1589 matches found
Lockbit Ransomware strikes, demands $70-million Ransom
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Lockbit sub-group, National Hazard Agency, claims of data exfiltration from TSMC systems, allegedly deployed Ransomware and demands 70-million-dollar ransom. TSMC has clarified that their system is...
Stealth Soldier Strikes North Africa with Espionage Attacks
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Stealth Soldier is a backdoor malware that conducts surveillance and espionage attacks. It targeted North Africa by mimicking Libyan websites to distribute malware. To receive real-time threat advisories...
WINTAPIX Kernel Driver Targeting Middle Eastern Nations
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The WINTAPIX driver, protected by VMProtect, targets Saudi Arabia and other Gulf countries, possibly linked to Iranian threat actors exploiting Exchange servers for malware deployment. To receive real-ti...
Actors, Threats and Vulnerabilities 15 to 21 May 2023
For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made significant discoveries in the field of cybersecurity threats. In the past week, they uncovered a total of eight attacks that were executed, taking advantage of five different vulnerabilities across...
8220 Gang Exploiting Vulnerabilities in Cloud Environments for Cryptocurrency Mining
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The 8220 Gang is a cyber threat group that targets cloud and container environments, exploiting vulnerabilities in applications like Oracle WebLogic, Apache Log4j, and Atlassian Confluence. To receive...
New DownEx Malware Campaign Targets Foreign Government Institutions in Central Asia
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The DownEx malware was discovered in a cyberattack on government institutions in Kazakhstan and Afghanistan in 2022, likely with state sponsorship. The attackers used spear-phishing emails to infiltrate...
Kimsuky APT Group Employs ReconShark
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Kimsuky, a North Korean APT group, is using a new malware tool called ReconShark to conduct global cyberattacks. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...
New Atomic Stealer MacOS malware Steals Browser Cookies and Cryptocurrency Wallets
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Atomic Stealer malware is a full-featured infostealer designed to steal sensitive data from macOS users. The malware can grab account passwords, browser data, session cookies, and crypto-wallets. To...
North Korean-Backed Group’s Sparks X_Trader Supply Chain Attack
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The XTrader software supply chain attack affected at least a number of critical infrastructure entities in the United States and Europe. To receive real-time threat advisories, please follow HiveForce La...
New PingPull Malware Variant Targets Linux Systems
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The PingPull malware variant that targets Linux systems is linked to Alloy Taurus, and it communicates with a domain over HTTPS to receive encrypted commands for executing specific functions. To receive...
Apple Addresses Zero-Day Vulnerabilities in macOS and Safari
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Apple addressed vulnerabilities in macOS Ventura and Safari for macOS Big Sur/Monterey, which could potentially enable attackers to execute arbitrary code with kernel privileges or through...
CISA Known Exploited Vulnerability Catalog March 2023
For a detailed CISAs KEV Catalog, download the pdf file here Summary For a detailed CISAs KEV Catalog, download the pdf file here The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included ...
Actors, Threats and Vulnerabilities 13 March to 19 March 2023
For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Over the past week, Hive Pro detected the presence of five active threat actors. The first of these is Dark Pink APT, a notorious group with a history of engaging in informati...
BlackLotus UEFI Bootkit Exploits Windows 11 vulnerability
Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary BlackLotus is a UEFI bootkit that can exploit a vulnerability in Windows 11 systems and is advertised and sold on underground forums for $5,000...
Actors, Threats and Vulnerabilities 6 March to 12 March 2023
For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Last week, HiveForce Labs discovered three threat actors. One of them is a Russian group called TA499, which has a history of conducting different cyberattacks such as...
Unveiling the Malicious Tactics of LokiBot Malware
Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary LokiBot is a constantly evolving information-stealing malware that creates a backdoor on infected machines to collect sensitive data, and it uses ISO files and API...
CISA Known Exploited Vulnerability Catalog February 2023
For a detailed CISAs KEV Catalog, download the pdf file here Summary For a detailed CISAs KEV Catalog, download the pdf file here The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included ...
New China-based Group Expands Operations to Compromise Diplomatic Targets in South America
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The China-based cyber espionage group DEV-0147 has expanded its data exfiltration operations to include diplomatic targets in South America, in addition to targeting government agencies and think tanks in...
A new botnet called the Medusa Botnet is emerging via Mirai Botnet targeting Linux users
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Mirai is a botnet that has been active since 2016 and exploits vulnerabilities in Linux-based networking devices like routers and IoT devices to gain control and perform malicious activities like...
Chinese Threat Actors Leverage Phishing and GuLoader to Distribute Remcos RAT
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The malicious campaign described involves the distribution of a malicious PDF file through email, via phishing. The PDF file in this case redirects victims to a legitimate cloud-based platform, where the...
A New Malware Called Album Stealer is Targeting Facebook Users
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Album Stealer is a malware that disguises itself as a photo album and drops decoy adult images while performing malicious activity in the background. It uses a side-loading technique to execute malicious...
Control Web Panel OS Command Injection Exploitation Increases After POC Release
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary On January 3, 2023, a security researcher published a proof-of-concept exploit for a vulnerability in Control Web Panel CWP that allows unauthenticated remote code execution. By January 6, the...
Trading platforms are in jeopardy due to ArkeiStealer
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Threat actors are currently disseminating ArkeiStealer via Windows Installer binaries disguised as trading applications. The trading application has been backdoored with the SmokeLoader downloader, which...
How ScarCruft APT group enhances its toolkit with a powerful Dolphin backdoor
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ScarCurft aka Reaper, APT 37, Ricochet Chollima is North Korean espionage group, active since 2012. ScarCruft has targeted South Korea Newspaper with a watering hole attack in the last year. In this...
Rise in new Royal Ransomware attacks
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Royal Ransomware is a new form of ransomware used as a service in early 2022, with the objective of gaining access to a victims environment, encrypting all their files, and extorting a ransom in orde...
RapperBot Campaign Launches DDoS Attacks on Game Servers
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The new RapperBot malware version creates a botnet capable of launching Distributed Denial of Service DDoS attacks. The latest version can launch Telnet brute-force strikes, DoS attacks using the Generic...
Citrix Addresses Auth bypass Flaws Affecting ADC and Gateway Products
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Citrix has addressed bugs in Citrix ADC and Citrix Gateway. A remote intruder could exploit either of these flaws to obtain control of a susceptible system. To successfully exploit the vulnerabili...
LDR4 is a new Ursnif variant
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In June 2022, a new aspect of the URSNIF malware was identified. Unlike prior URSNIF iterations, this new variation, code named LDR4, is a backdoor designed to facilitate operations such as ransomware an...
BlackByte uses a new attack technique to target vulnerable Windows drivers
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary BlackByte Ransomware is leveraging a security flaw in a legitimate Windows driver to conduct a new bring your own vulnerable driver BYOVD attack...
MuddyWater targets Israeli organizations by exploiting unpatched log4j vulnerabilities
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MuddyWater, an Iranian threat actor, exploits Log4j two vulnerabilities in SysAid applications to target Israeli organizations. As soon as the attacker gains access to the targeted organization, it...
Who is behind the Cisco attack?
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary Cisco has revealed that they have faced a breach carried out by threat actors, the UNC2447, the Lapsus$, and the Yanluowang ransomware gang. They stole around 2.8 GB of data, which included non-disclosure...
APT37 employs Konni malware to target high-level organizations
Threat Level Actor Report For a detailed advisory, download the pdf file here Summary The Konni remote access trojan, which is widely used malware by the APT37, is used in the attack campaign to take advantage of high-value targets from countries like the Czech Republic, Poland, and many others...
Vulnerabilities & Threats that Matter 11-17 July 2022
Published Vulnerabilities Interesting Vulnerabilities Active Threat Groups Targeted Countries Targeted Industries ATT&CK TTPs 580 37 2 World-wide 11 61 For a detailed threat digest, download the pdf file here Summary The second week of July 2022 witnessed the discovery of 580 vulnerabilities out ...
Bronze Starlight uses loader malware to deploy ransomware
Threat Level Actor Report For a detailed advisory, download the pdf file here Summary Bronze Starlight, a Chinese APT, is deploying ransomware LockFile, AtomSilo, Rook, Night Sky, and Pandora via the HUI loader malware to carry out double extortion...
ToddyCat exploits unknown vulnerability in Microsoft Exchange servers to targets entities in Europe and Asia
Threat Level Actor Report For a detailed advisory, download the pdf file here Summary ToddyCat, an APT group is deploying web shells by exploiting an unknown vulnerability in the Microsoft Exchange Servers. They are initiating a multi-stage infection that aims at governmental bodies in Europe and...
DriftingCloud exploits zero-day in Sophos firewall
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary The Chinese APT actor DriftingCloud exploits the RCE vulnerability in Sophos firewall to take over the entire network...
Deserialization of untrusted data by Fastjson library leads to RCE
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Applications using the Fastjson java library are impacted by remote code execution vulnerability...
Modernizing Vulnerability Management with Risk-Based Prioritization
...
Critical Samba vulnerability allows remote code execution as root
...
Apple releases macOS Monterey 12.2 to fix multiple vulnerabilities
...
How to Reduce Mean Time to Remediate (MTTR) in Cybersecurity
How to Reduce Mean Time to Remediate MTTR in Cybersecurity Every hour a vulnerability remains unpatched is an hour an attacker can use it against you. That window of exposure is exactly what Mean Time to Remediate MTTR measures, and for security leaders, it's one of the most consequential metrics...
A CISO’s Guide to Threat Management Platforms
Attackers don’t see your organization as a list of CVEs. They see a web of interconnected assets, looking for a single weak link that will give them a path to your most valuable data. A traditional vulnerability scanner might miss these dangerous connections, but a threat management platform is...
What Is Hive Pro’s End-to-End CTEM Solution?
The difference between a good security program and a great one often comes down to context. Without it, a list of 10,000 vulnerabilities is just a list. But when you can see that three of those vulnerabilities are being actively exploited by a threat group targeting your industry, your priorities...
Firefox Security Vulnerabilities: An Expert Guide
For any vulnerability management team, the daily flood of alerts can be overwhelming. When your scanner flags dozens of new CVEs, it’s easy to see browser-related issues as lower priority. Yet, a critical flaw in a widely used application like Firefox can be the initial foothold an attacker needs...
How Threat Intelligence Transforms Vulnerability Management
Your security team isn't just fixing technical flaws; they're protecting the business from tangible risks. The problem is, a list of thousands of CVEs doesn't communicate business impact very well. It’s just noise until you can connect a vulnerability to a potential outcome. Threat intelligence...
Navigating the Cyber Threat Landscape in 2025: Key Insights for Security Leaders
2025 is half way done already and it has been evolving at an unprecedented pace, presenting new challenges and opportunities for security leaders. Last week, we launched The Hive Pro Cyber Horizons Annual Threat Report 2025. The report sheds light on the most pressing threats and offers actionabl...
From AI to Zero-Days: Why CISOs Can’t Ignore the 2024 Threat Shifts
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Two weeks ago, we published the key insights from our Cyber Horizons 2025 Threat Report ,...
From Inventory to Influence: How CAASM Shifts Security’s Leverage
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! Most security teams already know...