New Migo Malware Targeting Redis Servers for Cryptocurrency Mining

A novel malware campaign has been observed targeting Redis servers for initial access with the ultimate goal of mining cryptocurrency on compromised Linux hosts. "This particular campaign involves the use of a number of novel system weakening techniques against the data store itself," Cado securi...

VulnCheck KEV: CVE-2023-3595

Where this vulnerability exists in the Rockwell Automation 1756 EN2 and 1756 EN3 ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to...

Malicious code in uber-rv-web-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a0f336c3e2ea33ad54b11ffc09c8c393d4a13bf84daabe5383d4b18ae4e683d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in analysis-studio-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75c17c5e49ccef1b22c2e66b608c7057f54ee1bcf3ab817c89662687dddc6f02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lol-pizda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28119bf8a3685ec67b475cd2445c48a49a636815dc36234375b3535a7f209c7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-21047 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: Alf.io versions prior to 2.0-M4-2402 Description: The issue allows an administrator on the Alf.io application to upload HTML files that trigger JavaScript payloads. This could enable an attacker who gains administrative access to persist acce...

Glupteba Botnet Evades Detection with Undocumented UEFI Bootkit

The Glupteba botnet has been found to incorporate a previously undocumented Unified Extensible Firmware Interface UEFI bootkit feature, adding another layer of sophistication and stealth to the malware. "This bootkit can intervene and control the operating system boot process, enabling Glupteba t...

Malicious code in vtuancuti (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b03a47e97430787e0ff4368de00faaa5660d41aeb26f22c0cf3a0e0df89d55e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-13276 · Ibm · Sametime

Name of the Vulnerable Software and Affected Versions: Sametime affected versions not specified Description: The issue is related to a failure to invalidate sessions in Sametime. Sensitive cookie values are set in a persistent manner in Sametime Web clients, allowing these values to remain valid...

New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization

By Jungsoo An, Wayne Lee and Vanja Svajcer. Cisco Talos discovered a new, stealthy espionage campaign that has likely persisted since at least March 2021. The observed activity affects an Islamic non-profit organization using backdoors for a previously unreported malware family we have named...

Persistence – Windows Setup Script

When the Windows Operating system is installed via a clean installation or via an upgrade, the Windows Setup binary is executed. The Windows setup allows… Continue reading - Persistence - Windows Setup Script...

Malicious code in take-cam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee2b55b60fc9b59f49dfd774411ff14fd939fdde2e9bb6fe39d19730bb910092 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Persistence – Disk Clean-up

Disk Clean-up is a utility which is part of Windows operating systems and can free up hard drive disk space by deleting mainly cache and… Continue reading - Persistence - Disk Clean-up...

Malicious code in myonlife (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf83c22849afc0e8140c52c352eef3ba6bb5922258f9f0af70839ebfce66abaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in myoimanshhu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c133af670c1bf65895c1949c3793dbbb2feb7df39eda4df7c5be551b4b580e0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in distube-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06ac3f289f159fa4961391d20b8dbb4b10a0467ac4654073bcc0aa7863caf8cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-8004 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fe20d610fac42ed237437021b64cb0e9dd8edffe8b40ca212f8064bec973dbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-7603 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11dafef5a7039e9f4bd8baaff2ea7aa10bf4249063e555211e098f87272c13a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-8008 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bc332f6f9feb05f866632a1d6c04a6167c381585faa7507662e4d6ba2de8398 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-8007 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ab1806a5ffb18dd0815ec94b47435c4c31518f75559018ddde6e2bd052c9eb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...