ALERT

ALERTS

HOME AI APT BOTNET CAMPAIGN CRIME CRYPTOCURRENCY EXPLOIT HACKING GROUP OPERATION PHISHING RANSOM SPAM VIRUS VULNEREBILITY | March(16) April(92) May(99) June(94) July(88) August(112) SEPTEMBER(67)

DATE	NAME	CATEGORY	SUBCATE	INFO
1.11.24	New variant of FakeCall Android malware	ALERTS	VIRUS	A new variant of the Android malware called FakeCall has been observed in the wild. The attackers behind this malware employ voice phishing (vishing) techniques in order to trick victims into disclosing sensitive information such as credentials or banking information. While abusing the Android Accessibility Service, FakeCall grants the attackers a considerable remote control over the infected devices, allowing them to simulate user actions, intercept incoming or outgoing calls, manipulate the devices' camera, etc. FakeCall also allows for collection of user contacts, call logs or SMS messages from the compromised devices. The collected data is then forwarded to the C2 servers controlled by the attackers.
1.11.24	Sauron - a new ransomware variant in the wild	ALERTS	RANSOM	Sauron is a new ransomware variant recently found in the wild. The malware appends ".sauron" extension to the encrypted files. The ransom note is dropped in form of a text file called "#HowToRecover.txt" on the affected machines. The attackers request to contact them via the provided email address and the ransom is demanded in form of Bitcoin cryptocurrency payment. The malware is also able to change the desktop wallpaper to inform the victims that the files have been encrypted. Sauron has the functionality to delete Volume Shadow Copies from the infected machines in an effort to prevent the victims from recovering the data.
1.11.24	UNC5812 campaigns against Ukraine with Android and Windows malware	ALERTS	GROUP	A recent report highlighted activity attributed to a suspected Russian threat actor identified as UNC5812. The activity involved distributions of Android and Windows malware targeting Ukranian military recruits. The intent of the campaign was not only to engage in espionage but also attempt to negatively influence support for pro-Ukranian forces.
1.11.24	A possible Bumblebee Loader resurgence	ALERTS	VIRUS	A new campaign delivering the Bumblebee loader has been reported this month. Bumblebee is a highly sophisticated downloader variant discovered initially back in 2022. The malware has been spread across a multitude of malicious campaigns and used for the delivery and execution of miscellaneous payloads such as Cobalt Strike, ransomware, etc. Since the botnet disruption campaign called Operation Endgame, conducted by Europol in May 2024, Bumblebee has not been observed up until now. The new Bumblebee infection chain incorporates malicious .zip archives, PowerShell commands, .lnk and .msi files, all leading to payloads deployed in form of .dll binaries.
1.11.24	CVE-2024-40711 - Veeam Backup and Replication deserialization vulnerability exploited by ransomware actors	ALERTS	VULNEREBILITY	CVE-2024-40711 is a recently disclosed critical (CVSS score 9.8) deserialization vulnerability affecting the Veeam Backup and Replication software in version 12.1.2.172 or older. If successfully exploited the flaw might provide unauthenticated attackers with remote code execution (RCE) on the vulnerable systems. The vulnerability has been reported as being exploited in the wild by the Akira and Fog ransomware threat groups. Following those reports, CVE-2024-40711 has also been added to the CISA's Known Exploited Vulnerabilities (KEV) catalog.
1.11.24	Malicious "Lounge Pass" app targets air travelers in India	ALERTS	VIRUS	A campaign involving a malicious Android app called "Lounge Pass" targeting air travelers at Indian airports has been observed. Distributed through fake domains, the app intercepts and forwards SMS messages from victims' devices to cybercriminals, leading to significant financial losses. The scammers exploited an exposed Firebase endpoint to store the stolen SMS messages. To prevent data theft, it’s recommended to download apps only from official stores and to refrain from granting SMS access to travel or lounge apps.
1.11.24	Adware Campaign uses Fake CAPTCHA to deliver Lumma and Amadey malware	ALERTS	VIRUS	Threat actors are increasingly using fake CAPTCHA as an initial attack vector. A recent adware campaign is targeting online users by presenting them with fake CAPTCHA or update prompts. Attackers are leveraging ad networks to redirect victims to compromised sites that host these social engineering lures. Once lured, victims are triggering PowerShell commands that deploy credential-stealing malware such as Lumma which harvests cryptocurrency wallets, passwords and browser data, or Amadey, which gathers credentials and can deploy Remcos RAT.
1.11.24	TeamTNT targets cloud-native environments in new Cryptojacking campaign	ALERTS	CRYPTOCURRENCY	A new campaign by the cryptojacking group TeamTNT has been reported targeting cloud-native environments for cryptocurrency mining and reselling compromised servers. They exploit exposed Docker daemons to deploy Sliver malware, cyber worms and cryptominers, gaining access through exposed Docker ports and using compromised Docker Hub accounts to spread malware and rent out victims' computational power.
1.11.24	Rekoobe malware found potentially targeting TradingView users	ALERTS	VIRUS	An open directory has been discovered hosting Rekoobe malware, potentially aimed at targeting TradingView users along with other cyber espionage campaigns. Rekoobe is a versatile backdoor previously deployed by APT31 and other adversaries engaged in cyber espionage and data theft. Based partially on the publicly available Tiny SHell, the malware has evolved to incorporate enhanced encryption techniques and unique command-and-control configurations, making analysis and detection more difficult.
1.11.24	Daggerfly targets Taiwanese entities with new CloudScout Toolset	ALERTS	APT	China-linked threat actor Daggerfly (also known as Evasive Panda) has been reported targeting a government entity and a religious organization in Taiwan with a previously undocumented post-compromise toolset called CloudScout. This toolset can retrieve data from various cloud services by leveraging stolen web session cookies. Additionally, CloudScout integrates seamlessly with MgBot, Evasive Panda's signature malware framework.
1.11.24	Daggerfly targets Taiwanese entities with new CloudScout Toolset	ALERTS	VIRUS	Researchers have recently uncovered a malicious campaign spreading the XWorm RAT trojan via fake emails posing as official communications from Namirial, a software and service company. The emails prompt users to open a password-protected PDF, and if it fails, directs them to a Dropbox link that downloads a ZIP file containing a URL that would connect to the attacker's servers and download additional malicious scripts, enabling control over the victim's machine.
1.11.24	Phishing Campaign Distributing XWorm RAT	ALERTS	PHISHING	Researchers have recently uncovered a malicious campaign spreading the XWorm RAT trojan via fake emails posing as official communications from Namirial, a software and service company. The emails prompt users to open a password-protected PDF, and if it fails, directs them to a Dropbox link that downloads a ZIP file containing a URL that would connect to the attacker's servers and download additional malicious scripts, enabling control over the victim's machine.
1.11.24	HeptaX Cyberattack Operations	ALERTS	OPERATION	A researcher recently identified a multi-stage cyberattack targeting the healthcare industry, initiated through a ZIP file containing a malicious shortcut (.lnk) file, likely spread via phishing emails. When executed, the LNK file runs a PowerShell command that downloads additional payloads including scripts and BAT files from a remote server. These scripts create a new administrative user account and alter RDP settings to reduce authentication requirements, allowing attackers to gain remote access for further malicious actions such as data theft and malware installation.
27.10.24	Multiple vulnerabilities affecting Palo Alto Networks Expedition	ALERTS	VULNEREBILITY	Multiple vulnerabilities affecting Palo Alto Networks Expedition have been disclosed this month. The reported flaws (CVE-2024-9463, CVE-2024-9464, CVE-2024-9465, CVE-2024-9466, CVE-2024-9467) have been rated between CVSS 7.0 and CVSS 9.9 and include a mix of command injection, cross-site scripting (XSS), cleartext storage of sensitive information, missing authentication, and SQL injection vulnerabilities. If exploited they could allow the attackers to read database contents in addition to writing arbitrary files to temporary storage locations on the vulnerable system, among others. The vulnerabilities have already been addressed by the product vendor in the application version 1.2.96 or later.
27.10.24	CVE-2024-47575 - Fortinet FortiManager Missing Authentication vulnerability	ALERTS	VULNEREBILITY	CVE-2024-47575 is a Zero-day vulnerability affecting Fortinet FortiManager, that has been disclosed just this month. The vulnerability has been rated with a critical CVSS score of 9.8. If successfully exploited, it could allow remote unauthenticated attackers to execute arbitrary code via specially crafted requests. The flaw has been reported as being exploited in the wild attacks since at least June 2024. Following those reports, it has also been added to the CISA's Known Exploited Vulnerabilities (KEV) catalog just this week.
27.10.24	Parano Stealer	ALERTS	VIRUS	Parano Stealer is another "run-of-the-mill" infostealer variant recently observed in the wild. This Python-based malware has functionality to collect and exfiltrate various information from the compromised endpoints, including: credentials, cookies, miscellaneous data stored in web browsers, cryptocurrency wallets, system information or data from various 3rd party applications like Steam, Telegram or Discord.
27.10.24	Liberium RAT malware	ALERTS	VIRUS	Liberium RAT (also known as ShadowRoot) is a malware variant recently advertised for sale on hacking forums. The malware has the capabilities allowing the attackers remote access to the vulnerable endpoints, file management operations, registry manipulation as well as theft of system related information and other confidential data.
27.10.24	CVE-2024-38094 - Microsoft SharePoint Deserialization vulnerability exploited in the wild	ALERTS	VULNEREBILITY	CVE-2024-38094 is a deserialization vulnerability affecting Microsoft SharePoint, which was initially disclosed and patched back in July 2024. The flaw rated with a CVSS score of 7.2 arises from the product deserializing data without enough verification that the resulting data output will be valid. Successful exploitation of this flaw could allow the attackers to inject and execute arbitrary code withing the context of the vulnerable application. Following the public reports of this vulnerability being exploited in the wild, it has been added to the CISA's Known Exploited Vulnerabilities (KEV) catalog just this week.
27.10.24	Prometei botnet activity	ALERTS	BOTNET	New Prometei botnet activity has been reported in the wild. The botnet has been historically used mostly for Monero cryptomining operations but with time the attackers behind it updated the botnet capabilities to conduct even more complex attacks, allowing for a full control over the infected machines a well as additional arbitrary payload deployments. Prometei distribution campaigns often leverage exploitation of previously disclosed RCP or SMB vulnerabilities, usage of domain generation algorithm (DGA) mechanisms for C2 communication as well as webshell deployments within the attack chain.
27.10.24	DarkComet Backdoor	ALERTS	VIRUS	DarkComet is a powerful Remote Access Trojan (RAT) that remains a significant threat because of its stealthy operations and comprehensive functionality. It enables attackers to remotely control infected devices, exfiltrate sensitive data, and deploy further malware. It can evade detection by altering file attributes, manipulating registry keys and escalating privileges. Additionally, it communicates with a command-and-control (C2) server to carry out various commands including capturing keystrokes and controlling display devices.
27.10.24	Threat actors distribute WarmCookie malware via various campaigns	ALERTS	VIRUS	WarmCookie is malware that has been observed being distributed through various campaigns, including malicious emails. This malware provides initial access to a compromised victim and is used to establish persistence. Additional functionality associated with WarmCookie includes remote command execution, file system manipulation, and payload delivery, among others. A recent report by Cisco Talos provides a technical analysis as well as data to support attribution of the malware to the threat actor group TA866.
27.10.24	Crystal Rans0m: Rust-Based Hybrid Ransomware	ALERTS	RANSOM	Crystal Rans0m is a Rust-based hybrid ransomware that combines file encryption with data-stealing capabilities that has been observed targeting Italy and Russia. The malware can steal browser data, Discord tokens, Steam files, Riot Games data and utilizes Discord webhooks for data exfiltration. It also employs anti-VM and anti-debugging techniques. The ransom note demands payment in Monero and provides a Session ID for communication.
27.10.24	CVE-2024-9680 - Mozilla Firefox Remote Code Execution vulnerability	ALERTS	VULNEREBILITY	CVE-2024-9680 is a recently disclosed Remote Code Execution (RCE) vulnerability affecting Mozilla Firefox and Thunderbird software. The vulnerability has been assigned a critical CVSS score of 9.8 and arises from a "use-after-free" flaw in the animation timeline component of the browser. Successful exploitation might allow the attackers to run arbitrary and potentially malicious code within the content process of the browser. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating reports of an active exploitation in the wild. The flaw has already been addressed in latest software versions released by Mozilla.
27.10.24	Phemedrone Stealer	ALERTS	VIRUS	Phemedrone is an open-source infostealer variant observed being distributed in the wild this year. The malware is written in C# and has the functionality to collect and exfiltrate various sensitive information such as login credentials, data stored in browsers, cookies, credit card information, cryptocurrency wallets, files stored in "My Documents" folders or data from other 3rd party apps such as Steam, Discord or Telegram.
27.10.24	Phemedrone Stealer	ALERTS	VIRUS	Earlier this year, Akira developed a new version of its ransomware encryptor and has since been observed using another novel iteration of the encryptor that targets both Windows and Linux systems. Akira typically employs a double-extortion tactic, exfiltrating critical data before encrypting the victim's systems. However, starting in early 2024, the group appears to be shifting away from encryption tactics, focusing solely on data exfiltration.
27.10.24	Akira Ransomware Evolution: A move towards cross-platform adaptability	ALERTS	RANSOM	Earlier this year, Akira developed a new version of its ransomware encryptor and has since been observed using another novel iteration of the encryptor that targets both Windows and Linux systems. Akira typically employs a double-extortion tactic, exfiltrating critical data before encrypting the victim's systems. However, starting in early 2024, the group appears to be shifting away from encryption tactics, focusing solely on data exfiltration.
27.10.24	Ghostpulse Malware: Shifting tactics from PNGs to Pixel values	ALERTS	VIRUS	According to recent reports, Ghostpulse malware has evolved its tactics by shifting from hiding its encrypted configuration and payload in the IDAT chunk of PNG files, to embedding it directly within the pixel values themselves to evade detection. In recent campaigns, attackers have employed social engineering techniques such as CAPTCHA validations to deceive users which ultimately triggers malicious commands via Windows keyboard shortcuts.
27.10.24	CVE-2024-28987 - SolarWinds Web Help Desk Hardcoded Credential vulnerability	ALERTS	VULNEREBILITY	CVE-2024-28987 is a recently disclosed hardcoded credential vulnerability affecting the SolarWinds Web Help Desk (WHD) software. The flaw is rated as critical (CVSS score 9.1 and if successfully exploited could allow remote unauthenticated attackers to access internal software functionality and modify data. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating reports of an active exploitation in the wild. Software vendor has already released a patched version of the WHD application - 12.8.3 HF2 that addresses this vulnerability.
27.10.24	Threat actors abusing open-source phishing framework to deliver RATS	ALERTS	VIRUS	A recent report by (CTA) member Cisco Talos has recently disclosed a new phishing campaign abusing the open-source phishing readiness assessment framework named 'Gophish' to deploy one of two attack chains. The first uses Pidief infected Office docs to deploy a newly discovered PowerShell RAT dubbed 'PowerRAT' while the second employs malicious HTML files and GOLoader to deploy DCRAT.
27.10.24	IcePeony: China-linked APT group targeting Southeast Asian governments	ALERTS	APT	A recently identified APT group linked to China dubbed IcePeony has been detected conducting malware campaigns targeting government agencies and institutions in countries such as India, Mauritius, and Vietnam. The group's attack vector often involves SQL injection, leading to compromises via web shells and backdoors that utilize custom malware like "IceCache" to infiltrate networks.
27.10.24	Lumma Stealer delivered via Fake CAPTCHA	ALERTS	VIRUS	Researchers are monitoring an ongoing phishing campaign where attackers appear to have upped their tactics from traditional phishing to incorporating the use of fake CAPTCHA pages and exploiting legitimate software. The intention being to eventually lure users into executing a payload called Lumma Stealer. This infostealing malware is a MaaS (Malware-as-a-Service) variant that steals sensitive data such as passwords and cryptocurrency information.
27.10.24	Phishing Campaign Delivering Wiper Malware	ALERTS	PHISHING	A recent campaign was observed by researchers where threat actors were seen targeting Israeli organizations, by impersonating a certain antivirus vendor and sending out phishing emails warning of state-backed threats. The emails include a link to a fake program that downloads a malware called Wiper, designed to erase data.
27.10.24	Phishing attack aims at Meta Ads Professionals with Quasar RAT	ALERTS	PHISHING	A malware campaign targeting job seekers and digital marketing professionals has been reported. The campaign specifically focuses on Meta Ads professionals and is believed to be driven by a Vietnamese Threat Actor. The attack chain begins with a phishing email containing an archive attachment that disguises a malicious LNK file as a PDF. When opened, the LNK file triggers PowerShell commands that lead to the download and execution of additional scripts, ultimately resulting in the delivery of the Quasar RAT payload. This gives attackers full control over the compromised system for activities such as data theft, surveillance and distributing more malware. The malware possesses anti-VM and anti-debug capabilities and establishes persistence by hiding in system directories.
27.10.24	ClickFix Tactic: New malware campaigns preying on Google Meet users	ALERTS	CAMPAIGN	Various malware campaigns utilizing the emerging ClickFix tactic have been reported since June 2024. One such campaign distributing infostealers through fake Google Meet pages, a popular video communication service has been reported in the wild. Users are lured by emails that appear to be legitimate Google Meet invitations for work meetings, conferences, or other significant events. Once lured, they are directed to a fake page that displays a pop-up about a technical issue. Clicking on this pop-up triggers the infection process, leading to the delivery of infostealer payloads such as Stealc, Rhadamanthys or AMOS depending on the operating system.
27.10.24	Recent malicious activities attributed to the UAT-5647 threat group	ALERTS	GROUP	According to the report published by Cisco Talos, UAT-5647 threat group has been targeting entities in Ukraine and Poland in their most recent campaigns. The threat actors have been distributing two distinct downloader variants called RustyClaw and MeltingClaw, a new RomCom malware variant dubbed SingleCamper, as well as DustyHammock and ShadyHammock backdoors. The wave of attacks has been ongoing since late 2023 and has been focused on data exfiltration and establishing long term access to the compromised environments.
27.10.24	Emerging Stealer Variants: Divulge, DedSec, and Duck Stealers	ALERTS	VIRUS	Multiple stealers have been observed being advertised on hacker forums, GitHub, and Telegram, all developed and promoted by the same entity. Notable variants include Divulge Stealer (a copy of Umbral), DedSec Stealer (based on Doenerium), and Duck Stealer (a derivative of AZStealer). These variants primarily target Discord data, browser information, cryptocurrency wallets and employ anti-analysis techniques to evade detection and operate effectively in the background.
27.10.24	TrickMo targeting Android users with fake lock-screen	ALERTS	VIRUS	Security researchers have recently disclosed a new variant of TrickMo, a mobile banking trojan that targets Android and iOS users. This new variant comes with some new functionality in addition to the existing capabilities, such as screen recording, remote control, and permissions granting. Now TrickMo includes the ability to steal screen lock codes and unique device identifiers from infected devices. When the malicious app is run it will display a full screen webpage designed to mimic the standard lock-screen, and if the user inputs their lock-screen code it will be exfiltrated via PHP to the attackers for later use.
27.10.24	Lockbit ransomware pretender targets macOS and Windows environments for data theft	ALERTS	RANSOM	A new campaign leveraging a malware variant disguised as Lockbit ransomware has been reported in the wild. The GO-based malware targets both macOS and Windows users in attempts to encrypt and exfiltrate confidential data. The stolen information is uploaded to Amazon AWS S3 buckets controlled by the attacks. The malware encrypts user files, deletes shadow copies on the infected machines and appends .abcd extension to the encrypted files. The ransomware then changes the desktop wallpaper to one copied over from Lockbit 2.0 attacks. This action is clearly a tactic meant to pressure the victims in paying the demanded ransom.
27.10.24	Microsoft Windows Kernel TOCTOU Race Condition Vulnerability (CVE-2024-30088)	ALERTS	VULNEREBILITY	CVE-2024-30088 is a Time-Of-Check Time-Of-Use (TOCTOU) race condition vulnerability in the Microsoft Windows Kernel. It arises when the state of a resource is modified between its validation (check) and actual use, allowing attackers to exploit the gap for privilege escalation. When successfully exploited, this vulnerability can enable attackers to execute code with elevated privileges on affected systems. It is now part of CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
27.10.24	Leafperforator APT group expands operations into the Middle East and Africa	ALERTS	APT	Researchers recently published a warning about the Telegram account '@reserveplusbot', linked to a specific application and serving as a contact for technical support. The suspicious messages urged users to install a ZIP file that contains malware. The executable file inside is a variant of Meduza Stealer, which steals files and evades detection by modifying Microsoft Defender settings.
27.10.24	Meduza Stealer	ALERTS	VIRUS	Researchers recently published a warning about the Telegram account '@reserveplusbot', linked to a specific application and serving as a contact for technical support. The suspicious messages urged users to install a ZIP file that contains malware. The executable file inside is a variant of Meduza Stealer, which steals files and evades detection by modifying Microsoft Defender settings.
27.10.24	New Linux variant of FASTCash malware discovered	ALERTS	VIRUS	A new Linux variant of the FASTCash malware (a tool which CISA has attributed to North Korea) has been discovered. FASTCash is malware that is implanted within compromised networks and leveraged to perform unauthorized banking transactions. This occurs by way of intercepting transaction messages and generating fraudulent responses in return, thereby defrauding the ATM/PoS card user.
27.10.24	CVE-2024-44849 - Qualitor Remote Code Execution (RCE) vulnerability	ALERTS	VULNEREBILITY	CVE-2024-44849 is a critical (CVSS: 9.8) Remote Code Execution (RCE) vulnerability in Qualitor, which is a platform for managing customer service processes and centralizing services. This exploit allows remote code execution (RCE) through an arbitrary file upload in Qualitor version before 8.24. If successfully exploited, this vulnerability might allow remote attackers to compromise the host system, potentially resulting in a complete system takeover. Symantec's network protection technology, Intrusion Prevention System (IPS) blocks these vulnerability exploitation attempts to prevent further infection/damage to the system.
27.10.24	ThunderKitty malware	ALERTS	VIRUS	ThunderKitty is a GO-based open-source infostealer variant seen in the wild. The malware has the functionality to collect miscellaneous information from infected machines including banking details, Discord session tokens, cookies, browser history and other data stored in the browsers, etc. ThunderKitty implements several evasion and anti-analysis techniques, VM environment and Debugger presence detection as well as persistence mechanisms.
27.10.24	CVE-2024-45519 - Remote Command Execution vulnerability in Zimbra Collaboration Suite	ALERTS	VULNEREBILITY	CVE-2024-45519 is a recently disclosed Remote Code Execution (RCE) vulnerability in Zimbra Collaboration Suite (ZCS) affecting versions before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1. The flaw stems from user input sanitation failure that if successfully exploited might allow the unauthenticated attackers to execute arbitrary code within the context of the vulnerable Zimbra installations.
27.10.24	INTERLOCK Ransomware	ALERTS	RANSOM	A new ransomware actor, going by the name INTERLOCK, has recently emerged in the threat landscape. This group appears to employ a double-extortion tactic. On successful compromise, encrypted files are appended with the ".interlock" extension.
27.10.24	Attackers still using SHTML files to target recipients with phishing	ALERTS	PHISHING	Symantec has recently observed a new phishing campaign using attached SHTML files disguised as import and or payment forms. The messages attempt to entice users to open the attached files to resolve import or billing issues. If the recipient opens the form they are greeted with a fake 'DHL' login page the exfiltrates the entered credentials to a private Telegram channel for the attacker to use later.
27.10.24	MiyaRat: The latest tool from the Bitter APT group	ALERTS	VIRUS	The Bitter APT group, recognized for its sophisticated cyber espionage activities targeting East and South Asia, has been observed deploying a new malware known as MiyaRat. This malware is capable of collecting system information, capturing screenshots, performing file uploads and downloads, and exfiltrating data to its command-and-control (C2) server, where it waits for further instructions.
27.10.24	CVE-2024-43363 - Cacti RCE vulnerability	ALERTS	VULNEREBILITY	CVE-2024-43363 is a remote code execution (RCE) vulnerability in Cacti, a network monitoring and fault management framework. Successful flaw exploitation happens via log poisoning on the vulnerable instances. This exploitation could ultimately allow the attackers for arbitrary command execution. The vulnerability has been fixed in product version 1.2.28 or higher.
27.10.24	Abuse of Code-Signing Certificates in Lumma Stealer deployment via HijackLoader	ALERTS	VIRUS	A malware campaign has been observed deploying Lumma Stealer using HijackLoader. The attack vector employs a "fake CAPTCHA" to lure users into executing a PowerShell payload that downloads a ZIP archive containing either a DLL or a signed HijackLoader binary. This binary is then loaded via DLL sideloading, ultimately installing Lumma Stealer. Multiple code-signing certificates were abused to sign the malware, obtained from various issuing certificate authorities that are largely automated, requiring only a valid company registration number and a contact person.
27.10.24	CoreWarrior Malware	ALERTS	VIRUS	Researchers investigated a malware named CoreWarrior and found that this variant aggressively spreads by creating numerous copies, connecting to various IP addresses, opening multiple backdoor access points, and intercepting Windows UI elements for surveillance purposes.
27.10.24	Core Werewolf utilizes AutoIt loader and Telegram for Cyber attacks	ALERTS	VIRUS	The Core Werewolf threat actor group, which primarily targets Russia's defense industry and critical infrastructure, has been observed using new tools including an AutoIt loader and delivering malicious files via Telegram in addition to email. As part of their attack chain, they utilize RAR archives containing SFX executables that deploy obfuscated AutoIt scripts, legitimate AutoIt interpreters, and decoy PDF documents. The loader collects system information, encrypts and transfers files, and communicates with a command-and-control server for data exfiltration. To evade detection, the attackers employ deceptive file names that correspond to the content of the decoy documents.
27.10.24	ErrorFather Android Trojan	ALERTS	VIRUS	Cerberus Android banking trojan came to light in 2019, and this variant utilizes a multi-stage dropper to deploy its payload and can execute financial fraud through remote attacks, keylogging, and overlay tactics. The emergence of ErrorFather highlights the persistent danger of repurposed malware, as cybercriminals continue to exploit leaked source code years after the original Cerberus malware was discovered.
27.10.24	Demodex targeting American telecommunications	ALERTS	VIRUS	APT group 'Squash' has been reported to be utilizing Demodex to target American telecommunications providers. Demodex, a rootkit, is used to establish persistence and then files with fake file headers (PNG, JPEG and WAV have been observed) are used to help evade detection and utilized to establish C2 communications.
27.10.24	CVE-2024-43573 - Microsoft Windows MSHTML Platform spoofing vulnerability	ALERTS	VULNEREBILITY	CVE-2024-43573 is a spoofing vulnerability that has been recently disclosed as part of the October 2024 Patch Tuesday. The vulnerability is affecting Microsoft Windows MSHTML Platform. Assigned with the CVSS score of 6.5 (Moderate) the flaw might allow attackers to execute arbitrary code within the context of the vulnerable application. CVE-2024-43573 has also been added to the "Known Exploited Vulnerabilities Catalog" by CISA, following reports of active exploitation in the wild.
27.10.24	New Pronsis Loader malware leveraged for Lumma Stealer and Latrodectus delivery	ALERTS	VIRUS	Pronsis Loader is a new malware variant leveraged recently in campaigns delivering Lumma Stealer and Latrodectus payloads. The malware utilizes executables compiled in JPHP programming language, which is a Java implementation of PHP. Pronsis also uses Nullsoft Scriptable Install System (NSIS) for the deployments in the observed campaigns. The malware implements certain detection evasion techniques such as exclusion of the user's profile directory path from Windows Defender scanning.
27.10.24	LemonDuck: The evolving Multi-Platform cryptomining malware	ALERTS	VIRUS	LemonDuck, a well-known cryptomining malware, has evolved into a multi-platform threat and has been observed exploiting SMB vulnerabilities, particularly EternalBlue, as part of its attack vector to gain network access. The malware employs techniques such as brute-force attacks, creating hidden administrative shares, and executing malicious actions via batch files and PowerShell scripts. LemonDuck has the capability to create scheduled tasks, disable Windows Defender, and utilize anti-detection mechanisms for persistence. It disguises itself as legitimate system services, manipulates firewall settings, in addition to using Mimikatz for credential theft.
27.10.24	CVE-2024-7954 - Remote Code Execution vulnerability in SPIP Porte Plume Plugin	ALERTS	VULNEREBILITY	CVE-2024-7954 is a critical (CVSS score 9.8) Remote Code Execution (RCE) vulnerability in porte_plume plugin used by SPIP versions prior to 4.30-alpha2, 4.2.13, and 4.1.16. SPIP is free software content management system (CMS) for publishing websites. The flaw might allow a remote, unauthenticated attacker to send a crafted HTTP request and execute arbitrary PHP code as the SPIP user. The attack can fully compromise the server to steal confidential information and pivot to the internal network. Symantec's network protection technology, Intrusion Prevention System (IPS) blocks these vulnerability exploitation attempts to prevent further infection/damage to the system.
27.10.24	Lynx ransomware - a formidable cyber-extortion threat	ALERTS	RANSOM	A new research published by Palo Alto Networks Unit 42 indicates that the ransomware variant known as Lynx shares a significant portion of its source code with the INC ransomware. The threat operators of Lynx have actively targeted organizations in various sectors (architecture, real estate, retail, and financial/environmental services) in the U.S. and UK. This ransomware operates using a RaaS model, and is disseminated through a variety of attack vectors (deceptive phishing mails, malicious downloads to infect users systems, and hacking forums etc.). Once afflicted with Lynx ransomware the victim(s) data is exfiltrated before encryption following the double extortion approach to obtain a ransom payment.
27.10.24	CVE-2024-43572 - Microsoft Windows Management Console RCE vulnerability	ALERTS	VULNEREBILITY	CVE-2024-43572 is a Microsoft Windows Management Console remote code execution (RCE) vulnerability recently disclosed and patched as part of the October 2024 Patch Tuesday. The vulnerability is exploited through execution of specially crafted malicious Microsoft Saved Console (MSC) files. Successful exploitation of this flaw could allow attackers to run arbitrary code within the context of the application. CVE-2024-43572 has also been added to the "Known Exploited Vulnerabilities Catalog" by CISA, following reports of active exploitation in the wild.
27.10.24	Perfctl malware campaign exploiting RocketMQ vulnerability hits Linux Servers worldwide	ALERTS	VULNEREBILITY	A Perfctl malware campaign targeting millions of Linux servers worldwide has been observed. The campaign exploits the CVE-2023-33246 RocketMQ vulnerability. The malware employs rootkits for stealth and process masquerading along with TOR for command and control (C2) communication. As the final payload, it deploys a cryptominer alongside proxy hijacking software. Additionally, the malware utilizes temporary directories and modified system utilities to evade detection.
27.10.24	Kransom ransomware targets gamers by imitating Honkai: Star Rail installer	ALERTS	RANSOM	Reports indicate that Honkai: Star Rail, a popular role-playing game, is being exploited by a new ransomware dubbed Kransom. This ransomware spreads through drive-by-download campaigns, enticing victims by masquerading the malicious binary as a legitimate StarRail game installer and employing valid digital certificates. Upon execution, the malicious DLL is loaded using a dynamic-link library (DLL) side-loading technique, initiating the ransomware’s encryption process.
27.10.24	Havoc Framework	ALERTS	VIRUS	Researchers have found that cybercriminals are increasingly leveraging pen testing tools like the Havoc framework to evade security systems. This tool is less recognized than others, such as Cobalt Strike or Metasploit, which makes it harder to spot. The Mysterious Werewolf group is using strategies similar to the Mythic framework, and phishing emails that mimic legitimate organizations remain a common tactic for gaining unauthorized access.
27.10.24	CleanUpLoader Leveraged By Rhysida	ALERTS	VIRUS	A recent report shed light on a loader/backdoor known as "CleanUpLoader," used by the double-extortion ransomware actor "Rhysida" as an initial vector of infection. It is typically disguised as software installers like Microsoft Teams or Google Chrome. The loader facilitates communication with multiple command-and-control (C2) servers, allowing Rhysida to establish persistence and perform data exfiltration.
27.10.24	New Ivanti CSA vulnerabilities exploited in the wild	ALERTS	VULNEREBILITY	Ivanti has published a new security advisory regarding three recently disclosed Ivanti CSA (Cloud Services Application) vulnerabilities. The reported vulnerabilities are as follows.
27.10.24	Lua-based malware variants target the educational sector	ALERTS	VIRUS	There has been a recent surge in Lua-based malware targeting students, specifically targeted attacks capitalizing on popular games within the student gamer community who are searching for gaming cheats. Fake game cheats are being leveraged by threat actors to trick users into downloading this malware. Lua-based malware is capable of establishing persistence on infected systems, exfiltrating sensitive harvested credential information, and delivering additional payloads.
27.10.24	Horus Protector	ALERTS	VIRUS	A new malware distribution service has been uncovered called Horus Protector that claims to be a Fully Undetectable (FUD) crypter and distributes various malware families, including AgentTesla, Remcos, Snake, and NjRat. The service distributes malware using a .zip file that contains a VBE script and gathers information from users' machines to transmit to its server.
27.10.24	Threat actors associated with North Korea target tech job seekers with malware	ALERTS	APT	The Contagious Interview campaign started in 2023 and is perpetuated by threat actors associated with North Korea. Recent activity has been observed that can be tied to this campaign with threat actors posing as job recruiters and luring victims into supposed interviews. Newer variants of previously used malware targeted individuals seeking jobs in the tech industry. The BeaverTail downloader and stealer is responsible for downloading the final InvisibleFerret backdoor payload. Researchers in Palo Alto Networks Unit 42 published a report with technical details of this activity.
27.10.24	A Recent PhantomLoader Campaign	ALERTS	VIRUS	PhantomLoader is a malware that disguises itself as a legitimate 32-bit DLL for a certain antivirus software and was recently found posing as “PatchUp.exe,” a genuine component of the software. The malicious loader was observed using binary patching and self-modifying techniques to load rust-based malware dubbed SSLoad into memory.
27.10.24	Malvertising campaign leads to malicious Windows and Mac payloads	ALERTS	VIRUS	A recently published report identified a campaign whereby advertisers are pushing ads for utility software, such as Slack or Notion, which lead to downloads of malicious payloads. The advertisers registered under existing businesses and distributed ads that target both Windows and Mac users. After multiple redirects, the users are provided downloads of stealer type malware which are masquerading as the advertised software.
27.10.24	Yunit Stealer - an infostealing malware with geofencing capabilities	ALERTS	VIRUS	Yunit Stealer is a malware variant recently distributed in the wild. Yunit has extensive infostealing capabilities including theft and exfiltration of credentials, credit card data, cryptocurrency wallets, cookies, auto-fill data and others. The collected information is exfiltrated via Discord or Telegram webhooks back to the attackers. Yunit employs various persistence techniques, obfuscation, defense evasion as well as some geofencing techniques ensuring only victims from targeted geographic locations will get infected with the malware.
27.10.24	Vilsa Stealer	ALERTS	VIRUS	Vilsa Stealer is a new infostealer malware variant identified in the wild. The malware has the functionality to exfiltrate miscellaneous confidential data from the infected machine including: browser data, credentials, autofill data, cookies, banking information, cryptocurrency wallets, Discord tokens and Telegram data, among others. The extracted information is uploaded back to the remote attackers by leveraging GoFile API. Vilsa Stealer also employs some anti-analysis and anti-VM capabilities meant to make the detection and protection against this infostealer more difficult.
27.10.24	Falcon Keylogger	ALERTS	VIRUS	Falcon is a keylogger variant recently active in the wild. Older samples of this malware date back even to 2019 while the latest observed are from just last month. Falcon has the functionality to record keystrokes on the infected machine, collect system information, screenshots, etc. The collected data is consecutively exfiltrated to the C2 servers controlled by the attackers. Keyloggers such as Falcon can be used by threat actors for the purpose of gaining access to confidential information including credentials, banking data and others.
27.10.24	Nunu Stealer malware	ALERTS	VIRUS	Nunu Stealer is a recently discovered Python-based infostealing malware variant which is based off an older Akira Stealer strain. The functionality includes exfiltration of various confidential information such as banking details, credit card data, credentials, autofill data stored in browsers, cookies, 3rd app session data, Discord tokens, cryptocurrency wallets and more. Nunu can be potentially used by attackers to compromise various user accounts and leverage those for further intrusions.
27.10.24	VeilShell: A new threat from North Korea's Vedalia APT group	ALERTS	APT	According to reports, threat actors linked to North Korea have been deploying a previously undocumented backdoor and remote access trojan (RAT) called VeilShell in a campaign targeting Southeast Asian countries. This activity is attributed to the Vedalia APT group (aka APT37, ScarCruft, Reaper)
27.10.24	SmartLoader Delivering Lumma Stealer	ALERTS	VIRUS	SmartLoader has been traced back to July 2024, involving a private GitHub account called "user-attachments." It starts with a zip archive containing four files: compiler.exe, conf.txt, Launcher.bat, and lua51.dll. The user runs Launcher.bat, which executes compiler.exe with conf.txt, triggering SmartLoader and deploying Lumma Stealer. This infostealer written in C is known to steal data stored in the system browsers as well any present cryptocurrency wallets.
27.10.24	Key Group: Targeting Russian users with evolving ransomware	ALERTS	RANSOM	The Key Group is a financially motivated ransomware group that primarily targets Russian users and is known for negotiating with victims via Telegram. Like other groups that leverage leaked ransomware builders, Key Group predominantly utilizes the Chaos ransomware builder, among others, and operates a GitHub repository for its command and control (C2) infrastructure. Discovered in April 2022, the group has developed several ransomware variants over time, including Chaos, Annabelle, RuRansom, Hakuna Matata, and the latest NoCry variant.
27.10.24	BabyLockerKZ - MedusaLocker Ransomware variant	ALERTS	RANSOM	BabyLockerKZ ransomware is a variant of MedusaLocker which has been active since 2023. This variant uses many of the same TTPs as seen in previous MedusaLocker attacks (publicly available tools, custom tools, lolbins, chat and leak sites). The threat actor responsible for this ransomware has been active since 2022 and has targeted victims globally. Most recent victims have been located in South America. Researchers at Cisco Talos have published additional details regarding this malware.
27.10.24	Silver Oryx Blade - a new banking malware targeting Brazil	ALERTS	VIRUS	Silver Oryx Blade is a new banking trojan discovered by the researchers from Scitum. The malware prevalently targets victims from Brazil and attempts to steal banking information from the compromised machines. The infection chain is initiated via phishing emails leveraging financial or tax related lures. In further attack stages the threat actors use malicious .zip archives, .msi droppers as well as .dll loaders. Silver Oryx Blade monitors for data related to over 50 banking and financial institutions and the extracted information is forwarded to the C2 servers controlled by the attackers.
27.10.24	Gorilla Botnet: A new global threat based on Mirai code	ALERTS	BOTNET	Reports indicate a surge in activity from a new botnet family called Gorilla Botnet, which is targeting telecommunications, universities, and the gaming industry worldwide. This botnet is a modified version of the Mirai source code and is compatible with various CPU architectures, including ARM, MIPS, x86_64, and x86. It boasts advanced DDoS attack methods and employs multiple techniques for persistence.
27.10.24	CeranaKeeper APT Campaign	ALERTS	APT	A recent CeranaKeeper APT campaign was observed by researchers. This China-linked threat actor targets government entities in Thailand, Myanmar, the Philippines, Japan, and Taiwan. The group continuously updates its tools, such as backdoors, to evade detection and exploits cloud services like Dropbox and OneDrive for custom solutions. They also leverage GitHub’s features to create a covert reverse shell, using the platform as their dedicated C2 server.
27.10.24	Fake Update Campaign Delivering WarmCookie Malware	ALERTS	CAMPAIGN	A new campaign in France is using compromised websites to distribute the WarmCookie backdoor through fake update prompts for popular applications like Google Chrome and Java. This tactic, employed by the threat group 'SocGolish', tricks users into downloading malicious software masquerading as legitimate updates for browsers and applications like Java and VMware. The updated WarmCookie can steal data, execute commands, and run files, making it a significant threat.
27.10.24	Defi Ransomware	ALERTS	RANSOM	Defi is the newest malware variant from the Makop ransomware family. The malware encrypts user files and appends .defi1328 to them, alongside of a developers' email address and a victim's unique ID. The ransom note is dropped in form of text file called "README-WARNING.txt" within various on the disk. The malware will also change the desktop wallpaper. Defi ransomware comes with functionality to delete the volume shadow copies on the infected machines.
27.10.24	Stonefly threat group continues to launch extortion attacks against US targets	ALERTS	GROUP	Symantec’s Threat Hunter Team has found evidence that the North Korean Stonefly group (aka Andariel, APT45, Silent Chollima, Onyx Sleet) is continuing to mount financially motivated attacks against organizations in the U.S., despite being the subject of an indictment and a multi-million dollar reward.
27.10.24	K4Spreader and Hadooken Latest Attacks	ALERTS	VULNEREBILITY	Recent research identified an infection chain targeting Windows and Linux systems through Oracle WebLogic vulnerabilities (CVE-2017-10271 and CVE-2020-14883). The attacker used Python and Bash scripts to deploy K4Spreader malware, which delivered the Tsunami backdoor and a cryptominer. A PowerShell script was also attempted for Windows systems. Another research team reported a separate attack in which Hadooken malware exploited a configuration vulnerability in WebLogic servers, using shell and Python scripts to install a cryptominer and Tsunami malware.
27.10.24	New Rast ransomware threat targets Chinese government entities	ALERTS	RANSOM	A new ransomware threat called Rast has been identified, specifically targeting Chinese government entities. The attack vector includes RDP brute-forcing and exploiting N-day vulnerabilities to gain access to border servers, followed by the manual deployment of ransomware components. Once deployed, Rast uploads the machine name and a unique identifier to a remote MySQL database. The ransomware appears to have evolved over time, with the latest variant requiring manual operation via a console interface upon startup, necessitating direct attacker involvement to initiate the ransom process.
27.10.24	Active malware campaign targeting Russian energy companies and Electronics suppliers	ALERTS	CAMPAIGN	A new malware campaign targeting Russian energy companies and electronic component suppliers has been observed. The malware spreads through email attachments or Yandex Disk links, using RAR archives that contain LNK files to download and execute malicious HTA files. These files generate VBS scripts that ensure persistence via registry keys and scheduled tasks. The scripts copy and exfiltrate files from the user's home directory and Telegram data to the attacker's C2 server.
27.10.24	CVE-2024-43461 - Windows MSHTML Platform Spoofing vulnerability exploited in the wild	ALERTS	VULNEREBILITY	CVE-2024-43461 is a Windows MSHTML spoofing vulnerability recently disclosed as part of the September 2024 Patch Tuesday. Successful exploiting of this flaw might allow attackers to execute arbitrary code within the context of the application. This flaw has been reported as being exploited in zero-day attacks in conjunction with another MSHTML vulnerability from July - CVE-2024-38112.
27.10.24	North Korean hackers target Cryptocurrency users on LinkedIn with RustDoor malware	ALERTS	CRYPTOCURRENCY	In early September, the FBI warned of North Korean threat actors targeting the crypto industry. A campaign has been reported where these actors attempt to lure potential victims on LinkedIn to deliver RustDoor malware. One user was approached by someone impersonating a recruiter for a legitimate decentralized cryptocurrency exchange (DEX) technology firm, supported by professional-looking websites to enhance the legitimacy of the fake entities.
27.10.24	CVE-2024-6670 - Progress WhatsUp Gold SQL Injection vulnerability	ALERTS	VULNEREBILITY	CVE-2024-6670 is a recently disclosed SQL Injection vulnerability affecting Progress WhatsUp Gold, which is a well known network monitoring software. Successful exploitation of this flaw could allow an unauthenticated attacker to retrieve the user's encrypted passwords. The vulnerability has also been added to the "Known Exploited Vulnerabilities Catalog" by CISA, following reports of active exploitation in conjunction with another WhatsUp Gold vulnerability CVE-2024-6671.
27.10.24	Vulnerabilities in the Common UNIX Printing System (CUPS)	ALERTS	VULNEREBILITY	Symantec is aware of multiple vulnerabilities in the Common UNIX Printing System (CUPS) on UNIX-based systems, where an attacker could exploit certain configurations to gain unauthorized access and perform remote code execution (RCE), particularly by leveraging the cups-browsed service.
27.10.24	Advanced Rhadamanthys Infostealer: AI-Driven threats to Cryptocurrency security	ALERTS	VIRUS	A new version of Rhadamanthys Infostealer with advanced features including the use of artificial intelligence (AI) for optical character recognition (OCR) has been reported.
27.10.24	DCRat (aka Dark Crystal RAT) Trojan Malware	ALERTS	VIRUS	DCRat (aka Dark Crystal RAT) is a modular remote access Trojan available as malware-as-a-service since 2018. It can execute commands, log keystrokes, and exfiltrate data. Recently, it was delivered using HTML smuggling, which embeds and obfuscates the payload within HTML to evade security measures.
28.9.24	CVE-2024-8190 - Ivanti Cloud Service Appliance Command Injection vulnerability	ALERTS	VULNEREBILITY	CVE-2024-8190 is a high severity (CVSS score 7.2) OS Command Injection vulnerability affecting Ivanti Cloud Services Appliance (CSA) versions 4.6 Patch 518 or older. If successfully exploited the flaw might allow a remote authenticated attacker for arbitrary code execution.
28.9.24	Vidar malware spreads via PEC Mail and Telegram profiles	ALERTS	VIRUS	CERT-AGID has identified a new campaign distributing Vidar through PEC mailboxes. The attackers are still leveraging Steam community profiles, but a significant new tactic involves exploiting Telegram profiles. In particular, the bios of these profiles are being used to reveal the IP addresses of their command and control (C2) servers.
28.9.24	Louse APT Group launches malware campaign targeting Chinese entities	ALERTS	APT	The Louse APT group (also known as Patchwork and Dropping Elephant) has reportedly launched a malware campaign targeting Chinese entities. The attack vector involves a malicious LNK file, likely originating from a phishing email. This file executes a PowerShell script that downloads a decoy PDF and a malicious DLL, which is loaded using DLL sideloading techniques.
27.9.24	Malspam campaign targeting transportation industry	ALERTS	CAMPAIGN	Researchers have recently disclosed a malspam campaign targeting organizations in the transportation industry. The attack originates from compromised mail accounts and utilizes files with a .URL extension that is either attached to or linked within spam messages, if these URL files are opened the victims machine initiates an external SMB connection to download and run a remote malicious executable.
27.9.24	SloppyLemming: Phishing campaigns targeting South and East Asia organizations	ALERTS	CAMPAIGN	Reports indicate that a threat actor known as SloppyLemming has been actively targeting organizations in South and East Asia, particularly in Pakistan and Bangladesh. This actor employs open-source adversary emulation frameworks such as Cobalt Strike and Havoc.
27.9.24	New DragonForce ransomware variant targets Global Industries with LockBit and Conti modifications	ALERTS	RANSOM	New variants of DragonForce ransomware, featuring modified versions of LockBit and Conti, have been observed targeting the manufacturing, real estate, and transportation industries worldwide. DragonForce operates a Ransomware-as-a-Service affiliate program, offering various attack management tools. The group employs the SystemBC backdoor for persistence, along with Mimikatz and Cobalt Strike for credential harvesting and lateral movement.
27.9.24	Twelve attack group aims to destroy	ALERTS	HACKING	Established in 2023 in response to the Russian-Ukrainian conflict, the attack group known as Twelve has been observed targeting Russian government organizations. The group's tactics include file encryption via ransomware, file/system deletion via wipers, and exfiltration of sensitive data among others. Based on the analysis provided in a recently published report, the goal of the group is focused on destruction rather than financial gain.
27.9.24	New KLogExe and FPSpy	ALERTS	VIRUS	New keylogger malware KLogExe and backdoor variant FPSpy have been used by Sparkling Pisces (aka Kimsuky, THALLIUM, Velvet Chollima) threat group. This APT group is known for its sophisticated cyber-espionage operations and advanced spear phishing attacks. Sparkling Pisces lure victims into downloading and executing malicious payloads. This includes the use of new and undocumented malware.
25.9.24	Foxtrot Ransomware - a new MedusaLocker variant	ALERTS	RANSOM	Foxtrot is a latest ransomware variant from the MedusaLocker family. The malware encrypts user files and appends .foxtrot70 to them. The ransom note is dropped in form of a .html file called "How_to_back_files.html". Foxtrot comes with functionality to delete the volume shadow copies and Windows Backup on the infected machines.
25.9.24	PDiddySploit Trojan Malware	ALERTS	VIRUS	A recent research study has revealed that the scandal surrounding Sean 'Diddy' Combs, also known as P. Diddy, has been exploited. Attackers often capitalize on public interest in high-profile scandals to spread malware, taking advantage of the topic to trick unsuspecting users into downloading malicious files. The trojan dubbed PDiddySploit involved in this campaign is a variant of the open-source PySilon RAT, known for stealing sensitive information and executing remote commands.
25.9.24	Turkey and Bulgaria Targeted in Remcos RAT Attacks	ALERTS	VIRUS	Symantec has recently observed two ongoing Remcos RAT campaigns from the same actor, targeting companies in Bulgaria and Turkey. In the Bulgarian campaign, they are using a classic invoice scheme (email subject: Плащане на фактура) to lure users, while in the Turkish campaign, they are using SWIFT transfer social engineering (email subject: Gelen Swift Mesaj). Although the social engineering tactics differ, the modus operandi is the same: they leverage a malicious .docx file that exploits an old vulnerability (CVE-2017-0199) to drop Remote Access Trojan.
25.9.24	Nanocore RAT Spreads Through Fake XLS Invoice	ALERTS	VIRUS	Nanocore RAT was highly prevalent many years ago and since has drastically dwindled but some groups and individuals continue to leverage this remote access trojan in their campaigns. One recent example being a fake invoice malspam campaign in which the authors have attached a malicious XLS (invoice.xls) that when executed will grab the Nanocore binary from a Discord server.
25.9.24	SnipBot - a new variant of the RomCom malware	ALERTS	VIRUS	Researchers from Palo Alto reported on a new variant of the RomCom malware dubbed SnipBot. The malware allows the attackers to execute command-line commands on the infected endpoints as well as to download additional arbitrary modules.
25.9.24	New Octo2 mobile malware variant observed in the wild	ALERTS	VIRUS	New variant of the Octo Android malware dubbed Octo2 has been identified in the wild. The malware has been spread via malicious campaigns targeting mobile users from European countries.
24.9.24	SectopRAT malware masqueraded as Notion installer in a recent distribution campaign	ALERTS	VIRUS	A new campaign spreading SectopRAT malware has been identified in the wild. The campaign disguises the malware binaries as installer files for known productivity software called Notion. The fake installers are distributed from malicious websites also masquerading as Notion software download portals.
24.9.24	Android Malware: Necro Trojan	ALERTS	VIRUS	The latest version of the Necro Trojan has infected various popular applications, including game mods available on Google Play, affecting over 11 million Android devices. This version employs obfuscation to evade detection and uses steganography to conceal its payloads.
24.9.24	Earth Baxia: Targeting Asia-Pacific region by exploiting GeoServer vulnerability	ALERTS	CAMPAIGN	According to a recent report from Trend Micro, the threat actor known as Earth Baxia has been targeting government, telecommunications, and energy organizations in the Asia-Pacific region through spear-phishing emails and the exploitation of the GeoServer vulnerability CVE-2024-36401.
24.9.24	SambaSpy malware targeting Italian users	ALERTS	VIRUS	SambaSpy RAT has been distributed in a new malicious campaign targeting users from Italy. The campaign has several stages within it's infection chain and is leveraging either malware downloaders or droppers depending on the observed run.
24.9.24	Go Injector Campaign Deploys Lumma Stealer	ALERTS	VIRUS	Researchers have identified a campaign using Go Injector to deploy Lumma Stealer, a malware designed to steal sensitive information. The attack begins when users visit a harmful website displaying a fake captcha, which tricks them into copying and running a command. This command downloads a zip file containing legitimate-looking files and the Go Injector. The injector then installs Lumma Stealer, which decrypts stolen data and sends it to the attackers.
20.9.24	North Korean APT group Appleworm delivers PondRAT via poisoned Python packages	ALERTS	APT	An ongoing campaign involving poisoned Python packages delivering backdoors for Linux and macOS, dubbed PondRAT, has been reported. This campaign is believed to be driven by the North Korean APT group Appleworm (also known as AppleJeus, Citrine Sleet, Gleaming Pisces).
20.9.24	New campaign targets GitHub users with Lumma Stealer malware via phishing emails	ALERTS	CAMPAIGN	CERT-AGID has reported a new campaign delivering Lumma Stealer malware. As part of this campaign, GitHub users are receiving alarming emails titled “IMPORTANT! Security Vulnerability Detected in Your Repository (Issue #1),” claiming to be from the “GitHub Security Team.” These emails warn recipients of a fabricated security vulnerability and encourage them to click on a suspicious link.
18.9.24	New variant of the Gomorrah Stealer identified in the wild	ALERTS	VIRUS	A new variant of the infostealing malware known as Gomorrah Stealer has been identified in the wild. Gomorrah is being offered for sale in form of a Malware-as-a-Service (MaaS) model. The malware is also actively developed by its creators who already announced upcoming 5.5 version of this infostealer to be released soon.
17.9.24	Fireant (APT31) unveils new tools in recent campaign against Asia-Pacific government entities	ALERTS	APT	The China-linked threat actor known as Fireant (also referred to as Mustang Panda or APT31) has recently been observed using new tools, including PUBLOAD, FDMTP, and PTSOCKET, in espionage attacks targeting government entities in the Asia-Pacific region.
17.9.24	Ajina mobile banking trojan	ALERTS	VIRUS	Ajina is a recently identified mobile banking trojan variant heavily targeting the Central Asia region. The malware focuses on theft of confidential user data including banking details as well as attempts to intercept the 2FA information.
17.9.24	Stealthy malware targets US-Taiwan Defense Industry conference attendees	ALERTS	VIRUS	A malware campaign targeting entities linked to the upcoming US-Taiwan Defense Industry Conference has been reported. Victims are lured with documents containing a ZIP archive and an LNK file disguised as a legitimate PDF registration form.
13.9.24	Mekotio and Mispadu malware distributed during Gecko Assault campaign	ALERTS	VIRUS	A new malicious campaign dubbed Gecko Assault has been reported by the researchers from SCILabs. The threat actors have been distributing two different payloads belonging to the URSA/Mispadu and the Mekotio malware families.
13.9.24	AutoIt-based credential flusher leveraged alongside StealC infostealer	ALERTS	VIRUS	A new campaign delivering the StealC infostealer malware has been observed in the wild. The initial stages of the attack use Amadey malware for loading the infostealer onto the targeted endpoints. In conjunction to the delivered StealC payload, the attackers are leveraging an AutoIt-based credential flusher malware.
13.9.24	Hadooken - Linux malware targeting Weblogic servers	ALERTS	VIRUS	Hadooken is a new Linux malware variant targeting Oracle Weblogic servers. In the initial attack stages the threat actors exploit known vulnerabilities, server misconfigurations or use weak or otherwise compromised credentials to get access to the targeted environments. Upon execution on the vulnerable server instances Hadooken drops two distinct payloads - Tsunami malware and another binary used for mining cryptocurrency.
13.9.24	ShrinkLocker Ransomware: Leveraging BitLocker for encryption and system disruption	ALERTS	RANSOM	ShrinkLocker is a recently discovered ransomware that exploits BitLocker, a legitimate Windows feature, to encrypt data and lock users out of their systems. Unlike traditional ransomware, ShrinkLocker uses BitLocker's secure boot partition to make decryption extremely difficult.
13.9.24	New Phishing Campaign Exploiting CapCut	ALERTS	PHISHING	CapCut, a popular video editor, is being exploited in phishing attacks. The latest campaign involves a malicious package that includes a legitimate CapCut app, JamPlus build utility, and a harmful ".lua" script. Running the app triggers JamPlus to execute the script, which then downloads and runs a final payload from a remote server.
13.9.24	Veaty and Spearal: Emerging malware in recent campaign against Iraqi Government	ALERTS	VIRUS	A new malware family, Veaty and Spearal, has been reported by Check Point, a CTA member, as being used in a campaign targeting Iraqi government infrastructure. The malware employs several techniques, including a passive IIS backdoor, DNS tunneling, and command-and-control (C2) communication through compromised email accounts.
13.9.24	Yet Another Silly Stealer (YASS) Infostealer	ALERTS	VIRUS	A new infostealer, being referred to as 'Yet Another Silly Stealer' (YASS), has been observed. While it shares some features with CryptBot, YASS also has distinct characteristics. The research compares YASS to CryptBot, emphasizing YASS's unique code and its delivery via a multi-stage downloader called MustardSandwich. This downloader, executed through a Windows LNK file, involves two JScript stages and two PowerShell stages, with the first PowerShell script run via an ActiveXObject.
13.9.24	BLX (aka XLABB) Stealer activity	ALERTS	VIRUS	BLX Stealer known also as XLABB Stealer is a malware variant initially discovered back last year. New activity attributed to this infostealer has been observed in the wild. BLX is an open-source malware actively distributed via Telegram and other platforms. Functionality-wise the malware is capable of stealing confidential data from compromised endpoints. The exfiltration efforts focus on data such as credentials, information stored in browsers, 3rd party applications accounts, Discord tokens, cryptocurrency wallets and others.
13.9.24	SEO manipulation leveraged for PlugX and BadIIS malware delivery	ALERTS	VIRUS	A new malicious campaign attributed to the DragonRank threat group has been discovered by researchers from Cisco Talos. The attackers have been reported to leverage search engine optimization (SEO) manipulation techniques to deploy malicious webshells, collect information off the infected systems as well as to deliver PlugX and BadIIS malware payloads.
13.9.24	Ransomware activity surge observed in second quarter of 2024	ALERTS	RANSOM	Ransomware activity increased markedly in the second quarter of 2024 as attackers seemingly recovered their momentum following the disruption experienced in late 2023 and early 2024. Analysis of data from ransomware leak sites found that ransomware actors claimed 1,310 attacks in the second quarter of 2024, a 36% increase on the first quarter of this year. This was the second highest amount of attacks claimed in a quarter by ransomware operators, short of the record 1,488 attacks claimed in the third quarter of 2023.
13.9.24	Linux SSH servers targeted by new SuperShell malware variant	ALERTS	VIRUS	SuperShell malware variant has been observed in a recent campaign targeted at vulnerable or otherwise misconfigured Linux SSH servers. The malware is Go-based and has the functionality to act as a reverse shell effectively allowing the attackers remote control and remote code execution on the infected machine. The servers compromised with use of SuperShell malware are likely to be used later by the attackers for the purpose of cryptomining or DDoS attacks.
13.9.24	ScRansom Ransomware	ALERTS	RANSOM	Researchers have found that the CosmicBeetle group is now using a new ransomware dubbed ScRansom, replacing their old Scarab ransomware. They are targeting small and medium businesses worldwide and are copying LockBit's style in their ransom notes and websites. CosmicBeetle is suspected to be affiliated with RansomHub, a recently active ransomware gang that has been increasing its operations since March 2024.
13.9.24	VSCode abused by Chinese APT group	ALERTS	APT	Stately Taurus, a Chinese APT group that carries out cyber-espionage attacks, has abused Visual Studio Code software in espionage operations targeting government entities in Southeast Asia. This threat actor used VSCode’s embedded reverse shell feature to gain a foothold in target networks to execute arbitrary code and deliver additional payloads. The leveraged this mechanism to deliver malware, perform reconnaissance, and exfiltrate sensitive data.
13.9.24	New variant of Cicada3301 ransomware found in the wild	ALERTS	RANSOM	According to a recent report from Palo Alto, Repellent Scorpius is a new ransomware-as-a-service (RaaS) group responsible for the delivery of a ransomware variant dubbed Cicada3301. The threat actors have been observed to leverage a variety of Living-Off-the-Land (LOTL) tools in their attacks. Among them PsExec for ransomware execution and Rclone tool used for data exfiltration.
13.9.24	Mekotio and BBTok malware remain active among the banking trojans targeting LATAM	ALERTS	VIRUS	Mekotio and BBTok malware variants remain active among the banking trojan families distributed lately across the Latin America region. The malware is usually spread via phishing campaigns utilizing business- or judicial-themed lures. The spam emails leverage either links leading to malicious archive downloads or use malicious attachments directly within the spam emails. While Mekotio is an older malware variant, BBTok was initially discovered just in 2020. Both variants target similar geographical locations and attempt to exfiltrate credentials and sensitive information in order to carry out unauthorized banking operations.
13.9.24	Threat actors spoof An Post Ireland services to steal credentials	ALERTS	CRIME	Symantec has identified a new wave of phishing attacks that impersonate An Post Ireland services to steal credentials. An Post Ireland is a state owned postal service provider in Ireland. In this campaign, phishing emails are disguised as parcel notifications to reschedule deliveries or check parcel details. The email content is brief, encouraging recipients to click on a phishing URL. Once clicked, victims encounter webpages designed for credential harvesting.
13.9.24	SpyAgent: Mobile malware stealing cryptocurrency wallets through image scanning	ALERTS	VIRUS	A new mobile malware called SpyAgent has been identified targeting mnemonic keys by scanning for images on your device that might contain them. A mnemonic key is a 12-word phrase used to recover cryptocurrency wallets. These secret phrases are highly valuable to threat actors because gaining access to them enables them to restore your wallet on their own devices and steal all the funds stored within.
13.9.24	Emerging Loki Backdoor variant employs Mythic Framework and Havoc Techniques	ALERTS	VIRUS	A new version of the Loki backdoor has been discovered targeting Russian organizations. This variant is compatible with the Mythic framework and utilizes various techniques from the Havoc framework, which complicates analysis. The updated variant is divided into a loader and a DLL. The loader gathers system information from the compromised machine, uploads it to the attacker’s C2 server, and retrieves the DLL in response. The DLL is then loaded into memory to download additional payloads and carry out further attacks.
11.9.24	Latrodectus campaign impersonates Antivirus software to deploy remote payloads	ALERTS	CAMPAIGN	A campaign deploying Latrodectus malware, disguised as a legitimate antivirus vendor, has been reported. The initial attack vector involves phishing and malicious ads. Latrodectus functions as a backdoor, allowing the execution of remote commands and the deployment of malicious payloads such as Brute Ratel C4. It employs common techniques for persistence, including the use of the Windows Component Object Model (COM) and employs TLS certificates for communication with its command-and-control (C2) server.
11.9.24	CVE-2024-45195: Remote Code Execution (RCE) vulnerability in Apache OFBiz	ALERTS	VULNEREBILITY	CVE-2024-45195 is a high-severity (CVSS: 7.5) Remote Code Execution (RCE) vulnerability in Apache OFBiz, a comprehensive suite of business applications. An attacker could likely exploit this vulnerability by framing a specially designed URL that bypasses authentication protocols. If successfully exploited, this vulnerability will allow remote attackers to execute malicious code on the server, potentially leading to complete system compromise.
11.9.24	Ongoing exploitation of CVE-2024-36401 in OSGeo GeoServer GeoTools	ALERTS	VULNEREBILITY	Multiple campaigns are exploiting a recently disclosed security flaw in OSGeo GeoServer GeoTools. The vulnerability, identified as CVE-2024-36401 (with a CVSS score of 9.8), is a critical remote code execution bug that allows malicious actors to take control of affected instances. This flaw has been leveraged to deploy GOREVERSE, a reverse proxy server designed to connect with a command-and-control (C2) server for post-exploitation activities.
11.9.24	TIDRONE activities in Taiwan	ALERTS	GROUP	In recent news, the TIDRONE group has been targeting Taiwan's military and satellite industries, focusing on drone manufacturers. Using malicious tools like CXCLNT and CLNTEND, the group enables data theft, credential dumping, and user control bypass. According to reports, their Tactics, Techniques, and Procedures (TTPs) include supply chain attacks via ERP software, pointing towards espionage motives.
11.9.24	Babylon open-source RAT targets Malaysia	ALERTS	VIRUS	Babylon RAT is an open-source malware variant recently distributed to users in Malaysia. The attack chain involves usage of crafted .iso files mimicking PDF documents. The delivered ISO archive contains a hidden PowerShell script, a decoy PDF document and a malicious executable leading to infection with the Babylon RAT.
11.9.24	Babylon open-source RAT targets Malaysia	ALERTS	VIRUS	Babylon RAT is an open-source malware variant recently distributed to users in Malaysia. The attack chain involves usage of crafted .iso files mimicking PDF documents. The delivered ISO archive contains a hidden PowerShell script, a decoy PDF document and a malicious executable leading to infection with the Babylon RAT.
11.9.24	ToneShell Backdoor Targets IISS Summit	ALERTS	VIRUS	A cyber espionage campaign involving the ToneShell backdoor, attributed to Mustang Panda, has been reported targeting attendees of the 2024 IISS Defense Summit in Prague. The attack leverages a malicious PIF file disguised as summit documents to gain access to sensitive defense discussions. The malware achieves persistence via registry run keys and scheduled tasks and communicates with a C2 server in Hong Kong using raw TCP that mimics TLS.
11.9.24	BlindEagle strikes Colombia's Insurance sector with Quasar RAT variant	ALERTS	VIRUS	BlindEagle, an advanced persistent threat actor, has been observed targeting Colombia’s insurance sector with the BlotchyQuasar Remote Access Trojan (RAT). The attack chain begins with phishing emails impersonating the Colombian tax authority, containing links to malware hosted on compromised Google Drive accounts.
6.9.24	Tropic Trooper unleashes new China Chopper variant and Crowdoor loader	ALERTS	APT	Tropic Trooper, a Chinese-speaking APT group, has been reported targeting Middle Eastern government entities in a cyber espionage campaign. The attackers focused on systems related to human rights studies, using a new China Chopper variant deployed on a compromised Umbraco CMS server. The group employed DLL hijacking to load malicious payloads, including Crowdoor, a loader linked to the SparrowDoor backdoor.
6.9.24	Spammers abusing uncommon TLDs	ALERTS	SPAM	Symantec has recently observed a new phishing campaign being delivered from recently created domains designed to steal credentials and/or banking information. In this campaign we have observed over 200 newly registered domains, most of these domains are registered with uncommon TLDs such as '.best', '.rest' or '.shop'. The subjects and message content attempt to lure recipients in with promises of dubious health products.
6.9.24	Formbook Targets Global Sectors with Fake RFQ from Chemical-Oil Joint Venture	ALERTS	VIRUS	Symantec has recently observed a Formbook actor impersonating a major joint venture between a global chemical company based in Germany and a national oil and gas company from Malaysia. In this malicious email campaign, they're targeting companies across multiple countries and various industry sectors, including:
6.9.24	Acab Infostealer	ALERTS	VIRUS	Acab is a Python-based infostealing malware variant recently observed in the wild. The malware shows some code similarities to another variant known as 1312 Stealer. Acab has the functionality to extract various confidential information from infected endpoints including credentials, banking information, crypto-wallet data, application data/tokens, various information stored in web browsers and others.
6.9.24	CVE-2024-5932 - GiveWP WordPress Plugin vulnerability	ALERTS	VULNEREBILITY	CVE-2024-5932 is a recently disclosed vulnerability affecting GiveWP plugin, which is a Donation and Fundraising Platform plugin for WordPress. The flaw allows for malicious injection within the vulnerable version of the plugin, up to 3.14.1. Successfully exploitation of this flaw might allow unauthenticated attackers to inject an arbitrary PHP Object which can further lead up to arbitrary code execution within the context of the vulnerable application. A patched version 3.14.2 of the plugin has been already released.
6.9.24	MacroPack generated payloads distributed in latest campaigns	ALERTS	CAMPAIGN	A payload generation framework called MacroPack has been leveraged to create miscellaneous payloads in a series of malicious activities recently observed by the researchers from Cisco Talos. The attackers have been using Word, Excel or PowerPoint lures that once opened run malicious MacroPack VBA code that ultimately leads to the final payload delivery and execution. Among the distributed payloads were Brute Ratel and Havoc post-exploitation tools as well as a new variant of the PhantomCore RAT.
6.9.24	KTLVdoor backdoor leveraged by the Funnelweb APT	ALERTS	VIRUS	A new Golang-based backdoor dubbed KTLVdoor has been discovered by researchers from Trend Micro. The malware has been attributed to the Funnelweb APT (also known as Earth Lusca). KTLVdoor is a highly obfuscated malware that comes in variants supporting both Windows and Linux platforms. Functionality-wise the malware is capable of running commands and shellcode received from the C2 servers, various file and directory operations on the infected machine including file download/upload, among others.
6.9.24	SLOW#TEMPEST campaign targets Chinese entities	ALERTS	CAMPAIGN	A recently identified malware campaign named SLOW#TEMPEST was uncovered targeting Chinese entities. The attack chain starts by way of malspam attachments in the form of zip files which are bundled with a shortcut lnk file in addition to dll/exe files. Successful execution of the available content leads to the establishment of a foothold in the targeted environment. Through this position, the attackers can execute further TTPs to accomplish their goals (such as credential harvesting, lateral movement, persistence and privilege escalation).
6.9.24	Latrodectus 1.4: New version unveiled with advanced capabilities	ALERTS	VIRUS	A newer version of the Latrodectus downloader has been observed, featuring enhancements like a new string deobfuscation method, a revised C2 endpoint, and two additional backdoor commands. The infection chain begins with a heavily obfuscated JavaScript file, which uses numerous comments to inflate file size and complexity, complicating analysis. The malware then extracts and executes hidden code, subsequently downloading and installing an MSI file from a remote server. This MSI file loads an obfuscated DLL to perform its malicious tasks.
5.9.24	Emansrepo infostealer	ALERTS	VIRUS	Researchers from Fortinet reported on a new Python-based infostealer variant dubbed Emansrepo. This malware has been distributed via phishing campaigns masquerading the malicious emails as purchase invoices or orders. The initial attack chain stage varies depending on the campaign and may leverage different attachments such as .html or .7z. The dropped Emansrepo payload has the functionality to collect miscellaneous confidential data from the compromised endpoints including credentials, banking information, crypto-wallets, browser and download history, autofill data as well as exfiltrate text/document files from various on-disk locations.
5.9.24	Zharkbot malware	ALERTS	VIRUS	Zharkbot is a C++based malware loader variant being dropped by Amadey trojan in some recently observed campaigns. Zharkbot employs various anti-analysis, anti-VM and sandbox detection/evasion techniques. Once on the compromised machine, the malware will attempt to set up persistence by copying itself to the temp folder and setting up a scheduled task execution. Zharkbot has the functionality to download and execute arbitrary payloads on the infected endpoints.
5.9.24	CVE-2024-24809 & CVE-2024-31214 vulnerabilities affecting Traccar 5	ALERTS	VULNEREBILITY	CVE-2024-24809 and CVE-2024-31214 are recently disclosed vulnerabilities affecting Traccar 5 which is an open-source GPS tracking system. The vulnerabilities are rated as CVSS score: 8.5 and CVSS score: 9.7 respectively. Successful exploitation in the affected product versions 5.1 through 5.12 could provide unauthenticated attackers with path traversal and unrestricted upload of arbitrary files. This exploitation could potentially lead to further compromise such as remote code execution on the affected instances. Product vendor has already released patch addressing the vulnerabilities in product version 6.0.
5.9.24	CVE-2024-22319 - JNDI Injection Vulnerability in IBM Operational Decision Manager	ALERTS	VULNEREBILITY	CVE-2024-22319 is a critical (CVSS: 9.8) JNDI injection vulnerability in IBM Operational Decision Manager. IBM ODM is a comprehensive decision automation solution that helps organizations automate and optimize their decision-making processes. Attackers can exploit this flaw by injecting malicious code into an unchecked argument passed to a specific API through JNDI (Java Naming and Directory Interface).
5.9.24	Stone Wolf campaign targets Russian firms with Meduza Stealer malware	ALERTS	CAMPAIGN	A malicious campaign by the Stone Wolf threat actor targeting Russian firms has been reported. The attackers use phishing emails impersonating a legitimate industrial automation provider to deliver the Meduza Stealer malware. The attack vector involves an archive containing a legitimate document alongside a malicious link to download and execute the Stealer payload. This malware collects and exfiltrates credentials, system information, and application data from compromised systems.
5.9.24	WailingCrab: A WikiLoader variant exploiting VPN Spoofs	ALERTS	VIRUS	A recent report from Palo Alto reveals that WailingCrab, a variant of WikiLoader, is being distributed through SEO poisoning and spoofed GlobalProtect VPN software. This campaign primarily targets the U.S. higher education and transportation sectors. The attack vector involves multiple stages like DLL sideloading, shellcode injection, and using MQTT for command and control. Attackers employ various evasion techniques such as fake error messages, process checks, and encryption. The loader's advanced tactics also leverage compromised WordPress sites and cloud-based Git repositories for infrastructure.
5.9.24	Luxy Infostealer	ALERTS	VIRUS	Luxy is a recently discovered malware variant with both infostealing and ransomware capabilities. Luxy collects various confidential information from the compromised machines including credentials, browser data, cookies, cryptocurrency wallets, etc. The ransomware module is used to encrypt files on the infected endpoint using AES256 algorithm. The ransom note dropped after the completed encryption asks the victims for ransom payment and for them to contact the attackers via Discord.
5.9.24	Cybercriminals Target Malaysia’s Digital Lifestyle with SpyNote	ALERTS	VIRUS	Around the world, E-commerce (shopping), service-oriented (food delivery, ride-hailing, and on-demand services), digital payment and deal aggregator android applications are highly popular. They have become integral to the digital lifestyle, meeting the growing demand for convenient, cost-effective services across various markets. These apps cater to consumers' needs for efficiency, accessibility, and savings, making them essential tools in everyday life.
5.9.24	CVE-2024-7593 - Ivanti Virtual Traffic Manager (vTM) Authentication Bypass vulnerability	ALERTS	VULNEREBILITY	CVE-2024-7593 is a critical (CVSS score 9.8) XML authentication bypass vulnerability affecting Ivanti Virtual Traffic Manager (vTM). Successful exploitation of this flaw could allow the attackers to bypass authentication and create new administrative users. Such compromise could potentially lead later to arbitrary code execution within the context of the vulnerable application. Product vendor has already released patch addressing this vulnerability in the updated software versions.
5.9.24	RAZR Ransomware	ALERTS	RANSOM	RAZR is a recently identified ransomware variant that abuses web hosting service called PythonAnywhere for hosting the malicious binaries. The malware uses AES-256 algorithm for encryption and appends .raz extension to the filenames. The ransom note is dropped in form of a text file README.txt in which the attackers also threaten that the confidential files have not only been encrypted but also exfiltrated.