Actors, Threats and Vulnerabilities 22 to 28 May 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries related to cybersecurity threats. Over the past week, the fact that there were a total of ten attacks executed, taking advantage of four different vulnerabilities in vario...

Spyware Group Candiru exploits Chrome Zero-Day to Target Middle East

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary CandiruSaito Tech spyware used the recently fixed CVE-2022-2294 Chrome zero-day in assaults on journalists, with a substantial portion of the attacks taking place in Lebanon. This recently patched vulnerability...

Storm-0978 actively exploited the unpatched Office zero-day

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Storm-0978 is a Russian cybercriminal group that specializes in executing sophisticated phishing campaigns. Storm-0978 was found to be engaged in a new wave of attacks, leveraging the exploitation of...

Exploit found in the wild for Critical VMware Aria Operations Bug

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary An exploit has surfaced for CVE-2023-20864, a highly significant security vulnerability within the VMware Aria Operations for Logs analysis tool utilized in cloud management. This exploit empowers...

Chrome’s zero-day flaw allows arbitrary code execution

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary A vulnerabilityCVE-2022-2856 in Google Chrome, has been exploited in the wild. Additionally, Chrome has addressed several other use-after-free vulnerabilities in multiple components, including FedCM,...

Unknown Attackers exploit several vulnerabilities in Zimbra Collaboration Suite

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary The Zimbra Collaboration Suite ZCS email servers experienced multiple breaches between July and early August 2022. The exploitation of CVE-2022-27925, a remote-code-execution RCE vulnerability in ZCS, was most...

Attacks, Vulnerabilities and Actors 25 to 31 March 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, a total of twelve attacks were executed, ten vulnerabilities were uncovered, and two active adversaries were...

Mallox Ransomware A Resurgent Threat Exploiting MS-SQL Flaws

Summary: Mallox is a resilient Ransomware-as-a-Service RaaS threat, utilizing tactics like exploiting MS-SQL vulnerabilities and employing brute force attacks. Operating with a prolonged presence, Malloxs recent variant, "Mallox.Resurrection," exhibits consistent functionalities, emphasizing the...

Critical Vulnerability in FortiOS SSL VPN Exploited in the Wild

Summary: A critical Out-of-Bounds Write vulnerability CVE-2024-21762 in Fortinet FortiOS SSL-VPN is actively exploited, enabling remote unauthenticated attacker to execute arbitrary code or command via specially crafted HTTP requests. Threat Level - Red | Vulnerability Report For a detailed threa...

Attacks, Vulnerabilities and Actors 2 October to 8 October 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of seven executed attacks, zero instances of adversary activity, and eight zero-day...

Did Patch Tuesday address the zero-day flaw in Microsoft Exchange

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Microsoft addresses two new zero-day vulnerabilities tracked under CVE-2022-41033, an Elevation of Privilege vulnerability exploited in the wild. CVE-2022-41043 is an Information Disclosure...

Ekipa RAT A High-Priced and Evolving Threat for Targeted Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Ekipa is a remote access trojan RAT that is used for targeted attacks and can be purchased on underground forums for a high price of$3,900. It primarily spreads and operates through the use of Microsoft...

Fortinet addresses Authentication Bypass in addition to numerous flaws

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Fortinet addressed security flaws across its products, including a high-severity authentication bypass affecting FortiOS and FortiProxy tracking CVE-2022-35843 in FortiOSs SSH login component. Onl...

Attacks, Vulnerabilities and Actors 01 to 07 July 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made substantial advancements in identifying cybersecurity threats. In just the past week, HiveForce Labs detected eleven executed attacks, reported five vulnerabilities, and identified three active...

VMware tackles security flaws in ESXi and vRealize

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary VMware addressed security weaknesses to address a critical-severity vulnerability affecting ESXi, Workstation, Fusion, and Cloud Foundation, as well as a critical-severity command injection flaw...

Microsoft’s March 2024 Patch Tuesday Addresses 60 Vulnerabilities

Summary: Microsofts March 2024 Patch Tuesday addresses 60 vulnerabilities, including two critical vulnerabilities, spanning various products like Office, Exchange Server, and Windows Kernel. Critical flaws in Windows Hyper-V CVE-2024-21407 and CVE-2024-21408 require immediate attention to mitigat...

Critical Security Vulnerabilities Discovered in Atlassian Products

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Atlassian have revealed the existence of several security vulnerabilities, namely CVE-2022-25647, CVE-2023-22512, CVE-2023-22513, and CVE-2023-28709, which affect their products. These...

GitLab Releases Critical Patch to Address Pipeline Execution Vulnerability

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The critical security vulnerability CVE-2023-5009 affects all versions of GitLab Enterprise Edition EE. This vulnerability is significant as it enables an attacker to execute pipelines as another...

‘Looney Tunables’ Flaw Enables Local Privilege Escalation in Glibc

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary CVE-2023-4911, also known as "Looney Tunables," is a critical buffer overflow vulnerability discovered in the GNU C Librarys dynamic loader, specifically in the processing of the GLIBCTUNABLES...

Zabbix affected by two actively exploited vulnerabilities

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Multiple security vulnerabilities have been discovered in Zabbix open-source network traffic monitoring software Web Frontend component while implementing client-side sessions storage and are being actively exploited as per...

Cloud Atlas Exploits Six-Year-Old Flaw to Target Russian Companies

Summary: The threat actor Cloud Atlas has been identified in spear-phishing attacks targeting Russian enterprises. The modus operandi involves a phishing message in the initial stage, containing a lure document that exploits CVE-2017-11882, a memory corruption vulnerability in Microsoft Offices...

A zero-day vulnerability has been discovered in PAN’s GlobalProtect firewall

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. Palo Alto Networks PAN released an update on November 10, 2021, that patched CVE-2021-3064, which was discovered and disclosed by Randori. This vulnerability affects PAN firewalls that use the GlobalProtect Portal VPN, and ...

Attacks, Vulnerabilities and Actors 29 January to 4 February 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of seven executed attacks, two instances of adversary activity, and six exploited...

Four Threat Actors Capitalized on Zimbra Zero Day to Infiltrate Government Organizations

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A zero-day vulnerability identified as CVE-2023-37580 in Zimbra Collaboration email software has been exploited by four different groups in attacks. These attacks aimed to illicitly obtain email data, us...

Attackers Exploit VMware’s Aria Operations for Logs Vulnerability

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A critical authentication bypass vulnerability CVE-2023-34051 in VMware Aria Operations for Logs allows remote code execution with root privileges under certain conditions, raising concerns for...

Microsoft addresses actively exploited zero-day and numerous critical flaws

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Patch Tuesday for December tackles two zero-day vulnerabilities, one of which is being actively exploited CVE-2022-44698 and another that was publicly disclosed at the time of release...

VMware addresses security flaws discovered during Tianfu Cup Pwn Contest

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here VMware addressed vulnerabilities in ESXi, Workstation, Fusion, and Cloud Foundation, few months after the discovery of these bugs by participants at Tianfu Cup Pwn Contest. VMware has rated some of these vulnerabilities as...

Microsoft Patch Tuesday addresses a zero-day vulnerability in Windows Kernel

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here Microsoft addressed 51 vulnerabilities in the February 2022 patch Tuesday release, one of which was classified as a zero-day vulnerability. A remote attacker could exploit some of these vulnerabilities to gain control of a...

For the third month in a row, it’s time to update Google Chrome

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. Multiple vulnerabilities have been discovered in the worlds most popular browser. Two of them have been used in the wild CVE-2021-38000, CVE-2021-38003. Google has recently patched these vulnerabilities in Google Chrome versi...

SafePay Ransomware: TTPs and Defense Strategies

When a threat actor disables your security software and starts deleting your backups, you’re already in the middle of a crisis. The operators behind SafePay ransomware are known for these exact tactics, deliberately sabotaging your ability to respond and recover. Catching an attack like this earl...

BackdoorDiplomacy targets the telecom industry in the Middle East

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary BackdoorDiplomacy, an advanced persistent threat APT gang with roots in China, is most likely behind a hostile campaign targeting the Middle East. The espionage action, aimed at a Middle Eastern telecom...

Clop Ransomware Group Claims Responsibility for GoAnywhere MFT Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Clop ransomware group claims responsibility for recent cyber attacks that exploited a zero-day vulnerability in the GoAnywhere MFT secure file transfer tool. The vulnerability, now known as...

WordPress plugin has been exploited in the wild to mount backdoors

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Malicious actors are actively exploiting a critical vulnerability in the YITH WooCommerce Gift Cards Premium WordPress plugin in order to plant backdoors on e-Commerce sites. The security flaw...

HTTP/2 Zero-Day Exploited for the Most Explosive DDoS Attacks

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A zero-day vulnerability in HTTP/2 has been actively exploited in August, introducing a novel DDoS technique referred as "Rapid Reset". The attack, utilizing CVE-2023-44487, exploits a vulnerabili...

HTTP2 Zero-Day Exploited for the Most Explosive DDoS Attacks

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A zero-day vulnerability in HTTP/2 has been actively exploited in August, introducing a novel DDoS technique referred as "Rapid Reset". The attack, utilizing CVE-2023-44487, exploits a vulnerabili...

Turla APT used ANDROMEDA malware to infiltrate a variety of industries

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Turla Group is reportedly distributing the KOPILUWAK reconnaissance software and the QUIETCANARY backdoor to victims of ANDROMEDA malware in Ukraine. ANDROMEDA malware, spread through infected USB...

Sandworm Team using a new modular malware Cyclops Blink

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The National Cyber Security Centre NCSC in the United Kingdom, the Cybersecurity and Infrastructure Security Agency CISA, the National Security Agency NSA, and the Federal Bureau of Investigation FBI have discovered that the...

Weren’t you warned about reactivating the Print Spooler?

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. After almost 10 days of releasing an advisory by the Hive Pro Threat Research team, a new vulnerability has been found in Windows Print Spooler. This is a privilege escalation flaw that allows attackers to run arbitrary code...

Google Fixes First Actively Exploited Chrome Zero-day of 2024

Summary: Google has addressed the first actively exploited Chrome zero-day vulnerability of 2024, identified as CVE-2024-0519. Its a high-severity out-of-bounds memory access weakness in Chromes V8. Attackers could exploit it to access data beyond the intended memory buffer, potentially leaking...

OpenSSL exposed to Denial-of-service vulnerability causing Infinite Loop

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. A security flaw exists in OpenSSL software library that could lead to a denial-of-service DoS condition when parsing certificates. The vulnerability, identified as CVE-2022-0778, arises from parsing a malformed certificate...

Sophos Zero-day vulnerability becomes target for attackers

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A zero-day vulnerability in the User Portal and WebAdmin of Sophos Firewall has been tracked as CVE-2022-3236. This vulnerability is been used by some unknown attackers to target organizations in...

Trend Micro Addresses Zero-Day Flaws Exploited in the Wild

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A critical zero-day vulnerability, tracked as CVE-2023-41179, has been identified in the third-party AV uninstaller module contained in Trend Micro Apex One, Worry-Free Business Security, and...

Multiple vulnerabilities have been discovered in the Apache HTTP Server

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. There is a zero-day vulnerability CVE-2021-41773 and a DoS vulnerability CVE-2021-41524 in Apache HTTP servers. After a publicly disclosed exploit, the zero-day vulnerability has been actively exploited in the wild. The Hiv...

WinRAR Zero-Day Exploit Targeting Traders Since April

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The zero-day vulnerability CVE-2023-38831 in WinRAR, allowing hackers to install malware through manipulated archives, exposing users to hidden malicious scripts and potential cyberattacks. To...

Denial of service vulnerability in PAN OS exploited in the wild

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary The URL filtering policy misconfiguration in PAN-OS leads to a vulnerability that could allow an unauthenticated remote attacker to conduct distributed denial-of-serviceDDoS attacks. This vulnerability h...

Atlassian’s Latest Critical Confluence Flaw Poses Risk of Data Loss

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A critical vulnerability identified in Atlassian as CVE-2023-22518 which pertains to be an improper authorization issue in Confluence Data Center and Server. If successfully exploited by an...

Winter Vivern Capitalizes on Zero-Day Flaw in Roundcube

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Winter Vivern cyberespionage group has been actively exploiting a zero-day vulnerability in the Roundcube webmail. The identified vulnerability, CVE-2023-5631, permits stored cross-site scripting...

Google and Firefox fixes Zero-Day Flaw Exploited in the Wild

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A zero-day vulnerability, CVE-2023-5217, is actively exploited and has been patched in both Google Chrome and Firefox browsers. CVE-2023-5217 is a Heap buffer overflow vulnerability discovered in...

Google Addresses Fourth Zero-Day Flaw Exploited by Attackers Wildly

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The zero-day vulnerability CVE-2023-4863 in Google Chrome enables arbitrary code execution and system crashes. Actively exploited "in the wild," it poses severe risks, including data exposure and...

A New APT named APT-C-61 Targets South Asia

Threat Level Actor Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary APT-C-61, also known as Tengyun Snake, is an advanced persistent threat APT group that has been active since at least January 2020 in South Asia. This group mainly...