Chinese State Hackers Target Tibetans with Supply Chain, Watering Hole Attacks

The China-linked threat actor known as Evasive Panda orchestrated both watering hole and supply chain attacks targeting Tibetan users at least since September 2023. The end goal of the attacks is to deliver malicious downloaders for Windows and macOS that deploy a known backdoor called MgBot and ...

Mustang Panda Targets Asia with Advanced PlugX Variant DOPLUGS

The China-linked threat actor known as Mustang Panda has targeted various Asian countries using a variant of the PlugX aka Korplug backdoor dubbed DOPLUGS. "The piece of customized PlugX malware is dissimilar to the general type of the PlugX malware that contains a completed backdoor command...

The vulnerability of the pskmad_64.sys driver used by Watchguard Endpoint Protection, Detection and Response (EPDR), Panda Adaptive Defense 360 (Panda AD360), and Panda Dome allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the pskmad64.sys driver of the Watchguard Endpoint Protection, Detection, and Response EPDR, Panda Adaptive Defense 360 Panda AD360, and Panda Dome security solutions is related to an operation that occurs outside of the buffer in memory. Exploiting this vulnerability can all...

The vulnerability of the pskmad_64.sys driver used by Watchguard Endpoint Protection, Detection and Response (EPDR), Panda Adaptive Defense 360 (Panda AD360), and Panda Dome allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the pskmad64.sys driver of the Watchguard Endpoint Protection, Detection, and Response EPDR, Panda Adaptive Defense 360 Panda AD360, and Panda Dome security solutions is related to an operation that occurs outside of the buffer in memory. Exploiting this vulnerability can all...

The vulnerability of the pskmad_64.sys driver used by Watchguard Endpoint Protection, Detection and Response (EPDR), Panda Adaptive Defense 360 (Panda AD360), and Panda Dome allows a malicious actor to gain unauthorized access to confidential information.

The vulnerability of the pskmad64.sys driver used by Watchguard Endpoint Protection, Detection and Response EPDR, Panda Adaptive Defense 360 Panda AD360, and Panda Dome involves the disclosure of information. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...

China-Linked Hackers Target Myanmar's Top Ministries with Backdoor Blitz

The China-based threat actor known as Mustang Panda is suspected to have targeted Myanmar's Ministry of Defence and Foreign Affairs as part of twin campaigns designed to deploy backdoors and remote access trojans. The findings come from CSIRT-CTI, which said the activities took place in November...

LODEINFO Fileless Malware Evolves with Anti-Analysis and Remote Code Tricks

Cybersecurity researchers have uncovered an updated version of a backdoor called LODEINFO that's distributed via spear-phishing attacks. The findings come from Japanese company ITOCHU Cyber & Intelligence, which said the malware "has been updated with new features, as well as changes to the...

PT-2024-1473 · Panda +1 · Panda Dome +2

Name of the Vulnerable Software and Affected Versions: Watchguard Endpoint Protection, Detection and Response EPDR affected versions not specified Panda Adaptive Defense 360 Panda AD360 affected versions not specified Panda Dome affected versions not specified Description: The issue is related to...

New MrAnon Stealer Malware Targeting German Users via Booking-Themed Scam

A phishing campaign has been observed delivering an information stealer malware called MrAnon Stealer to unsuspecting victims via seemingly benign booking-themed PDF lures. "This malware is a Python-based information stealer compressed with cx-Freeze to evade detection," Fortinet FortiGuard Labs...

Alert: New WailingCrab Malware Loader Spreading via Shipping-Themed Emails

Delivery- and shipping-themed email messages are being used to deliver a sophisticated malware loader known as WailingCrab. "The malware itself is split into multiple components, including a loader, injector, downloader and backdoor, and successful requests to C2-controlled servers are often...

Mustang Panda Targets Philippines Government Using Legitimate Software

Summary: Mustang Panda, a threat actor associated with China, has been implicated in a cyber attack targeting a government entity in the Philippines. The attackers employed a strategy of using legitimate software, such as Solid PDF Creator and SmadavProtect an antivirus solution based in Indonesi...

Mustang Panda Hackers Targets Philippines Government Amid South China Sea Tensions

The China-linked Mustang Panda actor has been linked to a cyber attack targeting a Philippines government entity amid rising tensions between the two countries over the disputed South China Sea. Palo Alto Networks Unit 42 attributed the adversarial collective to three campaigns in August 2023,...

Chinese Hackers Launch Covert Espionage Attacks on 24 Cambodian Organizations

Cybersecurity researchers have discovered what they say is malicious cyber activity orchestrated by two prominent Chinese nation-state hacking groups targeting 24 Cambodian government organizations. "This activity is believed to be part of a long-term espionage campaign," Palo Alto Networks Unit ...

The vulnerability of the Protection Agent component in Watchguard Endpoint Protection’s Detection and Response (EPDR) and Panda Adaptive Defense 360 (Panda AD360) allows attackers to enhance their privileges.

The vulnerability of the Protection Agent component in Watchguard Endpoint Protection, Detection and Response EPDR, and Panda Adaptive Defense 360 Panda AD360 is related to access control deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges by sending...

Attacks, Vulnerabilities and Actors 28 August to 3 September 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries related to cybersecurity threats. Over the past week, the fact that there were a total of six attacks executed, one vulnerability, and two different adversaries highlights...

Unveiling New Windows Ransomware Named Trash Panda

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Trash Panda is a ransomware that encrypts files on Windows machines, replaces the desktop wallpaper, and drops a ransom note with political messages. It adds a ‘.monochrome’ extension to the encrypted...

Malicious USB Drives Targeting Global Targets with SOGU and SNOWYDRIVE Malware

Cyber attacks using infected USB infection drives as an initial access vector have witnessed a three-fold increase in the first half of 2023, That's according to new findings from Mandiant, which detailed two such campaigns – SOGU and SNOWYDRIVE – targeting both public and private sector entities...

CVE-2023-37849

A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL file in the same directory as PANDAVPN.exe...

CVE-2023-37849

A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL file in the same directory as PANDAVPN.exe...

CVE-2023-37849

A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL file in the same directory as PANDAVPN.exe...