Hackers Using Bumblebee Loader to Compromise Active Directory Services

The malware loader known as Bumblebee is being increasingly co-opted by threat actors associated with BazarLoader, TrickBot, and IcedID in their campaigns to breach target networks for post-exploitation activities. "Bumblebee operators conduct intensive reconnaissance activities and redirect the...

Malicious code in doper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d9bb14be4806729de843faa2a6b302a9a41a928c89351fe5dc4afd4d7f5effa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wherehouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 716d8e721f3f56bcf3bd9ec501d0d50b26a7230735f3dd134e33db7413e8d714 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in colors-1.0.0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e251834479fd9d7472cee1bca5f877da16eec045ef2939a67c9a79af18aa137b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in r3corda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c382f0ace3aa69aa9a3b445f4290e833ef93054ab9f130875e8a5da3e387d5a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Uncontrolled Search Path Element in Outbyte Pc_Repair

POC-of-CVE-2022-36271 !cve1https://user-images.githubuserc...

CVE-2022-2503

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear...

AZL-10559 CVE-2022-2503 affecting package kernel for versions less than 5.15.67.1-4

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear...

UBUNTU-CVE-2022-2503

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear...

Malicious code in tbb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3de48d43075fd9973cabcbe45fa482af36e5acc26fbbba41e80107cfbf04d572 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ptokens-website-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f2eb8741be933f0b1b3bb5b71c91a9dc94860b2e2dd4706e8a781580f66f26c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @m365-admin/nav (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca8b90e02efef666370b40f0b2ad1cda6842e1d703eae103f1b15988d40bd543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TripleCross 安全漏洞

TripleCross is a Linux eBPF rootkit with backdoor, C2, library injection, execution hijacking, persistence, and steganography from the individual developer Marcos Bajo in Spain. A security vulnerability exists in TripleCross version v0.1.0, which stems from a segmentation fault that occurs when...

Malicious code in pplogger-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f79d96a39bd0701b0be053e0cad25703bda81b63b17638a10a26a1e023a91d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lwc-playground (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98e335481687ce6c9f293923692ec4f19da6a49f4d5fe8c014625761fe5a23cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in f36-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8429f79fd714aef2e42d4d72437a7b404d59fc7592a639fb43fb43dde7e6e4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in avax-js-cli-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20bcbb8282cba23d9c896b37231cedc6bae3b5042eff2693e1ee677525401345 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

APT37 employs Konni malware to target high-level organizations

Threat Level Actor Report For a detailed advisory, download the pdf file here Summary The Konni remote access trojan, which is widely used malware by the APT37, is used in the attack campaign to take advantage of high-value targets from countries like the Czech Republic, Poland, and many others...

Malicious code in ot-menu-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4719e9ae5efca357fd891b2be9fde0c17cd90faa6c67a1c4955e7e1f811cfe29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stringjs_lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 408657b4589508928485b1c6cb47eb32fe5964986aaa380196f80f7792356f1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...