Rhadamanthys: A New Evasive Information Stealer

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Rhadamanthys Evasive Infostealer is spread through phishing emails and prevalent Google ads that lead to fake download pages for popular workforce software...

Google releases Chrome 109 with a range of bug fixes

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Google Chrome 109 is being promoted to the stable channel for Windows, Mac, and Linux. It contains a number of bug fixes and improvements, including use after free in Overview Mode, a heap buffer...

Iranian APT’s new data extraction tool Hyperscrape

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Charming Kitten, an Iranian government-backed threat group, has been employing a new data extraction tool, HYPERSCAPE. It has been used to retrieve data from Microsoft Outlook, Yahoo, and Gmail accounts...

Iranian threat actor targets the Albanian government using ROADSWEEP ransomware

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary A cyberattack that took place in mid-July momentarily disrupted various Albanian government services and websites and was most likely the work of Iranian hackers. The attack used a new ransomware family called...

CISA Known Exploited Vulnerability Catalog June 2024

Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. It is recommended that all organizations review and monitor the KEV catalog, prioritize remediation of listed vulnerabilities, and reduce...

Patch Now Critical Auth Bypass Flaw in GitHub Enterprise Server Fixed

...

‘Operation FlightNight’ Targeting India with Deceptive Air Force Invitations

Summary: In a campaign dubbed Operation FlightNight, unidentified threat actors have focused on Indian government agencies and energy companies, aiming to deploy a modified variant of an open-source information stealer malware known as HackBrowserData. The threat actors have been observed...

Sysrv Harnessing Google Subdomains to Circulate XMRig

Summary: Sysrv, an advanced botnet, employs a Golang worm to infiltrate devices and distribute XMRig cryptocurrency miners, leveraging network vulnerabilities and undergoing constant evolution through operator refinement. Threat Level - Red | Attack Report For a detailed threat advisory, download...

APT29 Targets German Political Parties with New WINELOADER

Summary: APT29, linked to Russias SVR, targeted German political parties in late February 2024 using a new backdoor variant named WINELOADER, signaling a shift in operational focus beyond diplomatic missions. This marks a broader threat to European and Western political entities, driven by the SV...

Malware Leveraging Google OAuth for Persistent Account Access

Summary: Information-stealing malware is actively exploiting an undisclosed Google OAuth endpoint called MultiLogin. This technique was initially disclosed by a threat actor named PRISMA on their Telegram channel and has subsequently been integrated into various malware-as-a-service MaaS stealer...

Redefining the StripedFly Malware Framework

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary An intricate cross-platform malware framework, known as StripedFly, operated discreetly for five years, surreptitiously compromising over a million Windows and Linux systems. It skillfully evaded in-dept...

Unveiling Lu0Bot Malware A Node.js-Based Threat

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Lu0Bot Malware, a Node.js-based threat, surfaced in February 2021 as a secondary payload in GCleaner attacks. This malware acts as a bot, responding to C2 server commands and transmitting encrypted syste...

Attacks, Vulnerabilities and Actors 25 September to 1 October 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eight executed attacks, three instances of adversary activity, and four zero-day...

Daggerfly APT Deploys MgBot to Target African Telecoms Organization

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Daggerfly advanced persistent threat group has been observed using previously unseen plugins from the MgBot malware framework in a recent campaign. To receive real-time threat advisories, please foll...

FIN7 & Wizard Spider team up to disseminate Domino malware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary FIN7 threat actors and Wizard Spider collaborate to distribute Domino malware family in recent attacks. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...

Royal Ransomware Targets Organizations with Custom Encryption and Double Extortion Tactics

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary Since September 2022, threat actors have been attacking both US and international organizations using a version of ransomware called Royal. This ransomware is unique...

New Azov Ransomware can wipe 666 bytes data at a stretch

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The new Azov Ransomware can wipe 666 bytes of data at a time. The Azov wiper destroys victims data on purpose and infects other applications by dropping a fake pirated software...

What can you do about the critical vulnerability in OpenSSL 3.0

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary OpenSSL has a critical vulnerability that affects all the versions from 3.0 to 3.0.6. Due to the criticality of the vulnerability, OpenSSL has pre-announced the security update for security teams ...

Chile government’s Windows and Linux servers hit by RedAlert ransomware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Chilean Ministry of Interior asserted that RedAlert ransomware aka N13V attack had disrupted the operations and online services of a government agency in the country. In classic double-extortion...

Old Gatekeeper bypass vulnerability in macOS exploited

THREAT LEVEL: Amber For a detailed advisory, download the pdf file here A gatekeeper bypass vulnerability exists in macOS Big Sur and has been assigned CVE-2021-30853. An attacker can exploit this issue by using a specially-crafted script-based application downloaded from the Internet. This allow...

Microsoft’s May 2024 Patch Tuesday Addresses Two Zero-day Vulnerabilities

...

Malvertising Campaign Unleashes Nitrogen Malware Via Fake Installers

...

Hive Pro Announces Launch of Alliance Partner Program in North America for MSPs and VARs

Herndon, VA – 01 April 2024 – Hive Pro, a pioneer vendor in Threat Exposure Management, announced the formal launch of its North America Alliance Partner Program for Managed Service Providers MSP and Value-Added Resellers VARs. This initiative aims to empower Managed Service Providers MSPs and...

UNC5174 Functions as an Initial Access Broker, Exploiting Vulnerabilities

Summary: UNC5174, a threat actor believed to be associated with China, has been identified exploiting various vulnerabilities and deploying custom tools such as SNOWLIGHT, GOHEAVY, and GOREVERSE for post-exploitation activities. These tools enable UNC5174 to carry out sophisticated cyber...

Iranian Threat Actor Adapts Tactics to Stay One Step Ahead

Summary: Charming Kitten, an Iranian threat actor, has recently been linked to a series of attacks targeting the Middle East. This campaign involves deploying a new backdoor called BASICSTAR through a deceptive webinar portal. Threat Level - Red | Attack Report For a detailed threat advisory,...

Attacks, Vulnerabilities and Actors 27 November to 3 December 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, a total of eight attacks were executed, six vulnerabilities were uncovered, and two active adversaries were...

Multiple State-Sponsored Groups Exploit WinRAR Vulnerability in Phishing Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A series of phishing attacks linked to a Russian state-sponsored group, leveraging a WinRAR vulnerability to steal data, including browser credentials via PowerShell commands and exfiltrating it through ...

Microsoft’s October 2023 Patch Tuesday Addresses Three Zero-day Vulnerabilities

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary In the October Patch Tuesday release, Microsoft addressed 103 flaws, including three actively exploited zero-day vulnerabilities. These patches cover critical and important vulnerabilities, a...

CISA Known Exploited Vulnerability Catalog September 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included in the catalog, a vulnerability must meet three criteria: hav...

APT 33 Uses Password Spray Campaigns to Infiltrate Organizations

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary APT 33 aka Peach Sandstorm is an Iranian nation-state threat actor that was first identified in 2013. This group is notorious for conducting cyber espionage campaigns and has been associated with various...

Chinese Hacking Group ‘Flax Typhoon’ Targeting Taiwan Organizations

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Flax Typhoon, a Chinese nation-state actor, employs sophisticated tactics to target organizations in Taiwan for espionage, utilizing living-off-the-land techniques and legitimate tools to maintain long-te...

Turla Exploits Ukraine’s Defense Sector with DeliveryCheck Backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary DeliveryCheck, a .NET-based backdoor, targets Ukraines defense sector, attributed to Russian actor Turla; it aims to exfiltrate Signal app data. Notably, it breaches Microsoft Exchange servers using...

APT28’s Cyber Espionage Campaigns Targeting Ukraine

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The APT28 intrusion group, linked to the Russian GRU and renowned for its cyber espionage and sabotage endeavors, was observed employing various phishing methodologies to target the Ukrainian civic...

TA866 New Financially-Motivated Threat Actor Targeting US and Germany Organizations

Threat Level Actor Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary A new financially motivated threat actor named TA866 has been active since October 2022 and targets organizations in the United States and Germany. The attack chain...

NetSupport RAT employs phishing campaigns that incorporate Pokemon lures

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary NetSupport Manager is a remote control tool that can be used by ordinary or corporate users to remotely control systems, but it is being abused by threat actors as it allows external control over specifi...

APT40 deployed ScanBox malware to target the Australian government

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary APT 40 is a Chinese cyber espionage group, using phishing campaigns to target Australian government institutions and wind turbine operators in the South China Sea by directing selected individuals to a...

Zeppelin ransomware target organization in Europe and USA

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary Zeppelin, the newest member of the Delphi-based Vega ransomware family, has been quite clever in meticulously tailoring these ransomware operations. Zeppelin, first identified in 2019 as ransomware-as-a-service...

BlackCat Ransomware group attacks on the rise

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Blackcat Ransomware gang also known as ALPHV has targeted around 25 organizations belonging to multiple sectors globally since November 2021. The group has claimed responsibility for the recent cyber attack on Swissport...

The Shift from Vulnerability Management to Exposure Management

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Your vulnerability management program is optimized for the wrong war. You're counting patches whil...

D3Fack Loader: New Malware Exploits Google Ads and EV Certificates

...

Critical Rust Flaw Renders Windows Systems Vulnerable

...

CISA Known Exploited Vulnerability Catalog March 2024

Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. It is recommended that all organizations review and monitor the KEV catalog, prioritize remediation of listed vulnerabilities, and reduce...

Rhysida Ransomware’s Decryptor is Now in Action

Summary: The Rhysida ransomware-as-a-service RaaS group poses a significant global threat, targeting diverse sectors. Recently, an implementation vulnerability in the source code of the Rhysida ransomware has been discovered. By exploiting this vulnerability to reconstruct encryption keys, it...

The Rise of NetSupport RAT Recent Infections and Sector Impact

Summary: Threat actors exploit NetSupport Manager into a Remote Access Trojan RAT, leading to a recent surge in infections across multiple sectors. The evolving attack chain involves deceptive website downloads, JavaScript payloads, and PowerShell commands, emphasizing the need for vigilant...

TA402’s Covert Operation Takes Aim at the Middle East

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary TA402 aka Extreme Jackal launched sophisticated phishing campaigns targeting government entities in the Middle East. The objective was to deploy a newly developed initial access downloader called IronWin...

Deciphering Mirai’s Next Chapter: the Strategies of the Latest Players

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The realm of cybersecurity witnessed the rise of formidable botnet variants stemming from the notorious Mirai source code. Prominent among them are hailBot, kiraiBot, and catDDoS, showcasing heightened...

New KamiKakaBot Malware Targeting Government Entities in ASEAN Countries

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The new KamiKakaBot malware has been discovered targeting government entities in ASEAN countries, with the Dark Pink APT group believed to be behind the campaign...

Linux flaws could be chained together to achieve root access

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Two vulnerabilities CVE-2022-41974 and CVE-2022-41973 can either be exploited individually or in combination to lead to local privilege escalation, the first potentially causing a symlink attack a...

Lazarus neutralizes antivirus software using BYOVD technique

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The Lazarus group exploits known vulnerabilities within Dream Securitys MagicLine4NX and INITECH INISAFE CrossWEB EX V3 by utilizing Bring Your Own Vulnerable Driver BYOVD technique to neutralize an...

CISO Guide: Building a Business Case for CTEM

Every CISO knows the frustration: you understand the exposure risk facing your organization, you know that a Continuous Threat Exposure Management program would fundamentally change your security posture, and yet, when budget season arrives, CTEM is one of the first line items questioned. Ready t...