CVE-2025-0121 Cortex XDR Agent: Local Windows User Can Crash the Agent

A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it...

Malicious code in godaddy-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 724a0da7bd51020bd0cb61eeedbe68f99b1b5c60d9d2deb419fd7c686671a4ad The OpenSSF Package Analysis project identified 'godaddy-api-client' @ 999.9.9 npm as malicious. It is considered malicious because: - The packa...

Malicious code in test-rce3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 268f9a9b82d8e6d94dede1f419570ec5e28e30480f9ee76c010cacc4e248fd81 The OpenSSF Package Analysis project identified 'test-rce3' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-9469

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity...

PT-2024-7398 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Agent

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Cortex XDR Agent affected versions not specified Description: A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to...

CVE-2024-8690

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity...

Malicious code in nvk-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e0570e31c6c015817cd5fce4308786f1fe2264b4c8bb64fab755b0df9ba0c9f7 The OpenSSF Package Analysis project identified 'nvk-tools' @ 1.2.2 npm as malicious. It is considered malicious because: - The package...

Black Basta Ransomware Strikes 500+ Entities Across North America, Europe, and Australia

The Black Basta ransomware-as-a-service RaaS operation has targeted more than 500 private industry and critical infrastructure entities in North America, Europe, and Australia since its emergence in April 2022. In a joint advisory published by the Cybersecurity and Infrastructure Security Agency...

Malicious code in reqargs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9d1ba9bc54763d8ec8336f0edc8d5997d5fb080801556f288a4935dac06d4878 The OpenSSF Package Analysis project identified 'reqargs' @ 1.4 pypi as malicious. It is considered malicious because: - The package communicate...

Malicious code in apache2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 12b1a6eed914c86f199b052822217042e2afa047d6b1d9921fd30b56f1e5e650 The OpenSSF Package Analysis project identified 'apache2' @ 1.1.9 npm as malicious. It is considered malicious because: - The package communicat...

Malicious code in esqpushpullmc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 176143e891606079b9ba87e878279f75da3a0083aec6fc2159761c8340e4f927 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

What's New in InsightIDR: Q2 2022 in Review

This Q2 2022 recap post takes a look at some of the latest investments we've made to InsightIDR to drive detection and response forward for your organization. New interactive HTML reports InsightIDR's new HTML reports incorporate the interactive features you know and love from our dashboards...

ThreatList: Ransomware, EKs and Trojans lead the Way in Q3 Malware Trends

When it comes to malware activity, businesses took a big hit in the third quarter, with detection trending upward by a whopping 55 percent, according to new research. Consumers saw an uptick too, but only a modest one: volume was up just 4 percent quarter-over-quarter for this segment. Overall,...

sIPI - Simple IP Information Tools

This tool is aimed for Incident Response Team and anyone what's want to know the behaviour of the "suspicious" IP Address. The tools do search looking for reputation info from a set of open threat intelligence sources. Information about this IP like malware activity, malicious activity, blacklist...

Zero-Day Attacks Thrive for Months Before Disclosure

Zero-day vulnerabilities and exploits dominate headlines and most heated information security discussions. In truth, however, there are relatively few of these attacks hitting a small number of hosts, according to new research on the subject. The reason zero days eat up so much bandwidth is becau...