1589 matches found
XZ Utils Backdoored, A Supply Chain Nightmare
Summary: Multiple Linux distributions face a potential supply chain threat due to the introduction of malicious code into a widely-used library. A backdoor was discovered within the XZ Utils library, inserted roughly a month ago. This compromise allows attackers to manipulate and intercept data...
Unveiling AcidPour Evolution of Destructive Malware Targeting Ukraine
Summary: AcidPour, a variant of the destructive AcidRain wiper malware previously used during the Russia-Ukraine conflict, signals a heightened threat to Ukraines critical infrastructure. By targeting Linux UBI and DM logic, AcidPour poses a significant risk to large storage devices and RAID...
Mint Sandstorm’s Campaign Targets Researchers with Novel Backdoor
Summary: Mint Sandstorm, a threat actor, focuses on high-profile individuals involved in Middle Eastern affairs at universities and research organizations. The group utilizes phishing lures in a campaign to socially engineer targets, enticing them to download malicious files that deploy new...
North Korean APT’s Covert Supply-Chain Ambush
Summary: There has been a significant increase in software supply chain attacks orchestrated by North Korean hackers. Notably, the MagicLine4NX and 3CX compromises gained attention, with the Lazarus hacking group employing a sophisticated approach. They leverage a zero-day vulnerability in the...
CVSS 4.0 Decoded: Understanding & Implementing Changes
What is CVSS? The Common Vulnerability Scoring System CVSS is a vendor-agnostic, industry-open standard owned and maintained by The Forum of Incident Response and Security Teams FIRST. CVSS “provides a way to capture the principal characteristics of a vulnerability and produce a numerical score...
Prolonged Pursuit of OilRig APT Targeting Middle East Government
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Iran-affiliated threat actor known as OilRig orchestrated a sophisticated eight-month campaign directed at the Middle East government, during which the attackers managed to steal sensitive files and...
Unraveling the Intricate Arsenal of Stayin’ Alive Campaign
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In the October Patch Tuesday release, Microsoft addressed 103 flaws, including three actively exploited zero-day vulnerabilities. These patches cover critical and important vulnerabilities, a Chromium fi...
3AM Ransomware: LockBit’s Failed Standoff Revealed
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new ransomware variant, self-dubbed 3AM has arisen as a result of a rogue attack conducted by a ransomware affiliate. Initially, this affiliate attempted to install the LockBit ransomware on a targets...
Critical Remote Code Execution Vulnerabilities Discovered in ASUS Routers
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Three critical-severity remote code execution vulnerabilities have been identified in ASUS routers. These vulnerabilities have the potential to allow threat actors to take control of these devices...
New Variant of Chaes Malware ‘Chae$ 4’ Targeting Financial and Logistics Sectors
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new Chaes malware variant, "Chae$ 4," targeting logistics, finance, and prominent platforms has emerged with enhanced capabilities, including Python-based architecture and an expanded range of targeted...
Summary of Vulnerabilities, Actors & Attacks: August 2023
...
CISA Known Exploited Vulnerability Catalog August 2023
For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included in the catalog, a vulnerability must meet three criteria: hav...
New Rilide Stealer Version Evades Chrome Manifest V3 Protections
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new version of the Rilide Stealer malware, evading Chromes security measures to target Chromium-based browsers in campaigns that exploit user trust through fake plugins and games, posing a significant...
European Ministries Fall Victim to Chinese Hacker’s SmugX Campaign
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A Chinese nation-state group has been persistently conducting a campaign targeting Foreign Affairs ministries and embassies in Europe. They employ HTML smuggling techniques to distribute a new variant of...
New Chromeloader Shampoo Campaign Infecting Chrome and Stealing Data
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The current ChromeLoader Shampoo campaign, where users unknowingly download and execute VBScript files from malicious websites. These files trigger a series of PowerShell scripts, leading to the...
Earth Longzhi Unleashes New ‘Stack Rumbling’ Tactic
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary APT41s Earth Longzhi launches a new campaign targeting organizations in Asia Pacific using "stack rumbling" to disable security products and install Behinder web shell. To receive real-time threat...
Unveiling ChinaZ DDoS Threat Landscape
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ChinaZ, a Chinese threat group, is infamous for using DDoS botnets to attack Windows and Linux systems. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...
8220 Gang leverages ScrubCrypt in Cryptojacking Attacks
Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The 8220 Gang leverages ScrubCrypt for crypto-jacking, which is available on HackForums for $40 per month or up to $200 for a lifetime...
The Intricate Evolution of SoulSearcher Loader for Multi-Stage Malware Execution
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary SoulSearcher is a second-stage loader that has been seen in the wild since October 2017, and it is responsible for executing the Soul module payload and parsing its configuration. The samples found in th...
Citrix Resolves Vulnerabilities in Virtual Apps and Workspace Apps
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Citrix Systems has addressed vulnerabilities in its Virtual Apps and Desktops, as well as Workspace Apps products, that could potentially enable attackers with local access to the target to elevat...
Trigona Ransomware’s Rampant Threat to Businesses
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Trigona has gained momentum lately due to its utilization of the double-extortion technique of encrypting crucial assets within an organization, including endpoints and infrastructure, and demanding...
Unveiling the Advanced Rust-based Nevada Ransomware
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new type of ransomware named "Nevada Ransomware" has been identified. The creators of this ransomware have established an affiliate program that was initially introduced in the RAMP underground...
Newly Discovered PoweRAT Malware Distributed through PyPI
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A newly discovered malware called “PoweRAT" combines a stealer and a RAT remote access tool. The malware is being distributed through the Python Package Index PyPI, a repository of software for the Pytho...
Internet Explorer Zero-Day Vulnerability Exploited by APT 37
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary North Korean hackers identified as APT37 exploited a previously unknown Internet Explorer zero-day vulnerability to infect South Koreans, North Korean defectors, policymakers, journalists, and human righ...
Do you know about an emerging new infostealer malware named DockLogs
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary DuckLogs is a new info-stealing malware variant, which is sold as Malware-as-a-Service MaaS product. It captures and exfiltrates data from infected PCs such as credentials, cookies, crypto wallets, brows...
Zero-day vulnerability uncovered in Trend Micro Apex One
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A zero-day vulnerability, along with several other issues, has been addressed by Trend Micro. It has been identified as CVE-2022- 40139 and could allow attackers to execute remote code...
Novel remote access trojan CodeRAT uncovered
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary CodeRAT is a remote access trojan RAT. The malicious operation, which appears to have originated in Iran, employed a Word document with a Microsoft Dynamic Data Exchange DDE exploit to target...
Iranian APT targets Middle East’s Energy & Telecommunications industry
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary A new campaign has been launched by a state-sponsored Iranian APT group, Lyceum to target organizations from the Middle East in the energy and telecommunication sectors. They have been observed deploying a new...
Network Providers and Devices targeted by Chinese state-sponsored actors
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary The National Security Agency NSA, the Cybersecurity and Infrastructure Security Agency CISA, and the Federal Bureau of Investigation FBI have released a joint advisory to make organizations in the...
New Ransomware Group Axxes is on the rise
Threat Level Actor Report For a detailed advisory, download the pdf file here Summary Axxes ransomware is a relatively new ransomware group that appears to be a rebranded version of Midas ransomware. The H Dubai is the latest victim of the threat group, which has previously targeted the United...
Lazarus is back, targeting organizations with cryptocurrency thefts via TraderTraitor malware
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI, the Cybersecurity and Infrastructure Security Agency CISA, and the U.S. Treasury Department Treasury have issued a joint Cybersecurity AdvisoryCSA to make organizations in the blockchai...
FIN8 Hacker group using new ‘White Rabbit’ Ransomware against U.S. Banks
THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. White Rabbit is a ransomware family that has only recently been discovered. It could be a subsidiary project of the FIN8 hacking gang. A ransomware expert seeking for a sample of the malware made the first public disclosure...
Zafran vs Hive Pro: CTEM Platform Comparison
Persistent exposure backlogs do not shrink when teams chase every critical finding. Buyers need a CTEM platform that shows which risks demand action right now. Evaluate Uni5 Xposure for a threat-informed CTEM program. Zafran vs Hive Pro compares two CTEM platforms designed to focus security teams...
Kubernetes Security Scanning: A DevSecOps Guide
A clean container image is not proof of a secure Kubernetes workload. New CVEs, unsafe configurations, and excessive permissions can turn an approved deployment into an active exposure. Contact Hive Pro to review your Kubernetes container security priorities. Kubernetes security scanning is the...
Top Cybersecurity Frameworks Compared
Top Cybersecurity Frameworks Compared: NIST, CIS, and MITRE ATT&CK Security leaders do not need another framework for the sake of paperwork. They need a practical way to decide which cybersecurity frameworks help the business govern risk, harden defenses, and validate whether controls can withsta...
CTEM Platform: Operationalize All 5 Gartner CTEM Stages With Uni5 Xposure
Your security team runs scans, generates reports, and hands them to IT. Three weeks later, maybe some patches get applied. Meanwhile, attackers exploit the exposures you missed. Uni5 Xposure is the only CTEM platform that unifies all 5 Gartner CTEM stages, from scoping through mobilization, in a...
Patch Management: A Complete Guide to Securing Your Organization
Your vulnerability scanners just returned 15,000 findings. Microsoft's Patch Tuesday alone dropped 97 fixes. Linux vendors released another 40. Third-party applications added dozens more. Your security team has exactly the same number of hours in the day as they did last month. This is the realit...
Risk-Based Vulnerability Management: The Complete Guide to Smarter Threat Prioritization
Your vulnerability scanner just flagged 12,000 findings. Your team has the bandwidth to remediate maybe 200 this sprint. Which ones do you fix first? If your answer is "sort by CVSS score and work down the list," you are making the same mistake most security teams make. You are treating a 9.8-rat...
How BAS Helps Threat Exposure Management: A Complete Guide
Your vulnerability scanner just produced a report with hundreds of "critical" CVEs. Now what? For most security teams, this is where the guessing game begins. You know you can't fix everything at once, so you're forced to make tough calls based on CVSS scores and gut feelings, all while hoping yo...
A Practical Guide to Attack Surface Intelligence Mapping
Think of your organization’s digital presence as a sprawling, ever-expanding city. New buildings servers go up, old ones are forgotten, and unofficial shortcuts shadow IT appear overnight. Trying to defend this city without a current map is impossible. You’re left reacting to alarms instead of...
5 Types of Cybersecurity Assessment Tools Compared
Your organization’s assets are everywhere: on-premise servers, multi-cloud environments, remote endpoints, and countless applications. Trying to secure this sprawling digital footprint with siloed tools gives you a fragmented, incomplete picture of your risk. You might have one tool for cloud...
One Click Could Cost You Everything – Even Your Smartest Employee Might Be the Biggest Security Risk!
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! Introduction: The Persistent Threa...
A Scenario: Protecting a Financial Institution from External Threats With EASM
Background Carman Bank, a mid-sized financial institution, has experienced rapid growth over the past five years. As part of its expansion, the bank has significantly increased its digital presence by launching new online banking services, mobile applications, and integrating various third-party...
Critical Vulnerabilities Patched in Progress Software’s MOVEit
...
GitLab Flaw Allows Account Takeover via XSS Attacks
...
Ebury A Potent Linux Botnet Infects Over 400K Servers
...
Cuckoo Malware Operates as Both an Infostealer and Spyware
...
ArcaneDoor a Novel Espionage Campaign Exploits Cisco Zero-Days
...