A new pair of security vulnerabilities have been disclosed in JetBrains TeamCity On-Premises software that could be exploited by a threat actor to take control of affected systems.
The flaws, tracked as CVE-2024-27198 (CVSS score: 9.8) and CVE-2024-27199 (CVSS score: 7.3), have been addressed in version 2023.11.4. They impact all TeamCity On-Premises versions through 2023.11.3.
“The
AhnLab ASEC analyzed a backdoor family named WogRAT (also referenced as WingsOfGod) that is delivered via the aNotepad platform and supports both PE (Windows) and ELF (Linux) payloads. The Windows variant uses a .NET downloader that pulls Base64-encoded binari…
A Russian-linked cyberscam network used a deepfake video of Maria Ressa to promote a crypto scam campaign in the Philippines, distributing fake CNN/Rappler articles via clone domains and Facebook ads. The investigation links the operation to Russian actors and…
Two researchers highlight that certain Hugging Face ML models can execute code on load, enabling attackers to take control and implant backdoors. The report analyzes malicious models, their serialization-based exploit methods (notably Pickle in PyTorch and Lam…
Two sentences: CYFIRMA uncovered a stego-campaign that weaponizes a malicious DOCX using template injection to bypass email defenses and drop Remcos RAT and Agent Tesla through a multistage, script-based they-know-what trick. The attack chain leverages VBScrip…
Customers should immediately patch critical vulnerabilities in on-prem deployments of the CI/CD pipeline tool JetBrains TeamCity that could allow threat actors to gain admin control over servers.
35 years after the Morris worm, we’re still dealing with a version of the same issue: data overlapping with control.
A critical vulnerability (CVE-2024-27198) in the TeamCity On-Premises CI/CD solution from JetBrains can let a remote unauthenticated attacker take control of the server with administrative permissions. […]
The breach occurred through a third-party service provider frequently used by the company’s travel services division.
The North Korean APT hacking group Kimsuky is exploiting ScreenConnect flaws, particularly CVE-2024-1708 and CVE-2024-1709, to infect targets with a new malware variant dubbed ToddlerShark. […]
Law enforcement agencies shut down xDedic, a cybercrime-as-a-service (CaaS) marketplace specifically providing web servers to cybercriminals, back in 2019. However, WhoisXML API threat researcher Dancho Danchev posits that parts of its backend infrastructure may remain traceable.
The hacking group known as TA577 has recently shifted tactics by using phishing emails to steal NT LAN Manager (NTLM) authentication hashes to perform account hijacks. […]
Massachusetts Air National Guard member Jack Teixeira pleaded guilty on Monday to leaking highly classified military documents about the war in Ukraine and other national security secrets under a deal with prosecutors that calls for him to serve at least 11 years in prison. Teixeira, of North Dighto…
American Express warns customers that their credit cards were exposed due to a data breach experienced by a third-party merchant processor. American Express (Amex) notifies customers that their credit card information has been compromised in a data breach involving a third-party merchant processor. The company did not disclose the number of impacted customers. “We became […]
Yet challenges remain as many nation’s policies for the email authentication protocol remain lax and could run afoul of Google’s and Yahoo’s restrictions.