Threats December

January(137) February(207) March(430) April(317) May(278) June(237) July(216) August(316) September(186) October(24) November(114) December(126)

DATE	NAME	INFO	CATEGORY	SUBCATE
31.12.24	SpyMax Targets Uzbek Mobile Users Through Fake Uzum Apps	In 24, a malicious actor exploited Uzum's brand in a series of campaigns targeting mobile users in Uzbekistan.	ALERTS	VIRUS
31.12.24	CVE-24-12686	A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.	VULNEREBILITY	VULNEREBILITY
31.12.24	CVE-24-12356	A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.	VULNEREBILITY	VULNEREBILITY
31.12.24	Dirty DAG	Dirty DAG: New Vulnerabilities in Azure Data Factory’s Apache Airflow Integration	VULNEREBILITY	VULNEREBILITY
30.12.24	Ficora and Capsaicin botnets leverage old vulnerabilities for distribution	According to the researchers from Fortinet, two Linux botnet variants Ficora and Capsaicin have been distributed in recently observed campaigns.	ALERTS	BOTNET
28.12.24	Skuld Infostealer malware continues to target developers via npm registry	A malware campaign deploying the Skuld infostealer via the npm registry has been reported, targeting developers with ambiguous packages.	ALERTS	VIRUS
28.12.24	Gosar - a new Golang-based variant of Quasar backdoor	Gosar is a recently identified Golang-based variant of the Quasar backdoor.	ALERTS	VIRUS
28.12.24	Latest XWorm distribution campaign targets the hospitality sector	A new campaign distributing the XWorm commodity malware has been reported in the wild.	ALERTS	VIRUS
28.12.24	Recent I2PRAT malware variant leverages anonymous peer-to-peer network communication	The latest I2PRAT malware variant has been observed to leverage I2P anonymous peer-to-peer network for the purpose of C2 communication.	ALERTS	VIRUS
28.12.24	CVE-24-12856	The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability.	VULNEREBILITY	VULNEREBILITY
28.12.24	OtterCookie	OtterCookie, a new malware used by Contagious Interview	MALWARE	JavaScript
28.12.24	Cloud Atlas	Cloud Atlas seen using a new tool in its attacks	GROUP	GROUP
28.12.24	CVE-24-3393	CVE-24-3393 PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet	VULNEREBILITY	VULNEREBILITY
28.12.24	CAPSAICIN	Botnets Continue to Target Aging D-Link Vulnerabilities	BOTNET	BOTNET
28.12.24	CVE-24-52046	The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-47146	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically adjacent and sniffing the RAW WIFI signal.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-52324	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-48874	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-46874	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-47791	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receive partial messages being sent to and from devices.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-45722	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentials.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-47043	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and part of the email address.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-51727	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-service attack on a user's account.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-42494	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-47547	Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-45387	An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal",	VULNEREBILITY	VULNEREBILITY
26.12.24	BellaCPP	BellaCPP: Discovering a new BellaCiao variant written in C++	MALWARE	Malware
26.12.24	CVE-2021-44207	Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-50379	Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).	VULNEREBILITY	VULNEREBILITY
26.12.24	CVE-24-56337	Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.	VULNEREBILITY	VULNEREBILITY
26.12.24	FlowerStorm	Phishing platform Rockstar 2FA trips, and “FlowerStorm” picks up the pieces	PHISHING	PHAAS
22.12.24	HeartCrypt	HeartCrypt was originally discovered through underground forums and reported by security researchers in February and March 24.	MALWARE	Crypto
22.12.24	WezRat	The latest version of WezRat was recently distributed to multiple Israeli organizations in a wave of emails impersonating the Israeli National Cyber Directorate (INCD).	MALWARE	RAT
21.12.24	CookiePlus Malware	Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware	MALWARE	Backdoor
21.12.24	24-12 Reference Advisory: Session Smart Router: Mirai malware found on systems when the default password remains unchanged	On Wednesday, December 11, 24, several customers reported suspicious behavior on their Session Smart Network (SSN) platforms.	BOTNET	BOTNET
21.12.24	cShell DDoS Bot Attack	ASEC recently identified a new DDoS malware strain targeting Linux servers while monitoring numerous external attacks.	HACKING	HACKING
21.12.24	CVE-2023-48788	(CVSS score: 9.3) - Fortinet FortiClient EMS SQL Injection Vulnerability	VULNEREBILITY	VULNEREBILITY
21.12.24	CVE-2021-44529	(CVSS score: 9.8) - Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability	VULNEREBILITY	VULNEREBILITY
21.12.24	CVE-2019-7256	(CVSS score: 10.0) - Nice Linear eMerge E3-Series OS Command Injection Vulnerability	VULNEREBILITY	VULNEREBILITY
21.12.24	CVE-24-12356	BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability	VULNEREBILITY	VULNEREBILITY
21.12.24	CVE-24-12727	(CVSS score: 9.8) - A pre-auth SQL injection vulnerability in the email protection feature that could lead to remote code execution,	VULNEREBILITY	VULNEREBILITY
21.12.24	CVE-24-12728	(CVSS score: 9.8) - A weak credentials vulnerability arising from a suggested and non-random SSH login passphrase for High Availability (HA)	VULNEREBILITY	VULNEREBILITY
21.12.24	CVE-24-12729	(CVSS score: 8.8) - A post-auth code injection vulnerability in the User Portal that allows authenticated users to gain remote code execution.	VULNEREBILITY	VULNEREBILITY
21.12.24	CVE-2023-48782	(CVSS score: 8.8), an authenticated command injection flaw that has also been fixed in FortiWLM 8.6.6, to obtain remote code execution in the context of root.	VULNEREBILITY	VULNEREBILITY
21.12.24	CVE-2023-34990	[FortiWLM] Unauthenticated limited file read vulnerability	VULNEREBILITY	VULNEREBILITY
18.12.24	HubPhish	Effective Phishing Campaign Targeting European Companies and Organizations	CAMPAIGN	Phishing
18.12.24	CVE-24-53677	File upload logic in Apache Struts is flawed.	VULNEREBILITY	VULNEREBILITY
18.12.24	Earth Koshchei	Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks	APT	APT
18.12.24	CVE-24-12356	A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.	VULNEREBILITY	VULNEREBILITY
18.12.24	CryptoRom	Sha zhu pan scam uses AI chat tool to target iPhone and Android users	SPAM	SPAM
18.12.24	DarkGate	Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion	MALWARE	RAT
18.12.24	FLUX#CONSOLE	Analyzing FLUX#CONSOLE: Using Tax-Themed Lures, Threat Actors Exploit Windows Management Console to Deliver Backdoor Payloads	MALWARE	Backdoor
17.12.24	TA397	Proofpoint observed advanced persistent threat (APT) TA397 targeting a Turkish defense sector organization with a lure about public infrastructure projects in Madagascar.	GROUP	GROUP
17.12.24	BITTER APT	BITTER APT Targets Chinese Government Agency	APT	APT
17.12.24	WmRAT	Until 2016, the foreign security manufacturer Forcepoint disclosed the existence of the Manlinghua organization for the first time	MALWARE	RAT
17.12.24	MiyaRAT	Bitter Group Launches New Trojan Miyarat, Domestic Users Become Primary Ttargets	MALWARE	RAT
17.12.24	CoinLurker	CoinLurker: The Stealer Powering the Next Generation of Fake Updates	MALWARE	STEALER
17.12.24	Mask APT	Careto is back: what’s new after 10 years of silence?	APT	APT
17.12.24	CVE-24-20767	(CVSS score: 7.4) - Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel (Patched by Adobe in March 24)	VULNEREBILITY	CVE
17.12.24	CVE-24-35250	(CVSS score: 7.8) - Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges (Patched by Microsoft in June 24)	VULNEREBILITY	CVE
17.12.24	DrayTek Routers	DrayTek Routers Exploited in Massive Ransomware Campaign: Analysis and Recommendations	EXPLOIT	EXPLOIT
16.12.24	DeceptionAds	“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising	CAMPAIGN	MALWARETISING
16.12.24	NoviSpy	“A Digital Prison”: Surveillance and the suppression of civil society in Serbia	MALWARE	ANDROID
16.12.24	Glutton	Glutton: A New Zero-Detection PHP Backdoor from Winnti Targets Cybercrimals	MALWARE	BACKDOOR
16.12.24	Melofee	New Zero-Detection Variant of Melofee Backdoor from Winnti Strikes RHEL 7.9	MALWARE	BACKDOOR
16.12.24	BADBOX	BADBOX Botnet Is Back	BOTNET	BOTNET
14.12.24	Yokai	New Yokai Side-loaded Backdoor Targets Thai Officials	MALWARE	BACKDOOR
14.12.24	NodeLoader	NodeLoader Exposed: The Node.js Malware Evading Detection	MALWARE	LOADER
14.12.24	MUT-1244	Getting a taste of your own medicine: Threat actor MUT-1244 targets offensive actors, leaking hundreds of thousands of credentials	GROUP	GROUP
13.12.24	CVE-24-54143	openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters.	VULNEREBILITY	CVE
13.12.24	IOCONTROL	Team82 obtained a sample of a custom-built IoT/OT malware called IOCONTROL used by Iran-affiliated attackers to attack Israel- and U.S.-based OT/IoT devices.	MALWARE	IoT
13.12.24	PUMAKIT	PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with command-and-control servers.	MALWARE	ROOTKIT
12.12.24	BoneSpy	Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT	MALWARE	ANDROID
12.12.24	PlainGnome	Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT	MALWARE	ANDROID
12.12.24	Gamaredon	Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware.	GROUP	APT
12.12.24	CVE-24-44131	Unauthorized access to iCloud: analyzing an iOS vulnerability that could expose sensitive data to attackers	VULNEREBILITY	CVE
12.12.24	CVE-24-11972	Unauthorized Plugin Installation/Activation in Hunk Companion	VULNEREBILITY	CVE
11.12.24	Secret Blizzard	Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine	GROUP	GROUP
11.12.24	Kazuar	Upgraded Kazuar Backdoor Offers Stealthy Power	MALWARE	BACKDOOR
11.12.24	Windows UI Automation	Teaching an Old Framework New Tricks: The Dangers of Windows UI Automation	HACKING	HACKING
11.12.24	Microsoft Azure MFA Bypass	Oasis Security Research Team Discovers Microsoft Azure MFA Bypass	VULNEREBILITY	CVE
11.12.24	Zloader’s	Inside Zloader’s Latest Trick: DNS Tunneling	MALWARE	TROJAN
11.12.24	EagleMsgSpy	Lookout Discovers New Chinese Surveillance Tool Used by Public Security Bureaus	MALWARE	SPYWARE
11.12.24	Rakshasa	Likely China-based Attackers Target High-profile Organizations in Southeast Asia	APT	APT
11.12.24	CVE-24-11639	(CVSS score: 10.0) - An authentication bypass vulnerability in the admin web console of Ivanti CSA before 5.0.3 that allows a remote unauthenticated attacker to gain administrative access	VULNEREBILITY	CVE
11.12.24	CVE-24-11772	(CVSS score: 9.1) - A command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.3 that allows a remote authenticated attacker with admin privileges to achieve remote code execution	VULNEREBILITY	CVE
11.12.24	CVE-24-11773	(CVSS score: 9.1) - An SQL injection vulnerability in the admin web console of Ivanti CSA before version 5.0.3 that allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements	VULNEREBILITY	CVE
11.12.24	CVE-24-11633	(CVSS score: 9.1) - An argument injection vulnerability in Ivanti Connect Secure before version 22.7R2.4	VULNEREBILITY	CVE
11.12.24	CVE-24-11634	(CVSS score: 9.1) - A command injection vulnerability in Ivanti Connect Secure before version 22.7R2.3	VULNEREBILITY	CVE
11.12.24	CVE-24-8540	(CVSS score: 8.8) - An insecure permissions vulnerability in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0	VULNEREBILITY	CVE
10.12.24	CVE-24-55956	In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can	VULNEREBILITY	CVE
10.12.24	Antidot	AppLite: A New AntiDot Variant Targeting Mobile Employee Devices	MALWARE	BANKING
10.12.24	Operation Digital Eye	Operation Digital Eye \| Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels	OPERATION	APT
10.12.24	Operation Soft Cell	Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers	OPERATION	APT
10.12.24	Operation Tainted Love	Operation Tainted Love \| Chinese APTs Target Telcos in New Attacks	OPERATION	APT
09.12.24	Drops Zbot	Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware	CAMPAIGN	RANSOMWARE
09.12.24	Socks5Systemz	PROXY.AM Powered by Socks5Systemz Botnet	BOTNET	BOTNET
07.12.24	Realst	Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows	MALWARE	STEALER
06.12.24	Pegasus	iVerify Mobile Threat Investigation Uncovers New Pegasus Samples	MALWARE	MOBILE
06.12.24	Exploiting ML Clients and “Safe” Model Formats	Machine Learning Bug Bonanza – Exploiting ML Clients and “Safe” Model Formats	AI
06.12.24	CVE-24-27132	(CVSS score: 7.2) - An insufficient sanitization issue in MLflow that leads to a cross-site scripting (XSS) attack when running an untrusted recipe in a Jupyter Notebook,	VULNEREBILITY	CVE
06.12.24	CVE-24-6960	(CVSS score: 7.5) - An unsafe deserialization issue in H20 when importing an untrusted ML model, potentially resulting in RCE	VULNEREBILITY	CVE
06.12.24	CVE-2023-5245	(CVSS score: 7.5) - A path traversal issue in MLeap when loading a saved model in zipped format can lead to a Zip Slip vulnerability,	VULNEREBILITY	CVE
06.12.24	Venom	Unveiling RevC2 and Venom Loader	MALWARE	LOADER
06.12.24	GammaDrop	BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure	MALWARE	DROPPER
06.12.24	DroidBot	DroidBot: Insights from a new Turkish MaaS fraud operation	MALWARE	ANDROID
06.12.24	CVE-24-41713	A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201)	VULNEREBILITY	CVE
05.12.24	MOONSHINE	MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks	EXPLOIT	EXPLOIT KIT
05.12.24	Earth Kasha Spear	Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 24	CAMPAIGN	PHISHING
05.12.24	CVE-24-51378	(CVSS score: 10.0) - An incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property	VULNEREBILITY	CVE
05.12.24	CVE-2023-45727	(CVSS score: 7.5) - An improper restriction of XML External Entity (XXE) reference vulnerability that could allow a remote,	VULNEREBILITY	CVE
05.12.24	CVE-24-11680	(CVSS score: 9.8) - An improper authentication vulnerability that allows a remote, unauthenticated attacker to create accounts,	VULNEREBILITY	CVE
05.12.24	CVE-24-11667	(CVSS score: 7.5) - A path traversal vulnerability in the web management interface that could allow an attacker to download or	VULNEREBILITY	CVE
04.12.24	Snowblind	Snowblind: The Invisible Hand of Secret Blizzard	APT	APT
04.12.24	Secret Blizzard	Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage	CAMPAIGN	ESPIONAGE
04.12.24	CVE-24-42448	From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.	VULNEREBILITY	CVE
04.12.24	CVE-24-10905	IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8,	VULNEREBILITY	CVE
04.12.24	ANY.RUN	The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook's spam filters, allowing the malicious emails to reach your inbox	EXPLOIT	EXPLOIT
03.12.24	CVE-2014-2120	Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject	VULNEREBILITY	CVE
03.12.24	CVE-24-5921	(CVSS score: 5.6) - An insufficient certificate validation vulnerability impacting Palo Alto Networks GlobalProtect for Windows, macOS,	VULNEREBILITY	CVE
03.12.24	CVE-24-29014	(CVSS score: 7.1) - A vulnerability impacting SonicWall SMA100 NetExtender Windows client that could allow an attacker to execute	VULNEREBILITY	CVE
03.12.24	Kimsuky	Analysis of Kimsuky Threat Actor's Email Phishing Campaign	APT	APT
03.12.24	NetSupport RAT	Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT	MALWARE	RAT
03.12.24	BurnsRAT	Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT	MALWARE	RAT
02.12.24	SmokeLoader	SmokeLoader Attack Targets Companies in Taiwan	MALWARE	LOADER
02.12.24	SpyLoan	SpyLoan: A Global Threat Exploiting Social Engineering	MALWARE	SPYWARE