ALERTS MARCH 2024

HOME  AI  APT  BOTNET  CAMPAIGN  CRIME  CRYPTOCURRENCY  EXPLOIT  HACKING  GROUP  OPERATION  PHISHING  RANSOM  SPAM  VIRUS  VULNEREBILITY  | March(16) April(92) May(99) June(94) July(88) August(112) SEPTEMBER(67)

DATE

NAME

CATEGORY

SUBCATE

INFO

30.3.24CVE-2024-20767 - Adobe ColdFusion vulnerabilityALERTSVULNEREBILITYCVE-2024-20767 is a directory traversal vulnerability in Adobe ColdFusion, which is a development platform for building and deploying web and mobile applications.
30.3.24Sync-Scheduler InfostealerALERTSVIRUSA Infostealer dubbed as Sync-Scheduler, written in C++, has been reported as being distributed concealed within Office document files.
30.3.24WarzoneRAT malware re-emerges with new samplesALERTSVIRUSWarzoneRAT (also known as AveMaria) is a commodity Remote Access Trojan variant used by various threat groups in recent years.
30.3.24TheMoon malware targets thousands of insecure routersALERTSVIRUSA new malicious campaign featuring an updated version of TheMoon, a notorious malware family has been reported. This latest variant of TheMoon appears to target insecure outdated home routers,
30.3.24Beware of FlightNightALERTSVIRUSA new threat actor has been observed using similar Tactics, Techniques and Procedures (TTPs) to recent Go-Stealer campaigns targeting Indian government entities.
28.3.24Dropper disguised as legitimate PuTTy SoftwareALERTSVIRUSA threat actor has been reported purchasing an ad claiming to be the PuTTY homepage. This ad appeared at the top of the Google search results page, although it has since been removed. It appeared just before the official PuTTY website
28.3.24Mispadu Stealer extends its reachALERTSVIRUSMispadu Stealer (known also as Ursa) has shown some increased activity in recent distribution campaigns.
28.3.24Qilin ransomware remains an active threat in the landscapeALERTSRANSOMQilin, also known as Agenda, is a Rust-based ransomware variant discovered in 2022. The malware has been spreading actively in the wild in recent months, with ongoing developments evident in new versions.
28.3.24SnowLight downloader spread in campaigns exploiting F5 BIG-IP and ScreenConnect vulnerabilitiesALERTSVIRUSRecent malicious campaigns attributed to the UNC5174 threat group have been reported to exploit F5 BIG-IP (CVE-2023-46747) and Connectwise ScreenConnect (CVE-2024-1709) vulnerabilities for malware delivery.
27.3.24Stately Taurus APT Campaign Targeting Asian CountriesALERTSAPTResearchers observed a recent Stately Taurus (aka Mustang Panda) APT campaign during an ASEAN-Australia Special Summit held just this month targeting Asian countries.
27.3.24VCURMS and STRRAT being delivered via links in spam messagesALERTSVIRUSA java downloader has been discovered delivering VCURMS and STRRAT remote access trojans. This downloader is deployed via email with links to malicious JAR files. These two RATs will then download a modified Rude Stealer and keylogger for data exfiltration.
26.3.24VCURMS and STRAT being delivered via links in spam messagesALERTSVIRUSA java downloader has been discovered delivering VCURMS and STRRAT remote access trojans. This downloader is deployed via email with links to malicious JAR files. These two RATs will then download a modified Rude Stealer and keylogger for data exfiltration.
26.3.24VCURMS and STRRAT being delivered via links in spam messagesALERTSVIRUSA java downloader has been discovered delivering VCURMS and STRRAT remote access trojans. This downloader is deployed via email with links to malicious JAR files. These two RATs will then download a modified Rude Stealer and keylogger for data exfiltration.
26.3.24New backdoor WineLoaderALERTSVIRUSPhishing attacks impersonating political parties with an invite lure to diplomats for a wine-tasting event has been used to deploy WineLoader malware.
26.3.24New remote control backdoor leveraging malicious drivers emerges in ChinaALERTSVIRUSIn a recent campaign observed in China, a new remote control backdoor was distributed.
26.3.24Emergence of Mirai Nomi in the Threat LandscapeALERTSBOTNETA new Mirai botnet variant, named Mirai Nomi, has emerged in the threat landscape. This variant features modified UPX packing, a time-dependent Domain Generation Algorithm (DGA) for command and control, and multiple encryption and hashing algorithms.