New Jupyter Infostealer Version Emerges with Sophisticated Stealth Tactics

An updated version of an information stealer malware known as Jupyter has resurfaced with "simple yet impactful changes" that aim to stealthily establish a persistent foothold on compromised systems. "The team has discovered new waves of Jupyter Infostealer attacks which leverage PowerShell comma...

Windows Telemetry Persistence

This persistence mechanism installs a new telemetry provider for windows. If telemetry is turned on, when the scheduled task launches, it will execute the telemetry provider and execute our payload with system permissions. Module Options msf use exploit/windows/persistence/telemetry msf...

Mysterious Kill Switch Disrupts Mozi IoT Botnet Operations

The unexpected drop in malicious activity connected with the Mozi botnet in August 2023 was due to a kill switch that was distributed to the bots. "First, the drop manifested in India on August 8," ESET said in an analysis published this week. "A week later, on August 16, the same thing happened ...

Attacks, Vulnerabilities and Actors 23 October to 29 October 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of seven executed attacks, two instances of adversary activity, and three exploited...

A cascade of compromise: unveiling Lazarus’ new campaign

Earlier this year, a software vendor was compromised by the Lazarus malware delivered through unpatched legitimate software. Whats remarkable is that these software vulnerabilities were not new, and despite warnings and patches from the vendor, many of the vendors systems continued to use the...

StripedFly: Perennially flying under the radar

Introduction Its just another cryptocurrency miner… Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows. It comes equipped with a built-in TOR network tunnel for communication with command servers,...

Malicious code in envi-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf29d35387a88f70fb474d1d02435edd91ab0c4f8f482414b8f2c046328b820f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vietnamese Hackers Target U.K., U.S., and India with DarkGate Malware

Attacks leveraging the DarkGate commodity malware targeting entities in the U.K., the U.S., and India have been linked to Vietnamese actors associated with the use of the infamous Ducktail stealer. "The overlap of tools and campaigns is very likely due to the effects of a cybercrime marketplace,"...

CVE-2023-45814

CVE-2023-45814 affects Bunkum’s AuthenticationService token caching. The issue arises from caching ITokens and IUser relations after 4.0, causing a use-after-free when a cached token outlives a request and is later accessed (IToken.User) in subsequent requests. Red Hat/OSV/GHSA entries summarize ...

CVE-2023-45145

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...

A New XorDDoS Linux Trojan That Launches Powerful DDoS Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The XorDDoS Trojan, a Linux-based malware, orchestrates DDoS attacks through infected devices, with a recent campaign detected in 2023. Attackers employ scanning, persistence, and C2 infrastructure...

Malicious code in very-bad-npm-package2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a584dd679c45e7c26cb11a9996bf739b091a6bd7e73289844b51a3a48102a1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kempremium-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0ce69947fee989e38a8cb1396ceaf8b70bd343327c511cf946c8c9f4a3f364d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @momo-miniapp/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6007d4e44cc4c068a9bb068cda01c272f184a9023da891b3f63737a50f814575 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in situs-slot-gacor-slot-online-resmi-terbaik-mudah-menang-dan-maxwin-2023 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed117fc0df745b25c18fac4374260486998e37259de0c6bdc83baab0df4a485a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kernel: LoadPin bypass via dm-verity table reload

A flaw was found in the Linux kernel. Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module and firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out...

Malicious code in hyvee.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d097078bcb2a164d3761c80c52b4604ffd7e592ad363583f38e38192f542f63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in f0-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b198073a3c6c8c48eaa78a60790eebe24d1bce34d24bdcbba4e0f077f329c56b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-rebel-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b16fd5704b976681c8db55a38f76be6ba66ec571b41cc624d49b7a3f3c05aaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in corporate-delegate-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 177836844dbb30a41ac458ca968707ca386ae3dce8f06fc76b0cc7b9285a6518 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...