Malicious code in music-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01508d334e0bbe8458f00ca13978e861399e796f527f528b23fd9bbcd55000c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-164)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-164 advisory. Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and...

Malicious code in react-orange-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13d1f91905a22633d21b8801128e83148b0f22c92c6b63bfb66fb3a7981734d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

LOBSHOT: A Stealthy, Financial Trojan and Info Stealer Delivered through Google Ads

In yet another instance of how threat actors are abusing Google Ads to serve malware, a threat actor has been observed leveraging the technique to deliver a new Windows-based financial trojan and information stealer called LOBSHOT. "LOBSHOT continues to collect victims while staying under the...

ASB-A-261588851

In multiple functions of SnoozeHelper.java, there is a possible failure to persist settings due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

com.github.j5ik2o:akka-persistence-dynamodb-kafka-write-adaptor_2.11 (=1.1.0), com.github.j5ik2o:akka-persistence-kafka_2.11 (>=1.0.4 <=1.0.5) +1 more potentially affected by CVE-2023-29471 via com.typesafe.akka:akka-stream-kafka_2.11 (>=2.0.0 <=2.0.7)

com.typesafe.akka:akka-stream-kafka2.11 MAVEN version =2.0.0, =1.0.4, =2.0.0, =2.0.7 Source cves: CVE-2023-29471 Source advisory: OSV:GHSA-55VQ-XPJF-R2XC...

Malicious code in nodejs-encrypt-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f59ac2ca2c204c22b2a5f11db9eef454f786803297f219aeb3e179dbe656ae07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nlp-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ef6692095c28b968172ac45d43937a7bfe30267c7c27add946d2534ad6c7e24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zebilamouche (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e40ab7411da6bec58baf070991f0cfc47b4d1b87ba7bdf784b31aa130a118d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Kubernetes RBAC Exploited in Large-Scale Campaign for Cryptocurrency Mining

A large-scale attack campaign discovered in the wild has been exploiting Kubernetes K8s Role-Based Access Control RBAC to create backdoors and run cryptocurrency miners. "The attackers also deployed DaemonSets to take over and hijack resources of the K8s clusters they attack," cloud security firm...

Kubernetes RBAC Exploited in Large-Scale Campaign for Cryptocurrency Mining

A large-scale attack campaign discovered in the wild has been exploiting Kubernetes K8s Role-Based Access Control RBAC to create backdoors and run cryptocurrency miners. "The attackers also deployed DaemonSets to take over and hijack resources of the K8s clusters they attack," cloud security firm...

Blind Eagle Cyber Espionage Group Strikes Again: New Attack Chain Uncovered

The cyber espionage actor tracked as Blind Eagle has been linked to a new multi-stage attack chain that leads to the deployment of the NjRAT remote access trojan on compromised systems. "The group is known for using a variety of sophisticated attack techniques, including custom malware, social...

Blind Eagle Cyber Espionage Group Strikes Again: New Attack Chain Uncovered

The cyber espionage actor tracked as Blind Eagle has been linked to a new multi-stage attack chain that leads to the deployment of the NjRAT remote access trojan on compromised systems. "The group is known for using a variety of sophisticated attack techniques, including custom malware, social...

CVE-2023-28856 `HINCRBYFLOAT` can be used to crash a redis-server process

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised ...

Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access

The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems. While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis from Group-IB h...

Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access

The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems. While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis from Group-IB h...

North Korean Hackers Uncovered as Mastermind in 3CX Supply Chain Attack

Enterprise communications service provider 3CX confirmed that the supply chain attack targeting its desktop application for Windows and macOS was the handiwork of a threat actor with North Korean nexus. The findings are the result of an interim assessment conducted by Google-owned Mandiant, whose...

Malicious code in uploadcare-wordpress (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3539d032a58d539f1abeeed7c1e64a239da65fb248c8155e75f524875042d60c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign

This guide provides steps that organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2022-21894 via a Unified Extensible Firmware Interface UEFI bootkit called BlackLotus. UEFI bootkits are particularly dangerous as they run at computer...

Malicious code in fabric-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 031f95a39929ba0a778100655abe80c8b7455a55f5e2d1dea13b6bd2dbb3bd16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...