1589 matches found
TimbreStealer Focuses On Mexico With Social Engineering
Summary: Since at least November 2023, there has been a persistent phishing spam campaign targeting potential victims in Mexico. The campaign entices users to download TimbreStealer, a new information stealer that has been disguised. This campaign use financial-themed phishing emails to lure...
Roundcube Webmail Faces Unrelenting Exploitation
Summary: The Roundcube email server vulnerability, identified as CVE-2023-43770 and previously mitigated in September 2023, is currently being actively exploited. This flaw enables attackers to gain access to restricted information, with potential repercussions including sensitive data theft, use...
PikaBot Malware Unleashes Threat via Malvertising
Summary: PikaBot, a recently identified malware family, has become a prominent threat in malvertising campaigns, particularly through search engine ads. Associated with the TA577 threat actor and linked to ransomware distribution, PikaBot employs advanced tactics, such as decoy websites and...
Mirai Botnet’s Offspring InfectedSlurs Exploits Dual Zero-Days
Summary: A new Mirai-based malware botnet, InfectedSlurs, is actively conducting a sophisticated campaign by exploiting two zero-day remote code execution RCE vulnerabilities in routers and video recorder NVR devices. These vulnerabilities, currently being exploited in the wild, facilitate the...
Attacks, Vulnerabilities and Actors 11 September to 17 September 2023
For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries related to cybersecurity threats. Over the past week, a total of eight attacks were executed, along with eleven vulnerabilities discovered, and two different adversaries...
Unveiling Cadet Blizzard APT’s Wiper Attacks Targeting Ukraine
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Cadet Blizzard, a Russian GRU-sponsored threat group, conducted major cyber operations using WhisperGate, a customized wiper malware, to demonstrate their destructive capabilities through targeted attack...
The Emergence of 1877 Team and Rising Hacktivist Threat
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The 1877 Team is a hacktivist collective founded by a small group of Iraqi Kurds in July 2021. The 1877 Team has claimed responsibility for a range of cyber attacks on national governments, universities,...
Charming Kitten Hackers Utilize New Tactics with BellaCiao Malware
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Iranian APT group, Charming Kitten, is using a new, sophisticated malware called BellaCiao to target specific victims in multiple regions, employing unique communication tactics with its...
New Zaraza Bot Malware Steals Login Credentials from 38 Web Browsers via Telegram
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new credential-stealing malware named Zaraza bot uses Telegram as its command and control, targeting 38 web browsers and exfiltrating sensitive data for potential identity theft and financial fraud. To...
Nation-State Actors MERCURY and Partner DEV-1084 Carry Out Destructive Attack
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MERCURY, a nation-state actor linked to the Iranian government, worked with another actor, DEV-1084, to carry out a destructive attack. To receive real-time threat advisories, please follow HiveForce Lab...
A New Rorschach Ransomware Threat Employing Hybrid-Cryptography
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Rorschach is a new and highly effective ransomware that uses a hybrid-cryptography scheme and fast thread scheduling via I/O completion ports. To receive real-time threat advisories, please follow...
AgentTesla Trojan Returns with Phishing Campaigns Using GuLoader to Steal Secrets
Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The AgentTesla Trojan continues to pose a threat as attackers use GuLoader to deliver it in new phishing campaigns targeting various industries and countries...
Actors, Threats and Vulnerabilities 13 February to 19 February 2023
For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here HiveForce Labs identified seven active actors over the past week. There were three prominent Russian actors, namely TA505, Nodaria, and KillNet. Additionally, three Chinese...
Infection and Evolution of the GOOTLOADER Malware
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary GOOTLOADER malware infects via malicious archive download, executing JavaScript and PowerShell, delivering FONELAUNCH, Cobalt Strike BEACON/SNOWCONE, with the latest variant writing JavaScript to disk an...
Kinsing malware continues to exploit these two-year-old vulnerabilities
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Malicious actors are exploiting these two-year-old remote code execution vulnerabilities in Oracle WebLogic Server to deploy Kinsing malware...
Lazarus distributes Nukesped to VMware Horizon Servers by exploiting Log4J
Threat Level Actor Report For a detailed advisory, download the pdf file here Summary Lazarus, a North Korean threat actor group, is deploying Nukesped aka Manuscrypt malware on unpatched VMware Horizon servers by exploiting the Log4J remote code execution vulnerability...
Threat Campaign by Molerats uses NimbleMamba Malware to target Middle East
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here An APT group Molerats associated with Gaza has launched a new threat campaign using a malware NimbleMamba aimed at Middle Eastern governments, foreign policy think tanks, and even a state-owned airline. The current attack was...
MoonBounce: New malware deployed by APT41 in UEFI firmware
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. MoonBounce is a new type of malware that hides in the most complex part of an Operating System OS, the Basic Input Output System BIOS chip, and thus persists even after reinstalling your OS or formatting your hard drive...
Vulnerability Assessment vs Penetration Testing: What Security Leaders Need to Know
Your organization runs quarterly vulnerability scans. You get a report with hundreds, sometimes thousands, of findings. Your team patches what they can and moves on. Six months later, you bring in a penetration testing firm, and they walk right through your defenses using a chain of...
F5 BIG-IP Exploited in Three-Year Espionage Campaign by Velvet Ant
...
LLMjacking: An Attack Method for Stealing Cloud Credentials
...
The Enigmatic ‘Muddling Meerkat’ Poses a Nation-State DNS Puzzle
...
Active Targeting of WP-Automatic Plugin Flaw Raises Concerns for Site Takeover
...
Ivanti Addresses Flaws Leading to DoS Attacks and Code Execution
...
Windows SmartScreen Exploit Paves the Way for Phemedrone Stealer
Summary: The Phemedrone stealer malware campaign exploits a vulnerability in Microsoft Defender SmartScreen. Phemedrone, an open-source information-stealing malware written in C, is designed to extract data from web browsers, and cryptocurrency wallets. Threat Level - Red | Attack Report For a...
Decoding UAC-0050’s Cyber Espionage Playbook
Summary: UAC-0050, a threat actor focused on Ukraine, is using new tactics to spread the Remcos RAT. In their latest move, UAC-0050 shows advanced adaptability by cleverly avoiding detection through a hidden data transfer method and outsmarting EDR systems. Threat Level - Amber | Attack Report Fo...
Nim Backdoor Masquerades as Nepal Government Security
Summary: Attackers employed malicious Microsoft Word documents disguised as official communications from the Nepali government. These documents aimed to trick victims into downloading and executing a backdoor program written in the Nim programming language. As Nim is an uncommon language, it pose...
GhostSec Pioneering the Hacktivist Front with GhostLocker
Summary: GhostSec, a hacktivist coalition stemming from the Anonymous group and part of The Five Families, has introduced GhostLocker, an advanced Ransomware-as-a-Service RaaS framework. Threat Level - RED | Attack Report For a detailed threat advisory, download the pdf file here To receive...
Kimsuky Unveils New Addition to Its Malware Arsenal
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Kimsuky, a cyber-espionage group, is known for infiltrating via spear-phishing attacks, and is recognized for its versatility in using various types of malware and tools to facilitate remote control durin...
Hive Pro’s Take on Gartner’s Top Cybersecurity Trends 2023
In this video, Anand Choudha, CEO at Hive Pro, and Jeelan Poola, CPO at Hive Pro, introduce the HivePro Uni5 Threat Exposure Management Platform. HivePro Uni...
Charming Kitten’s Latest Malware Arsenal and Targeting Strategies
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Charming Kitten, an adaptable threat actor, has shifted to new malware tactics and targets by employing LNK infection chains and utilizing cloud hosting providers. This evolution in their approach poses ...
Surge in 8Base Ransomware Group Activity
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary 8Base Ransomware group define themselves as “honest and simple pentesters”, have spiked their activities recently and was observed to be within the top 2 performing ransom groups. To receive real-time...
PindOS malware deploying Bumblebee and IcedID
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary PindOS, new JavaScript dropper has been spotted in the wild. It is specifically engineered to deliver next-stage payloads and is currently deploying infamous malwares like deploying Bumblebee and IcedID...
SideCopy Resurfaces to Target Indian Defense
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary SideCopys recent campaign utilizes SILENTTRINITY and targets the Indian defense industry, warranting attention from SideCopy threat actors. To receive real-time threat advisories, please follow HiveForce...
New HinataBot Go-Based Botnet with DDoS Capabilities and Mirai Connection
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary HinataBot is a newly discovered Go-based botnet that spreads through old vulnerabilities and weak credentials. It carries out DDoS flooding attacks and has a connection with the Mirai malware family. To...
HookSpoofer A Novel Infostealer with Advanced Capabilities
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary North Korea-linked hacking group Reaper has recently been observed engaging in surveillance of North Korean defectors. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...
Actors, Threats and Vulnerabilities 27 February to 5 March 2023
For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here HiveForce Labs discovered six actors that have been active in the past week. TA866, APT-C-61, and DEV-0569 are cybercrime groups that focus on Financial gain. The other three...
Actors, Threats and Vulnerabilities 6 February to 12 February 2023
For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Hive Pro identified three active actors over the past week. The first, OilRig, is a well-known threat actor known for its information theft and espionage activities. The secon...
A new EmojiDeploy attack has been found in an Azure service
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The EmojiDeploy attack chain allows a threat actor to run arbitrary code, steal or delete sensitive data, and compromise a targeted application on Azure by exploiting a remote code execution vulnerabilit...
Information Stealer LummaC2 Targets Browsers and Crypto Wallets
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary LummaC2 Stealer is an information stealer that targets Chromium and Mozilla-based browsers. It is designed to steal sensitive information from a victims machine, including crypto wallets, extensions, and...
Ransomware Black Basta uses tools related to FIN7
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Black Basta is deploying a ransomware payload by exploiting Microsoft flaws and using an Endpoint Detection and ResponseEDR defense evasion tool created by FIN7. Black Basta is a relatively new ransomwar...
Evilnum strikes commodities and cryptocurrency Forum
Threat Level Actor Report For a detailed advisory, download the pdf file here Summary In recent campaigns, the Evilnum actor group has targeted the Decentralized Finance DeFi sector using Evilnum Malware. The latest iteration of Evilnum backdoor employs a diverse set of ISO, Microsoft Word, and...
RedLine InfoStealer exploits Google Chrome’s zero-day
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Summary The notorious information-gathering malware RedLine InfoStealer is stealing data from individuals and organizations such as Samsung, Zoom, Cisco, Vodafone, Jio, and Axis Bank by exploiting a two-month-old zero-day...
Hive Pro Named ‘Startup of the Year – Security Software’ in the Globee Awards 18th Annual Cyber Security Global Excellence Awards®
Milpitas, California, March 28 - Hive Pro announced today that The Globee® Awards, organizers of world’s premier business awards programs and business ranking lists, has named Hive Pro a winner in the 18th Annual 2022 Cyber Security Global Excellence Awards®. These prestigious global awards...
CISO Guide: Building a Business Case for CTEM
Every CISO knows the frustration: you understand the exposure risk facing your organization, you know that a Continuous Threat Exposure Management program would fundamentally change your security posture, and yet, when budget season arrives, CTEM is one of the first line items questioned. Ready t...
Cybersecurity Metrics Every CISO Should Report to the Board
Cybersecurity Metrics Every CISO Should Report to the Board After twenty years of leading security teams and presenting to boards at companies like Tripwire and RiskIQ, I can tell you this: the metrics that matter to your SOC team are not the metrics that matter in the boardroom. Boards do not wa...
7 Best Vulnerability Management Tools Compared
Let's be direct: if your team is drowning in a sea of CVEs and struggling to decide what to patch first, you're not alone. The sheer volume of vulnerabilities can feel overwhelming, leaving even the most skilled security teams stuck in a reactive cycle of chasing alerts. This is where modern...
CLOUD#REVERSER: From Cloud Storage to Command and Control
...