Security updates announced for Android on Monday resolve 38 vulnerabilities, including two critical-severity issues in the System component. Impacting Android 12, 12L, 13, and 14, and tracked as CVE-2024-0039 and CVE-2024-23717, the two critical flaws could lead to remote code execution and elevatio…
Hackers are targeting misconfigured servers running Apache Hadoop YARN, Docker, Confluence, or Redis with new Golang-based malware that automates the discovery and compromise of the hosts. […]
An in-depth look into a proactive website security solution that continuously detects, prioritizes, and validates web threats, helping to mitigate security, privacy, and compliance risks.
[Reflectiz shields websites from client-side attacks, supply chain risks, data breaches, privacy violations, and compliance issues]
You Can’t Protect What You Can’t See
Today’s websites are connected
The Alphv/BlackCat gang on Monday announced that it’s shutting down the ransomware operation and that it has already found a buyer for the malware’s source code. The announcement comes roughly three months after the ransomware-as-a-service (RaaS) survived a law enforcement takedown effort that force…
Cado Security Labs described a Linux-focused campaign that uses four custom Golang binaries plus multiple shell scripts to scan for and exploit misconfigured Docker, Hadoop YARN, Confluence (CVE-2022-26134) and Redis services, delivering a XMRig-based miner, r…
The US cybersecurity agency CISA on Tuesday added flaws impacting Pixel phones and Sunhillo software to its Known Exploited Vulnerabilities (KEV) catalog. The exploited Pixel vulnerability is tracked as CVE-2023-21237. When it patched the flaw in June 2023, Google warned that it had been aware…
Every Google Workspace administrator knows how quickly Google Drive becomes a messy sprawl of loosely shared confidential information. This isn’t anyone’s fault; it’s inevitable as your productivity suite is purposefully designed to enable real-time collaboration – both internally and externally.
For Security & Risk Management teams, the untenable risk of any Google Drive footprint
EclecticIQ observed a spike in WikiLoader deliveries in February 2024, highlighting renewed use of phishing PDFs that link to compressed JavaScript stagers which then download final payloads. Analysts note WikiLoader operates as a selective Malware-as-a-Servic…
Overview On February 13th, 2024, Microsoft announced a Windows Kernel Elevation of Privilege Vulnerability CVE-2024-21338 patch. The vulnerability occurs at certain IOCTL of “appid.sys” known as AppLocker‘s driver, one of the Windows feature. The threat actor can read and write on a random kernel me…
Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence
Trend Micro’s analysis details how the Earth Kapre (aka RedCurls) loader is deployed using legitimate tools (curl, 7-Zip) and script-based obfuscation to fetch, extract, and execute a DLL payload. The intrusion uses SMB-based command-and-control and Impacket s…
The U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two individuals and five entities associated with the Intellexa Alliance for their role in “developing, operating, and distributing” commercial spyware designed to target government officials, journalists, and policy experts in the country.
“The proliferation of commercial spyware poses distinct and growing
VMware has released patches to address four security flaws impacting ESXi, Workstation, and Fusion, including two critical flaws that could lead to code execution.
Tracked as CVE-2024-22252 and CVE-2024-22253, the vulnerabilities have been described as use-after-free bugs in the XHCI USB controller. They carry a CVSS score of 9.3 for Workstation and Fusion, and 8.4 for ESXi systems.
“A
The cybercrime group called GhostSec has been linked to a Golang variant of a ransomware family called GhostLocker.
“TheGhostSec and Stormous ransomware groups are jointly conducting double extortion ransomware attacks on various business verticals in multiple countries,” Cisco Talos researcher Chetan Raghuprasad said in a report shared with The Hacker News.
“GhostLocker and
A financial entity in Vietnam was the target of a previously undocumented threat actor called Lotus Bane that was first detected in March 2023.
Singapore-headquartered Group-IB described the hacking outfit as an advanced persistent threat group that’s believed to have been active since at least 2022.
The exact specifics of the infection chain remain unknown as yet, but it involves the
Apple has released security updates to address several security flaws, including two vulnerabilities that it said have been actively exploited in the wild.
The shortcomings are listed below –
CVE-2024-23225 – A memory corruption issue in Kernel that an attacker with arbitrary kernel read and write capability can exploit to bypass kernel memory protections
CVE-2024-23296 – A memory