Turla has introduced a new wrapper for the Kazuar backdoor, nicknamed Pelmeni, used in targeted campaigns to deliver a memory-resident payload. The analysis details the infection chain, DLL side-loading with spoofed libraries, in-memory decryption/execution of…
Aqua Nautilus reveals a Lucifer DDoS botnet variant targeting Apache Hadoop and Apache Druid by exploiting misconfigurations and CVE-2021-25646 to turn Linux hosts into mining nodes. The campaign evolves in three stages, deploying droppers and miners while emp…
Doppelgänger, a sophisticated Russia-aligned operation, targets German public opinion with disinformation ahead of elections.
Eye care practice management firm American Vision Partners faces lawsuit over data breach impacting 2.3 million patients. The post Eye Care Services Firm Faces Lawsuit Over Data Breach Impacting 2.3 Million appeared first on SecurityWeek. Read More SecurityWeek RSS Feed…
Scattered Spider is an English-speaking intrusion set that uses advanced phone- and web-based social engineering (phishing, smishing, SIM swapping, MFA bombing) to harvest credentials, take over accounts, and pivot into victim networks, later monetising access…
Cisco Talos and CERT.NGO analyzed Turla’s TinyTurla-NG campaign, revealing a PHP-based C2 hosted on compromised WordPress sites that provides a web shell and a task/result-based protocol for implant communication. The report details three modular PowerShell wo…
Trustwave SpiderLabs analyzed the Tycoon Group phishing-as-a-service (PaaS), which uses obfuscated landing pages, Cloudflare Turnstile, and socket.io WebSocket connections to exfiltrate credentials and session cookies. The service advertises MFA bypass (Micros…
Imperva researchers found that CVE-2023-22527, an unauthenticated OGNL injection in Atlassian Confluence, was rapidly scanned and exploited to achieve remote code execution. Attackers used injected wget/bash commands to fetch and run C3Pool xmrig installer scr…
ConnectWise ScreenConnect versions 23.9.7 and earlier contain two critical vulnerabilities — CVE-2024-1709 (authentication bypass, CVSS 10.0) and CVE-2024-1708 (path traversal, CVSS 8.4) — that enable unauthenticated remote code execution and direct access to …
Creates, a popular online retailer of hair styling tools, has suffered a significant data breach that exposed credit card details, names, addresses, and possibly even more sensitive personal information belonging to thousands of customers. An investigation revealed that attackers found weaknesses in…
Cleafy Labs identified a TeaBot campaign that used a malicious dropper app on the Google Play Store to dynamically download a dex file and a secondary APK, performing multiple checks and evasion steps before installing the banking trojan. The final TeaBot payl…
A mix of PSYOPs, espionage and … fake Canadian pharmacies!
Wireshark Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffe…
Malwarebytes reports a USB-charged vibrator was infected with the Lumma information stealer, spreading to the user’s system. The attack uses an obfuscated Outweep Dynes installer to drop Lumma, which steals cryptocurrency wallets, browser data, and 2FA details…
SSH‑Snake is a newly released, self‑modifying, fileless SSH worm that searches for SSH private keys and bash history on a compromised host, uses discovered credentials to SSH into other systems, and copies itself to propagate. Sysdig observed operators storing…