1589 matches found
ProxyShellMiner Exploits Windows Exchange Server Vulnerabilities for Cryptocurrency Mining
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ProxyShellMiner exploits Windows Exchange servers vulnerabilities, which are used to gain unauthorized access and compromise an organization, leading to the installation of cryptocurrency miners...
New Ransomware Campaign “TZW” Linked to GlobeImposter Targets South Korean Organizations
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new ransomware campaign called TZW is affecting organizations in South Korea. The campaign is linked to the known malware family GlobeImposter, suggesting that the actors behind GlobeImposter are...
Actors, Threats and Vulnerabilities 30 January to 5 February 2023
For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Hive Pro discovered four actors that have been active in the past week. The first, Sandworm Team, is a well-known Russian threat actor known for Sabotage and destruction. The...
Microsoft addresses one actively exploited zero-day and numerous critical vulnerabilities
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Microsoft released a patch on January 2023s Patch Tuesday addressing 98 vulnerabilities, of which 11 are considered critical. The patch includes fixes for a range of vulnerabilities including 39...
Gamaredon APT cyber feud strikes Ukrainian entities
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary One of the most ubiquitous, intrusive, consistently active, and laser-focused APTs targeting Ukraine in cyberspace is the Gamaredon group, also known as the Shuckworm. Gamaredon Group has employed fast...
Ransomware Black Basta uses tools related to FIN7
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Black Basta is deploying a ransomware payload by exploiting Microsoft flaws and using an Endpoint Detection and ResponseEDR defense evasion tool created by FIN7. Black Basta is a relatively new ransomwar...
Unknown Iranian attackers leverage vulnerabilities to conduct ransom operations
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Iranian government-sponsored actors carry out malicious cyber activities against a wide range of people and entities in the United States, Australia, Canada, and the United Kingdom by using known...
Worok cyber-espionage gang preys on high-profile Asian businesses and governments
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Worok, a newly uncovered cyber-espionage gang, has been targeting governments and high-profile companies in Asia since at least 2020 using a combination of unique and existing harmful tools. This group of...
Vice Society actors target K-12 institutions in US
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Vice Society is an extortion hacking group that emerged in the summer of 2021. The Vice Society does not use a specific ransomware variant. Instead, they used variants of Hello Kitty, Five Hands, and...
Multiple vulnerabilities addressed by Google with Chrome 105
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Google Chrome addresses multiple vulnerabilities in its latest stable channel update for Windows, Mac, and Linux...
APT29 utilizes cloud storage service to deliver malicious payloads
Threat Level Actor Report For a detailed advisory, download the pdf file here Summary APT29, a cyber espionage gang uses cloud storage services such as Google Drive and Dropbox to distribute malware to compromised systems. The gang used a phishing campaign that targeted several Western diplomatic...
Iranian APT targets Middle East’s Energy & Telecommunications industry
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary A new campaign has been launched by a state-sponsored Iranian APT group, Lyceum to target organizations from the Middle East in the energy and telecommunication sectors. They have been observed deploying a new...
Deserialization of untrusted data by Fastjson library leads to RCE
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Applications using the Fastjson java library are impacted by remote code execution vulnerability...
RedLine InfoStealer exploits Google Chrome’s zero-day
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Summary The notorious information-gathering malware RedLine InfoStealer is stealing data from individuals and organizations such as Samsung, Zoom, Cisco, Vodafone, Jio, and Axis Bank by exploiting a two-month-old zero-day...
DarkHotel APT group targeting the Hospitality Industry in China
...
UNC2596 exploits Microsoft’s ProxyShell and ProxyLogon vulnerabilities to distribute Cuba Ransomware
...
Google Chrome affected by high severity vulnerabilities
THREAT LEVEL: Green. For a detailed advisory, download the pdf file here Google has released Chrome 98 as a stable channel for Windows, Mac, and Linux. This update addresses 19 security vulnerabilities. Eight of them are rated severity high, ten of them are medium and one of them is of severity...
APT27 group uses the HyperBro remote access trojan to inject backdoors into victim’s network
...
Top Cybersecurity Frameworks Compared
Top Cybersecurity Frameworks Compared: NIST, CIS, and MITRE ATT&CK Security leaders do not need another framework for the sake of paperwork. They need a practical way to decide which cybersecurity frameworks help the business govern risk, harden defenses, and validate whether controls can withsta...
Patch Now Critical Auth Bypass Flaw in GitHub Enterprise Server Fixed
...
QNAP Flaws Enable Remote Code Execution Under Certain Conditions
...
Trinity Ransomware Strikes with the Dual Extortion Strategy
...
APT42’s Operations Employ “Nicecurl” and “Tamecat” Malwares
...
Active Targeting of WP-Automatic Plugin Flaw Raises Concerns for Site Takeover
...
FIN7 Takes Aim at the U.S. Auto Industry
...
TA547 Malware Campaign Hits German Businesses
...
Attacks, Vulnerabilities and Actors 11 to 17 March 2024
For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, HiveForce Labs discovered eight executed attacks, uncovered ten vulnerabilities, and identified two active...
TA577 Targeting Windows NTLM Hashes in Global Campaigns
Summary: TA577, a significant cyber threat group, has shifted tactics to steal NTLM authentication data, utilizing thread hijacking and customized HTML attachments. Organizations should block outbound SMB to thwart exploitation and remain vigilant against evolving attack methods. Threat Level - R...
Iranian hackers soar into the defense sectors of the Middle East
Summary: Since June 2022, the hacking group UNC1549, potentially connected to Tortoiseshell aka Imperial Kitten and linked with the Iranian IRGC, has implemented distinct backdoors known as MiniBike and MiniBus. Their primary focus lies in targeting defense-related entities in the Middle East...
Unmasking Doppelgänger: Russia’s Disinformation Campaign Revealed
Summary: Doppelgänger, a suspected Russia-aligned influence operation network targeting German audiences with propaganda and disinformation, potentially aiming to sway opinions ahead of elections. Doppelgänger employs coordinated social media activities and a dynamic infrastructure to maximize it...
Coyote: A Sophisticated Banking Trojan Targeting Financial Information
Summary: A new banking trojan called Coyote is currently targeting more than 60 banking institutions, primarily in Brazil. The malware distributes itself using the Squirrel installer and executes its infection process using Node.js and Nim, a relatively new multi-platform programming language...
Ukraine Hit by Cyber Attack 2,000+ Computers Infected by DIRTYMOE
Summary: The UAC-0027 group executed a sophisticated cyber attack against Ukrainian organizations. Their weapon of choice was the notorious DIRTYMOE PURPLEFOX malware. This modular malware has been active for over half a decade and poses a serious threat. Threat Level - Amber | Attack Report For ...
Kasseika Ransomware Employs BYOVD Tactic to Impair Defenses
Summary: The ransomware operation Kasseika has recently been identified using the Bring Your Own Vulnerable Driver BYOVD tactic. This involves exploiting vulnerabilities in a loaded driver to disable antivirus software before initiating the file encryption process. Through this strategy, the...
Maliciously Crafted Cracked Software Propagates Lumma Stealer via YouTube
Summary: In an attempt to deceive users into downloading the information-stealing virus Lumma, threat actors are exploiting YouTube videos featuring content related to cracked software. These videos typically include content related to the use of cracked software, accompanied by identical...
Unveiling the Sea Turtle Cyber Espionage Campaign
Summary: Sea Turtle, a Turkey-based Advanced Persistent Threat APT actor, has been active since 2017. The group has primarily targeted European and Middle Eastern organizations, focusing on information theft and DNS hijacking to compromise repositories with valuable and sensitive data. In a recen...
Anonymous Arabic Hacktivist Group Orchestrating Silver RAT
Summary: Silver RAT, a Windows-based RAT written in C and developed by a group known as "Anonymous Arabic," exhibits advanced capabilities, including antivirus evasion and ransomware encryption. Despite facing bans, the threat actors dynamic activities persist, featuring the sharing of cracked...
MetaStealer a $125 Ticket to Digital Chaos
Summary: MetaStealer, a nefarious information-stealing malware, initially surfaced in discreet online marketplaces with a pricing structure of USD 125 per month or USD 1000 for an unlimited subscription, subsequently becoming entangled in malvertising campaigns. Threat Level - Red | Attack Report...
Muddywater Utilizes Custom Tools to Target Telecom Companies
Summary: Iranian espionage group Muddywater,targeted telecommunications companies in Egypt, Sudan, and Tanzania in November 2023. The attackers employed a diverse set of tools for this activity, including leveraging the MuddyC2Go infrastructure. Additionally, they utilized the SimpleHelp remote...
The Kuiper Ransomware Surge and Its Dark Origins
Summary: In a predominantly Russian Dark Web forum, a sophisticated ransomware-as-a-service RaaS project named "KUIPER" was introduced. The Kuiper ransomware, developed in Golang, is compatible with Windows, Linux, and OSX systems, and is associated with a suspected intrusion at a government...
Decoding MrAnon Stealer’s Plot through Deceptive Emails
Summary: A phishing email campaign employs misleading booking details to lure victims, aiming to deploy a Python-based information stealer known as MrAnon Stealer. This malicious software is designed to pilfer victims credentials, system details, browser sessions, and cryptocurrency extensions...
A New Face of AsyncRAT Utilizes WSF Scripts to Spread
Summary: AsyncRAT is a remote access trojan RAT malware known for stealing credentials and executing various malicious activities since 2019. Its recent variant, distributed through WSF script files, employs sophisticated fileless techniques, emphasizing the importance of user caution and robust...
DanaBot Stealer: Multistage MaaS Malware Resurfaces
Summary: DanaBot is a covert malware designed for the discreet theft of sensitive data for financial gain. Unlike ransomware, its focus is on prolonged persistence rather than immediate disruption. Functioning as a malware-as-a-service MaaS platform, DanaBot is versatile, targeting individuals,...
Cactus Ransomware Exploits Vulnerabilities in Qlik Sense
Summary: The Cactus ransomware is actively exploiting critical Qlik Sense vulnerabilities, with the ultimate goal of establishing persistence and enabling remote control, infiltrating corporate networks stealthily. This serves as a stark reminder that unpatched Qlik Sense instances are prime...
Gamaredon Deploys LitterDrifter USB Worm in Cyber Espionage Operations
Summary: Russian cyber espionage group Gamaredon aka Primitive Bear has been observed utilizing a USB-propagating worm known as LitterDrifter in attacks targeting Ukrainian entities. This group has recently adopted LitterDrifter, a worm written in VBS, designed to spread through removable USB...
Mastering Threat Exposure with Uni5 Xposure
...
ShellBot Malware Evades Detection Using Hexadecimal IP Addresses
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ShellBot malware, targeting poorly managed Linux SSH servers, now employs hexadecimal IP addresses in its download URLs to evade detection. This change highlights the need for strong security measures an...
Grayling APT Emerges as a Silent Threat Targeting Taiwan
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The Grayling APT group orchestrated a meticulously planned targeting campaign with a primary emphasis on espionage. Grayling set its sights on a government entity in the Asia-Pacific region, along with...
Cybercriminals Target Graphic Designers with Cryptojacking Malware
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Cybercriminals are taking advantage of a legitimate Windows tool known as Advanced Installer to compromise the computers of graphic designers with cryptocurrency mining malware. These scripts are designe...
Carderbee APT Strikes Hong Kong with Supply Chain Attack
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Carderbee advanced persistent threat APT group executed a supply chain attack by exploiting the legitimate Cobra DocGuard software. Their objective was to deploy the PlugX backdoor onto targeted...
Microsoft’s July 2023 Patch Tuesday Addresses 5 Zero-day Vulnerabilities
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Microsofts July 2023 Patch Tuesday includes security updates for 130 flaws, including five actively exploited zero-day vulnerabilities, nine are rated as Critical’, and 37 remote code execution...