses Vulnerabilities in FortiADC, FortiOS and FortiProxy

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Fortinet has issued security patches for two high-severity vulnerabilities - an OS command vulnerability in FortiADC, and an out-of-bounds write flaw in sslvpnd of FortiOS and FortiProxy. To recei...

New LOBSHOT Malware Being Distributed Through Google Ads

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary LOBSHOT is a new malware that is being distributed through Google Ads. It is a remote access trojan that can allow threat actors to take control of an infected Windows devices hidden desktop, execute...

TP-Link Router Vulnerability Triggers Mirai Malware Infection

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The TP-Link router vulnerability allows attackers to execute commands and infect devices with the Mirai malware. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...

New macOS malware RustBucket attributed to North Korean group BlueNoroff

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary RustBucket, attributed to BlueNoroff, is split into two stages, with the second stage application appearing as a legitimate PDF viewer but becoming malicious when a specific PDF is loaded. To receive...

North Korean-Backed Group’s Sparks X_Trader Supply Chain Attack

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The XTrader software supply chain attack affected at least a number of critical infrastructure entities in the United States and Europe. To receive real-time threat advisories, please follow HiveForce La...

LinkedIn: CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*

A CSRF vulnerability was identified that could potentially cause a LinkedIn user to follow an attacker-controlled account without additional confirmation by clicking a specially crafted URL...

Charming Kitten Hackers Utilize New Tactics with BellaCiao Malware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Iranian APT group, Charming Kitten, is using a new, sophisticated malware called BellaCiao to target specific victims in multiple regions, employing unique communication tactics with its...

Daggerfly APT Deploys MgBot to Target African Telecoms Organization

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Daggerfly advanced persistent threat group has been observed using previously unseen plugins from the MgBot malware framework in a recent campaign. To receive real-time threat advisories, please foll...

Critical PaperCut Security Vulnerabilities Actively Exploited in the Wild

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Attackers are leveraging severe vulnerabilities in PaperCut MF/NG software to install Atera remote management software, posing a significant risk due to proof-of-concept exploits being available...

CVE-2023-23710

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in miniOrange WordPress Social Login and Register Discord, Google, Twitter, LinkedIn plugin = 7.5.14 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in miniOrange WordPress Social Login and Register Discord, Google, Twitter, LinkedIn plugin = 7.5.14 versions...