Design/Logic Flaw

Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series CLIP STUDIO PAINT for Windows EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION for Windows Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER for Windows Ver.1.6.3 and...

CVE-2018-0580

Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series CLIP STUDIO PAINT for Windows EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION for Windows Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER for Windows Ver.1.6.3 and...

A Deep Dive Into RIG Exploit Kit Delivering Grobios Trojan

As discussed in previous blogs, exploit kit activity has been on the decline since the latter half of 2016. However, we do still periodically observe significant developments in this space, and we have been observing interesting ongoing activity involving RIG Exploit Kit EK. Although the volume o...

Vega Stealer Malware Takes Aim at Chrome, Firefox

A malware dubbed Vega Stealer has been uncovered, looking to make off with saved credentials and credit-card information in the Chrome and Firefox browsers. While it’s a simple payload for now, researchers said it has the ability to evolve into something more concerning in the future. Proofpoint,...

Panda Banking Trojan Diversifies into Cryptocurrency, Porn, Other Targets

The Panda banking trojan, a spin-off from the infamous Zeus malware, is widening its net to attack more than just financial services targets, as seen in three ongoing campaigns discovered in May. The Windows-focused Panda is far from the cuddly thing its name would suggest. It has a full arsenal ...

SynAck targeted ransomware uses the Doppelgänging technique

The Process Doppelgänging technique was first presented in December 2017 at the BlackHat conference. Since the presentation several threat actors have started using this sophisticated technique in an attempt to bypass modern security solutions. In April 2018, we spotted the first ransomware...

UCMS 1.4.5 File Upload Vulnerability

UCMS is a simple open source content management system. A file upload vulnerability exists in UCMS 1.4.5. An attacker can exploit the vulnerability to directly upload a script Trojan file to obtain a webshell...

Updated GravityRAT Malware Adds Advanced AV Detection

Researchers tracking the evolution of the remote access trojan GravityRAT warn that developers behind the malware have made key changes to the RAT’s code in an attempt to decrease antivirus detection. “We’ve seen file exfiltration, remote command execution capability and anti-vm techniques added...

Arbitrary file editing vulnerability in niubicms v1.8

Cow CMS is a free version of the local portal PHP source code system. Includes: news, real estate, talent, automotive, local business station three-level domain name station, merchant business cards and other functions. niubicms v1.8 version of the existence of arbitrary file editing vulnerabilit...

Threat Roundup for April 20-27

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 20 and 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

Sea Lotus APT groups use CVE-2017-8570 vulnerability of the new sample and Association analysis-vulnerability warning-the black bar safety net

Sea Lotus（OceanLotus）APT gang is a highly organized, professional foreign national hacker group, the oldest by 360 days eye Labs discovered and disclosed. The organization since at least 2012 and 4 January will be for the Chinese government, research institutes, Maritime institutions, Maritime...

Orangeworm Kwampirs Trojan Detection

The script tries to detect the Orangeworm Kwampirs Trojan via various known Indicators of Compromise IOC. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Orangeworm Targeting Healthcare Industry since 2015 Now Exposed

Operating since 2015, a threat group dubbed Orangeworm has been newly attributed to hacking and infiltrating healthcare groups around the world. Companies specifically targeted include hospitals, healthcare providers, pharmaceuticals, IT services firms serving the healthcare industry, and more...

Metamorfo Campaigns Targeting Brazilian Users

FireEye Labs recently identified several widespread malspam malware spam campaigns targeting Brazilian companies with the goal of delivering banking Trojans. We are referring to these campaigns as Metamorfo. Across the stages of these campaigns, we have observed the use of several tactics and...

Metamorfo Campaigns Targeting Brazilian Users

FireEye Labs recently identified several widespread malspam malware spam campaigns targeting Brazilian companies with the goal of delivering banking Trojans. We are referring to these campaigns as Metamorfo. Across the stages of these campaigns, we have observed the use of several tactics and...

Hackers Behind Healthcare Espionage Infect X-Ray and MRI Machines

Security researchers have uncovered a new hacking group that is aggressively targeting healthcare organizations and related sectors across the globe to conduct corporate espionage. Dubbed "Orangeworm," the hacking group has been found installing a wormable trojan on machines hosting software used...

ucms v1.4.5 Arbitrary File Editing Vulnerability

UCMS is a simple open source content management system. ucms v1.4.5 version of the existence of arbitrary file editing vulnerability, the attacker can edit any script file, directly write a sentence Trojan horse, to obtain control of the web server...

CVE-2018-0562

Untrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-0562

Untrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-0561

Untrusted search path vulnerability in The installer of PhishWall Client Internet Explorer edition Ver. 3.7.15 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...