1589 matches found
Outdated Internet Protocol Vulnerable to Massive DoS
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Critical SLP vulnerability affects 54k devices, including VMware, posing a risk of massive DoS attacks costing businesses up to $120k. To receive real-time threat advisories, please follow HiveFor...
LockBit Ransomware Targets MacOS
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary LockBit ransomware has been discovered on VirusTotal compiled for Apples macOS arm64 architecture, raising concerns about the ransomware threat on Mac devices. To receive real-time threat advisories,...
80K QNAP Devices Vulnerable to Cyberattack
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Multiple QNAP operating systems have been impacted by two vulnerabilities that could potentially allow remote authenticated users to access secret values. To receive real-time threat advisories,...
Botnets Actively Exploited Realtek and Cacti Flaws
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Attacks surged exploiting Cacti and Realtek vulnerabilities, resulting in the spread of ShellBot and Moobot malware. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...
Unraveling North Korea’s Cyber Espionage Group APT43 Targeting Geopolitical Interests
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary APT43 is a cyber espionage group that serves North Korean regime interests by targeting government organizations, academics, and think tanks focused on Korean peninsula geopolitical issues, mainly in Sout...
New BlackSnake Ransomware Performs Clipper Operations on Cryptocurrency Users
Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary BlackSnake ransomware has been discovered with clipper functionality that intercepts and replaces the cryptocurrency wallet addresses of victims with those of attacke...
Sharp Panda A Sophisticated Cyber-Espionage Campaign Targeting Governments
Threat Level Actor Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The Sharp Panda cyber-espionage campaign, which has been active for a considerable period, focuses on infiltrating government entities in Southeast Asia. This operatio...
ProxyShellMiner Exploits Windows Exchange Server Vulnerabilities for Cryptocurrency Mining
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ProxyShellMiner exploits Windows Exchange servers vulnerabilities, which are used to gain unauthorized access and compromise an organization, leading to the installation of cryptocurrency miners...
NewsPenguin Threat Actor Unleashes Malicious Attacks on Pakistani Firms
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary A recently identified adversary, referred to as NewsPenguin, has been associated with a sophisticated phishing campaign targeting Pakistani organizations. The attacker employs a highly intricate payload...
Linux malware leverages plugin exploits to backdoor WordPress sites
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary WordPress sites are being exploited by an unidentified strain of Linux malware that exploits flaws in plugins and compromises the sites by injecting malicious JavaScripts that are run sequentially until...
Two Zero-day Supply Chain Attacks Found in the Python Package Index
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A zero-day supply chain attack called "aioconsol" was discovered on December 9, 2022 in a Python package published on the Python Package Index PyPI on December 6, 2022. All three versions of the package...
Agenda ransomware made its return with a Rust variant
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In addition to BlackCat, Hive, Luna, and RansomExx, Agenda is the latest ransomware strain to use the cross-platform programming language Rust. Ransomware-as-a-service RaaS group Agenda, attributed to an...
Mallox Ransomware is Ramping up its Operation
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Mallox ransomware strains have been spotted in the wild, indicating that the ransomware is operational, propagating rapidly, and infecting entities. An unknown .NET-based loader distributes these Mallox...
New Botnet named Zerobot Exploiting Multiple Vulnerabilities
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A new botnet named ‘Zerobot’ has two variants, both are written in Go programming language, the first variant discovered on 18 Nov 2022, and within a short time on 24 Nov 2022 second variant was...
Actors, Threats and Vulnerabilities 21 – 27 November 2022
...
Heimdal addresses multiple vulnerabilities in v7.7.1
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Heimdal has addressed bugs in Heimdal KDC. A remote intruder can use unwrap des3 to induce a buffer overflow in Heimdal GSSAPI, leading to a denial of service or remote code execution on the host...
New Venus Ransomware Targets Healthcare industry
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Venus ransomware, also called Goodgame, has been a source of concern since August 2022. Venus ransomware is an example of the legacy ransomware model: a standalone package sold on underground markets...
BumbleBee leverages Zerologon to get Domain Controller Access
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Since May 2022, threat actors are leveraging BumbleBee as an initial vector from a Contact Forms campaign. The intrusion started with the delivery of an ISO file that contained an LNK and a DLL. Using...
Vulnerabilities & Threats that Matter 24-30 October 2022
...
US healthcare organizations targeted by Daixin Team ransomware
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Daixin Team ransomware, and data extortion group has been gaining initial access to victims through virtual private networks VPN servers since June 2022, either by exploiting an unpatched vulnerability in...
Earth Aughisky uses a new set of malware
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Earth Aughisky, a well-known cyber espionage group is exploiting legitimate accounts, software, applications, and other weaknesses by conducting a spearphishing campaign to disrupt everyday activities of...
Vulnerabilities & Threats that Matter 19 – 25 September
...
How Continuous Threat Exposure Management helps the Telecom sector defend against cyber threats
...
North Korean hacker group targets victims globally with Holy Ghost ransomware
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary The H0lyGh0st ransomware group, also tracked as DEV-0530 have been using ransomware payloads to compromise several small to mid-sized organizations across the world...
OpenSSL Vulnerability leads to Remote Code Execution
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary The Heap Memory Corruption vulnerability in OpenSSL let attackers perform Remote Code Execution...
Microsoft addresses multiple RCE vulnerabilities in their June 2022 Patch Tuesday
Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Microsoft June 2022 Patch Tuesday addressed 55 security flaws. One of them is the Follina which has been addressed in another detailed advisory. Three of them have been rated criticalas per Microsoft and...
Enemybot malware expands its arsenal by exploiting well-known vulnerabilities
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary EnemyBot, a Mirai-based botnet, is expanding its arsenal by exploiting well-known vulnerabilities in log4j, VMware workspace, Spring Framework, and others. Keksec, also known as Nero and Freakout, is the threat...
CrowdStrike vs Hive Pro: VM Compared
CrowdStrike vs Hive Pro for Vulnerability Management CrowdStrike vs Hive Pro is not a simple feature checklist. It is a decision about how your security team wants to manage exposure: through an endpoint-centered platform that extends into vulnerability assessment, or through a vendor-neutral...
CTEM for Financial Services: Continuous Threat Exposure Management for Banks and Financial Institutions
Protect Customer Data. Prevent Fraud. Meet PCI-DSS, SOX, and DORA Compliance. Financial institutions are the most targeted sector for cyberattacks. With an average breach cost of $6.08 million and regulators tightening requirements under PCI-DSS 4.0 and DORA, reactive security programs leave bank...
5 Best Kenna Replacement Options to Consider
Attackers don't think in terms of isolated CVE scores. They look for the path of least resistance, chaining together multiple weaknesses across your entire attack surface to reach their goal. This is why the search for a Kenna replacement is so critical. It’s not just about finding a new tool to...
Your Guide to Risk-Based Vulnerability Management
Communicating security needs to leadership can be a challenge when you’re just presenting a long list of technical flaws. The conversation shifts when you can talk about risk in clear business terms. Instead of saying "we have 500 critical vulnerabilities," you can say "we have 15 vulnerabilities...
Scattered Spider’s Strategic Hunt: Is Your Industry Next?
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Introduction In April 2025, a single phone call didn’t just ‘help crash’ Marks & Spencer’s...
5 Cyber Trends That Should Be Shaping Your 2025 Security Strategy
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. 2024 was the year cyber threats got faster, smarter, and far more lethal. Ransomware groups became...
Paris Olympics 2024: Securing The Games
The Rising Cyber Threats In recent years, the threat of cyberattacks has grown exponentially, affecting the sports sector as well. Major international events like the Olympics are prime targets for cybercriminals, hacktivists, and even nation-states. The reasons are clear: these events attract...
Cracking Open the Dual Weaknesses of Rockwell Automation’s PanelView Plus
...
Boolka: From Scripting to Sophisticated Malware Attacks
...
Deciphering LilacSquid’s Strategies for Long-Term Data Theft
...
JAVS Courtroom Recording Software Hit by Supply Chain Attack
...
Kimsuky Expands Its Arsenal with New Backdoor
...
Tracing the Footprints of Agent Tesla’s Conspirators
...
CHAVECLOAK Banking Trojan Sneaks into Brazil’s Financial Hub
Summary: The CHAVECLOAK banking trojan is purposefully crafted to target the banking credentials of individuals in Brazil, highlighting the ongoing focus of cyber criminals on the nations financial sector. Threat Level - Amber | Attack Report For a detailed threat advisory, download the pdf file...
CISA Known Exploited Vulnerability Catalog January 2024
For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. It is recommended that all organizations review and monitor the KEV catalog,...
Malicious Google Ads Target Chinese Users, Covertly Delivering RATs
Summary: Chinese-speaking users are being targeted in an ongoing malvertising campaign that leverages Google ads. The threat actor employs Google advertiser accounts to create deceptive ads that lure users into downloading Remote Administration Trojans RATs. The malicious ads are designed to mimi...
Unveiling GambleForce: A SQL Injection Gang
Summary: A recently identified threat actor, GambleForce, has been linked to a series of SQL injection attacks targeting companies primarily in the Asia-Pacific region. GambleForce employs a combination of basic yet highly effective techniques, including SQL injections and exploiting...
AeroBlade Swoops Down on U.S. Aerospace Giants
Summary: A US-based aerospace entity has become a victim of an intricate year-long cyber espionage campaign orchestrated by AeroBlade. AeroBlades probable goal was to enhance visibility into the internal resources of its target, evaluating vulnerabilities for potential future ransom demands. Thre...
Mustang Panda Targets Philippines Government Using Legitimate Software
Summary: Mustang Panda, a threat actor associated with China, has been implicated in a cyber attack targeting a government entity in the Philippines. The attackers employed a strategy of using legitimate software, such as Solid PDF Creator and SmadavProtect an antivirus solution based in Indonesi...
Microsoft’s August Patch Tuesday Addresses Active Zero-Day Exploits
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary In the August Patch Tuesday release, Microsoft addressed a total of 73 CVEs, encompassing six critical and 67 important vulnerabilities. Within this range of vulnerabilities, the security update...
The Unrelenting Nature of TOITOIN Malware
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The TOITOIN malware campaign, targeting businesses in the LATAM region, employs sophisticated techniques and multi-stage infection chains with numerous malware samples disguised as compressed ZIP archive...
Hive Pro Announces Release of Version 3.0.1 of Threat Exposure Management Platform
Introducing Self-Service SaaS for HivePro Uni5 Flagship Product and Enhanced Visualizations for Improved Cybersecurity Insights Milpitas, CA – 6th July 2023—Hive Pro, a pioneer in the Threat Exposure Management market, is thrilled to announce the release of version 3.0.1 of the Hive Pro: Threat...
Vulnerability in WordPress Plugin threatens Website takeover
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary WordPress Ultimate Member Plugin, with over 200K installations helps in streamlining user registration and login processes. It has been found vulnerable to unauthenticated privilege escalation,...