Careto is back: what’s new after 10 years of silence?

During the first week of October, Kaspersky took part in the 34th Virus Bulletin International Conference, one of the longest-running cybersecurity events. There, our researchers delivered multiple presentations, and one of our talks focused on newly observed activities by the Careto threat actor...

CVE-2024-12553

creationtimestamp| type| source ---|---|--- 2024-12-12 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1682/ 2024-12-14 00:58:32+00:00| seen| https://t.me/cvedetector/12905...

CVE-2024-54500

creationtimestamp| type| source ---|---|--- 2024-12-12 00:14:10+00:00| seen| https://infosec.exchange/users/cve/statuses/113636963130468376 2024-12-12 06:24:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/113638417612658147 2025-03-18 04:00:00+00:00| seen|...

CVE-2024-54501

creationtimestamp| type| source ---|---|--- 2024-12-12 00:14:10+00:00| seen| https://infosec.exchange/users/cve/statuses/113636963145001217 2025-03-18 04:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-170/...

CVE-2024-54486

creationtimestamp| type| source ---|---|--- 2024-12-11 23:59:09+00:00| seen| https://infosec.exchange/users/cve/statuses/113636904055458729 2025-03-18 04:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-166/...

Modular Java Backdoor Dropped in Cleo Exploitation Campaign

Many thanks to Rapid7 MDR and incident response teams for their contributions to this analysis. While investigating incidents related to Cleo software exploitation, Rapid7 Labs and MDR observed a novel, multi-stage attack that deploys an encoded Java Archive JAR payload. Our investigation reveale...

U.S. Charges Chinese Hacker for Exploiting Zero-Day in 81,000 Sophos Firewalls

The U.S. government on Tuesday unsealed charges against a Chinese national for allegedly breaking into thousands of Sophos firewall devices globally in 2020. Guan Tianfeng aka gbigmao and gxiaomao, who is said to have worked at Sichuan Silence Information Technology Company, Limited, has been...

CVE-2024-12550

creationtimestamp| type| source ---|---|--- 2024-12-11 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1678/ 2025-02-11 20:16:05+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwhzcxzde2a 2025-02-20 23:26:55+00:00| seen|...

CVE-2024-12548

creationtimestamp| type| source ---|---|--- 2024-12-11 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1680/ 2025-02-11 20:15:59+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwhz5vmwk2c...

CVE-2024-11949

creationtimestamp| type| source ---|---|--- 2024-12-11 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1672/ 2024-12-11 21:58:36+00:00| seen| https://infosec.exchange/users/cve/statuses/113636430016828724 2024-12-12 02:56:45+00:00| seen| https://t.me/cvedetector/12664...

CVE-2024-12549

creationtimestamp| type| source ---|---|--- 2024-12-11 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1679/ 2025-02-11 20:16:02+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwhzaf5ug2a...

Patch Tuesday, December 2024 Edition

Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common Log File System...

Patch Tuesday - December 2024

Microsoft is addressing 70 vulnerabilities this December 2024 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation and public disclosure for one of the vulnerabilities published today, and this is reflected in a CISA KEV entry. For the third month in a row, Microsoft has published...

Patch Tuesday - December 2024

Microsoft is addressing 70 vulnerabilities this December 2024 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation and public disclosure for one of the vulnerabilities published today, and this is reflected in a CISA KEV entry. For the third month in a row, Microsoft has published...

CVE-2024-49082

creationtimestamp| type| source ---|---|--- 2024-12-10 17:33:56+00:00| seen| https://www.thezdi.com/blog/2024/12/10/the-december-2024-security-update-review 2024-12-10 19:07:30+00:00| seen| https://infosec.exchange/users/cve/statuses/113630094912090814 2024-12-11 05:00:00+00:00| seen|...

CVE-2024-49069

creationtimestamp| type| source ---|---|--- 2024-12-10 17:33:56+00:00| seen| https://www.thezdi.com/blog/2024/12/10/the-december-2024-security-update-review 2025-01-08 05:38:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/650 2025-09-16 23:16:38+00:00| seen|...

Ongoing Phishing and Malware Campaigns in December 2024

Cyber attackers never stop inventing new ways to compromise their targets. That's why organizations must stay updated on the latest threats. Here's a quick rundown of the current malware and phishing attacks you need to know about to safeguard your infrastructure before they reach you. Zero-day...

Critical Windows Zero-Day Alert: No Patch Available Yet for Users

Protect your systems with automated patching and server hardening strategies to defend against vulnerabilities like the NTLM zero-day.…...

CVE-2024-11158

creationtimestamp| type| source ---|---|--- 2024-12-05 17:44:45+00:00| seen| https://infosec.exchange/users/cve/statuses/113601457861462098 2024-12-05 20:22:53+00:00| seen| https://t.me/cvedetector/12130 2024-12-10 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1650/...

CVE-2024-11872

creationtimestamp| type| source ---|---|--- 2024-12-04 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1646/ 2024-12-11 21:58:35+00:00| seen| https://infosec.exchange/users/cve/statuses/113636429972354770 2024-12-12 02:56:47+00:00| seen| https://t.me/cvedetector/12666...