THREATS 2023 March

January(56) February(146) March(137) April(491) May(161) June(162) July(242) August(171) September(238) October(161) November(135) December(70)

DATE	NAME	CATEGORY	SUBCATEGORIES	INFO
28.3.23	IcedID (Bokbot) with BackConnect traffic and Cobalt Strike	Malware traffic	Malware traffic	Zip files are password-protected. If you don't know the password, see the "about" page of this website.
25.3.23	PHPGurukul Online Birth Certificate System V 1.2 - Blind XSS	Exploit	WebApps	PHP
25.3.23	Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution	Exploit	WebApps	PHP
25.3.23	MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution	Exploit	WebApps	PHP
25.3.23	Abantecart v1.3.2 - Authenticated Remote Code Execution	Exploit	WebApps	PHP
25.3.23	SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution	Exploit	WebApps	PHP
25.3.23	ImpressCMS v1.4.3 - Authenticated SQL Injection	Exploit	WebApps	PHP
25.3.23	Password Manager for IIS v2.0 - XSS	Exploit	WebApps	ASP
25.3.23	Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)	Exploit	WebApps	PHP
25.3.23	DLink DIR 819 A1 - Denial of Service	Exploit	DoS	Hardware
25.3.23	GuppY CMS v6.00.10 - Remote Code Execution	Exploit	WebApps	PHP
25.3.23	NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle	Exploit	Remote	Python
25.3.23	Lavalite v9.0.0 - XSRF-TOKEN cookie File path traversal	Exploit	WebApps	PHP
25.3.23	Employee Performance Evaluation System v1.0 - File Inclusion and RCE	Exploit	WebApps	PHP
25.3.23	Yoga Class Registration System v1.0 - Multiple SQLi	Exploit	WebApps	PHP
25.3.23	Human Resources Management System v1.0 - Multiple SQLi	Exploit	WebApps	PHP
25.3.23	D-Link DNR-322L <=2.60B15 - Authenticated Remote Code Execution	Exploit	Remote	Hardware
25.3.23	Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated)	Exploit	WebApps	PHP
25.3.23	System Mechanic v15.5.0.61 - Arbitrary Read/Write	Exploit	Local	Windows
25.3.23	Translatepress Multilinugal WordPress plugin < 2.3.3 - Authenticated SQL Injection	Exploit	WebApps	PHP
25.3.23	NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi	Exploit	WebApps	PHP
25.3.23	"camp" Raspberry Pi camera server 1.0 - Authentication Bypass	Exploit	WebApps	Python
25.3.23	Detect and Prevent Web Shell Malware	KNIHOVNA	KNIHOVNA	Cyber actors have increased the use of web shell malware for computer network exploitation.
25.3.23	TONEINS	Malware	Backdoor	TONEINS is the name of a backdoor malware.
25.3.23	MQsTTang	Malware	Backdoor	MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT
25.3.23	BLUEHAZE	Malware	Malware	Mandiant associates this with UNC4191, this malware is a launcher for NCAT to establish a reverse tunnel.
25.3.23	MISTCLOAK	Malware	Malware	Mandiant associates this with UNC4191, this malware decrypts and runs DARKDEW.
25.3.23	CVE-2023-23397	Vulnerebility	CVE	Microsoft Outlook Elevation of Privilege Vulnerability
25.3.23	RDP NetNTLMv2	Attack	Attack	Capturing RDP NetNTLMv2 Hashes: Attack details and a Technical How-To Guide
24.3.23	Bitbucket v7.0.0 - RCE	Exploit	WebApps	Atlassian Bitbucket Server and Data Center 7.0.0 before version
24.3.23	wkhtmltopdf 0.12.6 - Server Side Request Forgery	Exploit	WebApps	wkhtmltopdf 0.12.6 - Server Side Request Forgery
24.3.23	WorkOrder CMS 0.1.0 - SQL Injection	Exploit	WebApps	WorkOrder CMS 0.1.0 - SQL Injection
24.3.23	MAN-EAM-0003 V3.2.4 - XXE	Exploit	WebApps	MAN-EAM-0003 V3.2.4 - XXE
24.3.23	Owlfiles File Manager 12.0.1 - Multiple Vulnerabilities	Exploit	WebApps	Owlfiles File Manager 12.0.1 - Multiple Vulnerabilities
24.3.23	Emotet Epoch 4 activity	Malware traffic	Malware traffic	Zip files are password-protected. If you don't know the password, see the "about" page of this website.
23.3.23	SiestaGraph	Malware		NAPLISTENER: more bad dreams from developers of SIESTAGRAPH
23.3.23	DoorMe	Malware		Update to the REF2924 intrusion set and related campaigns
23.3.23	NAPLISTENER	Malware	Malware	This unique malware sample contains a C# class called MsEXGHealthd that consists of three methods: Main, SetRespHeader, and Listener.
23.3.23	CVE-2023-28756	Vulnerebility	CVE	CVE
23.3.23	CVE-2023-28755	Vulnerebility	CVE	CVE
23.3.23	CVE-2023-1145	Vulnerebility	CVE	CVE
23.3.23	CVE-2023-1139	Vulnerebility	CVE	CVE
23.3.23	CVE-2023-1133	Vulnerebility	CVE	CVE
23.3.23	VIRTUALGATE (Windows)	Malware	Windows	The Windows guest virtual machines which were hosted by the infected hypervisors also contained a unique malware sample located at C:\Windows\Temp\avp.exe.
23.3.23	VIRTUALPITA (LINUX)	Malware	LINUX	Mandiant discovered two (2) additional VIRTUALPITA samples listening on TCP port 7475 that were persistent as an init.d startup service on Linux vCenter systems.
23.3.23	VIRTUALPIE (VMware ESXi)	Malware	VMware ESXi	VIRTUALPIE is a lightweight backdoor written in Python that spawns a daemonized IPv6 listener on a hardcoded port on a VMware ESXi server
23.3.23	VIRTUALPITA (VMware ESXi)	Malware	VMware ESXi	VIRTUALPITA is a 64-bit passive backdoor that creates a listener on a hardcoded port number on a VMware ESXi server.
23.3.23	CVE-2022-41328	Vulnerebility	CVE	A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through
23.3.23	Mispadu	Malware	Banking	According to ESET Research, Mispadu is an ambitious Latin American banking trojan that utilizes McDonald’s malvertising and extends its attack surface to web browsers.
23.3.23	DOTRUNPEX	Malware	RAT	DEMYSTIFYING NEW VIRTUALIZED .NET INJECTOR USED IN THE WILD
23.3.23	Emotet Epoch 5 activity	Malware traffic	Malware traffic	Zip files are password-protected. If you don't know the password, see the "about" page of this website.
23.3.23	Epoch 5 activity: Emotet now also using OneNote files	Malware traffic	Malware traffic	Zip files are password-protected. If you don't know the password, see the "about" page of this website.
23.3.23	PowerMagic	Malware	Backdoor	Bad magic: new APT found in the area of Russo-Ukrainian conflict
23.3.23	Linksys AX3200 V1.1.00 - Command Injection	Exploit	Hardware	Linksys AX3200 V1.1.00 - Command Injection
23.3.23	SoX 14.4.2 - Denial Of Service	Exploit	Hardware	SoX 14.4.2 - Denial Of Service
23.3.23	VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities	Exploit	PHP	VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities
23.3.23	ShellBot	Malware	Linux	ShellBot Malware Being Distributed to Linux SSH Servers
18.3.23	BrasDex	Malware	Android	The mobile malware landscape of the LATAM region, more specifically Brazil, has recently risen to prominence in the news due to families like Brata and Amextroll, extending their reach all the way to Europe.
18.3.23	PixPirate	Malware	Android	Between the end of 2022 and the beginning of 2023, a new Android banking trojan was discovered by the Cleafy TIR team.
17.3.23	SCARLETEEL	Operation	Operation	A sophisticated attack campaign dubbed SCARLETEEL is targeting containerized environments to perpetrate theft of proprietary data and software.
17.3.23	PROXYSHELLMINER CAMPAIGN	Operation	Operation	Morphisec has recently identified a highly evasive malware campaign delivering ProxyShellMiner to Windows endpoints.
17.3.23	SILKLOADER	Malware	Malware	Malware
16.3.23	CVE-2023-26360	Vulnerebility	CVE	CVE
16.3.23	CVE-2019-18935	Vulnerebility	CVE	Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function
16.3.23	CVE-2017-11317	Vulnerebility	CVE	Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption,
16.3.23	CVE-2017-11357	Vulnerebility	CVE	Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
15.3.23	CVE-2023-23397	Vulnerebility	CVE	Microsoft Outlook Elevation of Privilege Vulnerability
15.3.23	CVE-2023-24880	Vulnerebility	CVE	Windows SmartScreen Security Feature Bypass Vulnerability
15.3.23	CVE-2022-44698	Vulnerebility	CVE	Windows SmartScreen Security Feature Bypass Vulnerability
15.3.23	CVE-2023-23392	Vulnerebility	CVE	HTTP Protocol Stack Remote Code Execution Vulnerability
15.3.23	CVE-2023-23415	Vulnerebility	CVE	Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability
15.3.23	CVE-2023-21708	Vulnerebility	CVE	Remote Procedure Call Runtime Remote Code Execution Vulnerability
15.3.23	CVE-2023-24882	Vulnerebility	CVE	Microsoft OneDrive for Android Information Disclosure Vulnerability
15.3.23	CVE-2023-24923	Vulnerebility	CVE	Microsoft OneDrive for Android Information Disclosure Vulnerability
15.3.23	CVE-2023-23391	Vulnerebility	CVE	Office for Android Spoofing Vulnerability
15.3.23	CVE-2023-24890	Vulnerebility	CVE	Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
15.3.23	CVE-2023-24930	Vulnerebility	CVE	CVE
15.3.23	CVE-2023-1017	Vulnerebility	CVE	An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine.
15.3.23	CVE-2023-1018	Vulnerebility	CVE	An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine.
15.3.23		Vulnerebility	CVE	CVE
15.3.23	REDBALDKNIGHT	Malware	Backdoor	REDBALDKNIGHT a.k.a BRONZE BUTLER cyberespionage group employ the Daserf backdoor in campaigns. We found that Daserf was not only used on Japanese targets, but also against other countries.
15.3.23	ENDTRADE	Operation	Operation	We found cyberespionage group TICK targeting critical systems and enterprises to steal information.
15.3.23	YoroTrooper	Malware	Espionage	YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States (CIS), based on our analysis
15.3.23	Dero Cryptojacking Campaign	Operation	Cryptocurrency	CrowdStrike has discovered the first-ever Dero cryptojacking operation targeting Kubernetes infrastructure.
15.3.23	CVE-2022-41328	Vulnerebility	CVE	A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and
15.3.23	CVE-2023-25610	Vulnerebility	Vulnerebility	A buffer underwrite ('buffer underflow') vulnerability in FortiOS & FortiProxy administrative interface may allow a remote unauthenticated attacker to execute arbitrary code on
14.3.23	LummaC2 Stealer	Malware	Stealer	During a threat-hunting exercise, Cyble Research and Intelligence Labs (CRIL) discovered a post on the cybercrime forum about an information stealer targeting both Chromium and Mozilla-based browsers.
14.3.23	WhiteSnake Stealer	Malware	Stealer	Cyble Research and Intelligence Labs (CRIL) came across a new malware strain called “WhiteSnake” Stealer. The stealer was first identified on cybercrime forums at the beginning of this month.
14.3.23	ImBetter	Malware	Stealer	Threat Actors (TAs) employ sophisticated techniques to create phishing websites that are designed to appear legitimate and attractive to users.
14.3.23	R3NIN Sniffer Toolkit	Malware	Toolkit	Credit card sniffers are malicious codes usually programmed in JavaScript and designed to covertly steal payment card information and Personally Identifiable Information (PII)
13.3.23	KamiKakaBot	Malware	Malware	In February 2023, EclecticIQ researchers identified multiple KamiKakaBot malwares which are very likely used to target government entities in ASEAN (Association of Southeast Asian Nations) countries.
11.3.23	GoBruteforcer	Malware	Malware	According to researchers with Palo Alto Networks' Unit 42, who first spotted it in the wild and dubbed it GoBruteforcer, the malware is compatible with x86, x64, and ARM architectures.
11.3.23	Operation Dream Job	Operation	Operation	Hackers associated with the North Korean government have been distributing a trojanized version of the DeFi Wallet for storing cryptocurrency assets to
11.3.23	CVE-2021-39144	Vulnerebility	('Code Injection')	XStream is a simple library to serialize objects to XML and back again.
11.3.23	(AiTM) phishing attack	Attack	Attack	An AiTM attack typically involves a threat actor attempting to steal and intercept a target’s password and session cookies by deploying a proxy server between the user and the website.
11.3.23	CVE-2023-27532	Vulnerebility	CVE	Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
11.3.23	BATLOADER	Malware	Malware	BATLOADER, as the name suggests, is a loader that's responsible for distributing next-stage malware such as information stealers, banking malware, Cobalt Strike, and even ransomware.
10.3.23	TinyShell	Malware	Trojan	A Trojan for Winows with the same code structure and functionalities of elf.rekoobe, for Linux environment instead.
10.3.23	NetWire	Malware	RAT	Netwire is a RAT, its functionality seems focused on password stealing and keylogging, but includes remote control capabilities as well.
10.3.23	LIGHTSHOW	Malware	Malware	In June 2022, Mandiant Managed Defense detected and responded to an UNC2970 phishing campaign targeting a U.S.-based technology company.
10.3.23	LIGHTSHIFT	Malware	Malware	In part one on North Korea's UNC2970, we covered UNC2970’s tactics, techniques and procedures (TTPs) and tooling that they used over the course of multiple intrusions.
10.3.23	Xenomorph	Malware	RAT	Xenomorph is a Android Banking RAT developed by the Hadoken.Security actor.
10.3.23	2023-03-07 -- Emotet infection with spambot traffic	Malware traffic analysis	Malware traffic analysis	Zip files are password-protected. If you don't know the password, see the "about" page of this website.
10.3.23	2023-03-08 -- IcedID (Bokbot) infection with BackConnect & VNC traffic	Malware traffic analysis	Malware traffic analysis	Infection traffic started on 2023-03-08 shortly after 02:00 UTC, but this wave of malspam & malware is from Tuesday 2023-03-07. Zip files are password-protected. If you don't know the password, see the "about" page of this website.
10.3.23	2023-03-06 -- Gozi (ISFB/Ursnif) activity targeting Italy	Malware traffic analysis	Malware traffic analysis	Zip files are password-protected. If you don't know the password, see the "about" page of this website.
10.3.23	PlugX	Malware	Malware	PlugX malware through the Chinese remote control programs Sunlogin and Awesun’s remote code execution vulnerability.
8.3.23	CVE-2022-35914	Vulnerebility	('Injection')	/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
8.3.23	CVE-2022-33891	Vulnerebility	('Command Injection')	The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable.
8.3.23	CVE-2022-28810	Vulnerebility	('OS Command Injection')	Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature
8.3.23	CVE-2021-39144	Vulnerebility	('Code Injection')	XStream is a simple library to serialize objects to XML and back again.
8.3.23	CVE-2022-31678	Vulnerebility	Improper Restriction of XML	VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability.
7.3.23	SYS01stealer	Malware	Stealer	We have seen SYS01 stealer attacking critical government infrastructure employees, manufacturing companies, and other industries.
7.3.23	CrimsonRat	Malware	RAT	CrimsonRAT is a remote access Trojan used to take remote control of infected systems and steal data. We know this particular RAT is used by the Transparent Tribe APT group.
7.3.23	CapraRAT	Malware	RAT	Most likely active since July 2022, the campaign has distributed CapraRAT backdoors through at least two similar websites, while representing them as untainted versions of those secure messaging apps.
6.3.23	ZuoRAT	Malware	RAT	According to Black Lotus Labs, ZuoRAT is a MIPS file compiled for SOHO routers that can enumerate a host and internal LAN, capture packets being transmitted over the infected device and perform person-in-the-middle attacks (DNS and HTTPS hijacking based on predefined rules).
6.3.23	HiatusRAT	Malware	RAT	Just nine months after discovering ZuoRAT – a novel malware targeting small office/home office (SOHO) routers – Lumen Black Lotus Labs®
4.3.23	ATMii	Malware	ATM Malware	While some criminals blow up ATMs to steal cash, others use less destructive methods, such as infecting the ATM with malware and then stealing the money.
4.3.23	Skimer	Malware	ATM Malware	Backdoor: Win32/Hesetox.A: vSkimmer POS Malware Analysis
4.3.23	ATMitch	Malware	ATM Malware	A look at the ATM/PoS malware landscape from 2017-2019
4.3.23	Alice	Malware	ATM Malware	The following table summarizes the properties of various ATM malware families that we have encountere.
4.3.23	RIPPER	Malware	ATM Malware	Cashing in on ATM Malware: A Comprehensive Look at Various Attack Types
4.3.23	GreenDispenser	Malware	ATM Malware	On the heels of recent disclosures of ATM malware such as Suceful [1], Plotus [2] and Padpin [3] (aka Tyupkin), Proofpoint research has discovered yet another variant of ATM malware, which we have dubbed GreenDispenser.
4.3.23	SUCEFUL	Malware	ATM Malware	If you answered ‘c’ you might be correct! FireEye Labs discovered a new piece of ATM malware (4BDD67FF852C221112337FECD0681EAC) that we detect as Backdoor.ATM.Suceful
4.3.23	Prilex	Malware	ATM Malware	Prilex is a Brazilian threat actor that has evolved out of ATM-focused malware into modular point-of-sale malware.
4.3.23	Ploutus	Malware	ATM Malware	Ploutus, one of the most sophisticated ATM malware families worldwide, is back with a new variant focused on Latin America.
4.3.23	FiXS	Malware	ATM Malware	ATMs are a core part of the financial system, providing users access to their money anytime at different physical locations.
3.3.23	CVE-2023-1018	Vulnerebility	Out-of-bounds Read	An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine.
3.3.23	CVE-2023-1017	Vulnerebility	Out-of-bounds Write	An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine.
3.3.23	MQsTTang	Malware	Backdoor	Mustang Panda is known for its customized Korplug variants (also dubbed PlugX) and elaborate loading chains.
3.3.23	TCG TPM2.0 implementations vulnerable to memory corruption	Alert	Alert	Two buffer overflow vulnerabilities were discovered in the Trusted Platform Module (TPM) 2.0 reference library specification, currently at Level 00, Revision 01.59 November 2019.
3.3.23	2023-03-02 -- Rig EK --> malware loader --> Redline Stealer	Malware traffic analysis	Malware traffic analysis	Zip files are password-protected. If you don't know the password, see the "about" page of this website.
2.3.23	SCARLETEEL	Operation	Operation	Operation leveraging Terraform, Kubernetes, and AWS for data theft
2.3.23	Rshell	Malware	Linux	Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users
2.3.23	HyperBro	Malware	RAT	HyperBro is a RAT that has been observed to target primarily within the gambling industries, though it has been spotted in other places as well.
2.3.23	SysUpdate	Malware	Malware	Sideloader used by EmissaryPanda
2.3.23	CVE-2023-20079	Vulnerebility	Vulnerebility	Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated,
2.3.23	CVE-2023-20078	Vulnerebility	Vulnerebility	Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated,
2.3.23	GootLoader	Malware	Malware	Gootloader Malware Leads to Cobalt Strike and Hand-on-Keyboard Activity
2.3.23	FAKEUPDATES	Malware	Malware	FAKEUPDATES is a downloader written in JavaScript that communicates via HTTP. Supported payload types include executables and JavaScript. It writes the payloads to disk prior to launching them.
1.3.23	BlackLotus	Malware	UEFI bootkit	The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality.
1.3.23	March(85)	Vulnerebility	CVE	CVE