Bluebottle Group Continues Attacks on Banks in Francophone Africa

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Bluebottle is a cybercrime group that has been targeting banks in French-speaking countries in Africa. The group uses a variety of tactics, including living off the land, dual-use tools, and commodity...

Vice Society gang switches to new custom ransomware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Vice Society is a well-established ransomware group that has successfully targeted a range of enterprises. They aim to maximize their financial gain by using the standard double extortion strategy. In...

MuddyWater is back with new techniques

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary MuddyWater used Dropbox links and document attachments with URLs redirected to ZIP archives as lures in its campaign, which also utilized compromised corporate email accounts. In addition to using Remote...

FRwL destroys data with Somnia to disrupt operations in Ukraine

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary FRwLFrom Russia with Love group, tracked as UAC-0118 uses a fake website to trick Ukrainian organization employees into downloading the Advanced IP Scanner software. Upon installation, the system is...

Privilege Escalation in VMware spring-security

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A vulnerability in VMwares Spring Security affects the mapping of permitted scope in spring-security-oauth2-client, allowing privilege escalation...

WIP19 targets IT service providers and telcos with custom malware

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary WIP19, a Chinese APT group is using legitimate and stolen certificates to sign malware, such as SQLMaggie, ScreenCap, and a credential dumper which it then used to target telecommunications and IT service...

Summary of Vulnerabilities & Threats: July 2022

...

SparklingGoblin Revamps SideWalk Backdoor for Linux Variant

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary SparklingGoblin aka Earth Baku State-backed Chinese hackers has integrated a Linux variant of the SideWalk backdoor. SparklingGoblin Threat actors typically target East and Southeast Asian countries, wit...

Vulnerabilities & Threats that Matter 05 – 11 September

...

Vulnerabilities & Threats that Matter 29 August – 04 September

...

Healthcare industry tore down by Karakurt ransomware group

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The Karakurt ransomware group is a recent addition to the list of cybercriminal gangs, with reports of its first appearance in late 2021. Since June 2022, the recent attacks have had an impact on the US...

The current cybersecurity challenge: All the threat data in the world, but no idea how to leverage it

Milpitas, California, August 05, 2022 -- Organizations today are facing a deluge of automated cybersecurity threats that are increasing exponentially every day, not only in velocity but in variety and complexity. This makes it virtually impossible for organizations to address every vulnerability...

Attackers can bypass authentication in Cisco SMA & ESA

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary An attacker can login into a web management interface of an affected system to perform bypass authentication remotely...

Drupal addresses a Guzzle third-party vulnerability

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary The Drupal core project addresses security flaws in a third-party Guzzle library to handle HTTP requests and responses to external services. These may not directly affect Drupal core; however, it can hav...

Gitlab addresses critical security vulnerabilities with newer versions

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary The new versions of Gitlab address one critical and two high-security flaws as per Gitlab. Some of these vulnerabilities could be exploited by an attacker to perform a Stored Cross-Site ScriptingXSS...

New Threat Actor using Serpent Backdoor attacking French Entities

...

DarkHotel APT group targeting the Hospitality Industry in China

...

Multiple Google Chrome Vulnerabilities affects all Platforms

THREAT LEVEL: Green. For a detailed advisory, download the pdf file here. Chrome versions prior to 99.0.4844.74 affects Windows, Mac, and Linux. Vendor has released fixes for ten vulnerabilities that allow an attacker to gain control of a vulnerable system. Nine of the ten Chrome vulnerabilities...

Google Chrome affected by high severity vulnerabilities

THREAT LEVEL: Green. For a detailed advisory, download the pdf file here Google has released Chrome 98 as a stable channel for Windows, Mac, and Linux. This update addresses 19 security vulnerabilities. Eight of them are rated severity high, ten of them are medium and one of them is of severity...

Adobe Illustrator 2021 has several critical Vulnerabilities

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. Adobe Illustrator 2021 has an update that addresses several important vulnerabilities that might result in memory leaks, arbitrary code execution, and application denial of service. Vulnerability Details Patch Link Referenc...

How to Present Cybersecurity ROI to Your Board of Directors

...

7 Best CTEM Tools to Reduce Your Attack Surface

To truly secure your organization, you have to start thinking like an attacker. An adversary doesn’t care about your endless spreadsheet of CVEs; they look for a single, exploitable path to their objective. So, how do you find that path before they do? You start by using threat intelligence to...

Top 5 Vulnerability Prioritization Tools for Enterprises

A high CVSS score doesn’t always equal high business risk. A critical vulnerability on a non-essential, isolated asset might be less of a priority than a medium-level one on your primary payment server. To truly manage risk, you have to connect technical data to business context. This means...

5 Best Cisco Vulnerability Management Replacements

The end-of-life announcement for Cisco Vulnerability Management formerly Kenna Security might feel like a disruption, but it’s actually a perfect opportunity to re-evaluate your entire security strategy. For years, teams have been stuck in a reactive cycle, chasing an endless list of CVEs with...

Chrome Zero-Day Vulnerability: Are You Protected?

With billions of users, Google Chrome is more than just a browser; it’s a fundamental part of your organization's attack surface. It’s installed on nearly every endpoint, from the C-suite to the intern pool. This ubiquity is precisely what makes a Chrome zero-day vulnerability so uniquely...

What Is Exposure Management Cybersecurity? A Guide

For too long, security has been a defensive game of whack-a-mole. A new threat appears, and we scramble to patch it. But what if we could see our organizations the way an attacker does? Attackers don’t care about your patching cadence or your CVSS scores. They look for the path of least...

What Is a “Next Generation” Vulnerability Management Solution?

You already know that running vulnerability scans is a fundamental part of cybersecurity. But what happens after the scan is finished? A long list of potential weaknesses without context is more overwhelming than helpful. A modern vulnerability management system goes far beyond simple scanning. I...

The Landmines CAASM Exposes That Your CMDB Pretends Don’t Exist

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! Let’s be honest: a lot of the...

UNC3886 Covert Operations Leveraging Rootkits and Backdoored Applications

...

Microsoft’s June 2024 Patch Tuesday Addresses 49 Vulnerabilities

...

Novel TargetCompany Ransomware Linux Variant Now Attacks ESXi

...

Hackers Exploit LiteSpeed Cache for WordPress Site Takeover

...

Attacks, Vulnerabilities and Actors 8 to 14 April 2024

...

LazyStealer the Unconventional Approach to Cyber Espionage

...

Over 170K Users Hit by Fake Python Infrastructure

...

Magnet Goblin Strikes Public-Facing Servers

Summary: Magnet Goblin, characterized by its financial incentives, strategically exploits zero-day vulnerabilities within publicly accessible services by employing sophisticated malware sourced from the Nerbian family, which also includes NerbianRAT and MiniNerbian. Threat Level - Red | Actor...

Volt Typhoon: A Cyber Threat to U.S. Critical Infrastructure

Summary: State-sponsored cyber actors from the People’s Republic of China, known as Volt Typhoon, are actively targeting critical infrastructure in the United States, employing sophisticated tactics like pre-compromise reconnaissance and living off-the-land techniques. Threat Level - Red | Attack...

Maliciously Crafted Cracked Software Propagates Lumma Stealer via YouTube

Summary: In an attempt to deceive users into downloading the information-stealing virus Lumma, threat actors are exploiting YouTube videos featuring content related to cracked software. These videos typically include content related to the use of cracked software, accompanied by identical...

UAC-0099 Utilizes WinRAR Exploit to Deploy LONEPAGE Malware

Summary: UAC-0099, a threat actor, has been involved in persistent attacks targeting Ukraine. These attacks leverage a critical vulnerability in WinRAR to deploy a malware strain known as LONEPAGE. Notably, the threat actor focuses on Ukrainian employees working for organizations outside of...

OilRig Group Unleashes Three New Malware Strains

Summary: The Iranian state-sponsored threat actor, commonly referred to as OilRig, implemented three distinct downloader malware variants throughout the year 2022. The primary objective was to sustain persistent access to targeted organizations located in Israel. OilRig demonstrated active...

The Lethal Advancement of DarkGate Malware-as-a-Service

Summary: DarkGate, a formidable Remote Access Trojan RAT, functions as a Malware-as-a-Service MaaS and is masterminded by the elusive RastaFarEye within the underground cybercrime landscape. The latest iteration, DarkGate 5.0.19, advances upon its predecessors with sophisticated evasion technique...

Quasar RAT Utilizes DLL Side-Loading to Evade Detection

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Quasar RAT is an open-source remote access trojan that has been used by cybercriminals and threat actors for various malicious purposes. The use of DLL side-loading is a sophisticated technique that allo...

MATA Backdoor Targets Eastern European Industrial Companies

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MATA malware, a sophisticated backdoor framework, updated to target Eastern European industrial companies via spear-phishing, compromising financial software servers, and infiltrating networks, even...

BbyStealer’s Tactic for Targeting VPN Users

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The BbyStealer malware resurfaces and orchestrates a sophisticated information-theft campaign, utilizing numerous phishing domains to target users of VPN applications engaged in downloading activities,...

Summary of Vulnerabilities, Actors & Attacks: September 2023

...

Earth Lusca’s Sneaky Moves Unleashes New Linux Backdoor

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Earth Lusca, a highly sophisticated Chinese threat actor, is believed to have resumed its operations in the first half of 2023. This cyber espionage group utilizes the SprySOCKS backdoor, primarily...

PCI DSS Compliance with Hive Pro Threat Exposure Management

In this video, Anand Choudha, CEO at Hive Pro, and Jeelan Poola, CPO at Hive Pro, introduce the HivePro Uni5 Threat Exposure Management Platform. HivePro Uni...

FreeWorld Ransomware Targets MSSQL Servers Facing Siege

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Adversaries are capitalizing on inadequately protected Microsoft SQL MS SQL servers in an operation known as DBJAMMER, deploying both Cobalt Strike and a ransomware strain named FreeWorld, which appears ...

Lazarus Group Uses ManageEngine Exploit to Unlock Path for QuiteRAT

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Lazarus Group, a threat actor associated with North Korea, has been detected utilizing a recently patched critical security vulnerability in Zoho ManageEngine ServiceDesk Plus. This vulnerability was...

Citrix Netscaler ADC and Gateway Vulnerabilities Exploited in the Wild

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Citrix has released a zero-day critical patch for a remote code execution vulnerability in Netscaler ADC and Netscaler Gateway that has been exploited, along with two other vulnerabilities. Urgent...