Researchers traced a fake WhatsApp phishing operation aimed at iPhone users, linked to an Italian surveillance company. The attack uses iPhone configuration profiles via a phishing site to push spyware and potentially exfiltrate device data. #WhatsApp #Cy4Gate…
Rapid7 analyzes Black Hunt ransomware, a variant reportedly built from leaked LockBit code with similarities to REvil in its techniques, which has impacted hundreds of Paraguayan companies. The post details its anti-analysis checks, privilege escalation, langu…
CISA analyzed three artifacts linked to the PRC state-sponsored group Volt Typhoon: a Golang-based FRP client (FRPC) and FRP binary variants used to open reverse proxies, and a UPX-packed ScanLine port scanner. The FRPC samples attempted connections to 203[.]9…
Ransomware threat actors have been extorting money after taking control over organizations’ internal networks, distributing ransomware, encrypting systems, and holding system restoration for ransom. Recently, however, threat actors not only encrypts the systems but also leaks internal data and threa…
Detect and mitigate CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893, critical vulnerabilities in Ivanti VPN products. Organizations should patch urgently, and government agencies are instructed to isolate Ivanti VPN instances.
If you have anything to do with cyber security, you know it employs its own unique and ever-evolving language. Jargon and acronyms are the enemies of clear writing—and are beloved by cyber security experts. So Morphisec has created a comprehensive cyber security glossary that explains commonly…
Sekoia.io’s TDR team tracked a sharp rise in adversary C2 infrastructure during 2023, identifying over 85,000 IP addresses used as C2 and monitoring widespread use of phishing-as-a-service, infostealers, and OSTs like Cobalt Strike. The report explains the pro…
CSIRT-CTI and Unit 42 expand their Stately Taurus investigation against Myanmar’s military junta, detailing seven campaigns (Campaign #3–#7) observed between November 2023 and January 2024 with largely consistent tactics and infrastructure. The campaigns reuse…
Two sentences summarizing the content: The article discusses CVE-2024-23897, a critical Jenkins vulnerability up to version 2.441 that allows unauthenticated reading of files from the Jenkins controller filesystem via a crafted CLI payload. It also covers Splu…
FortiGuard Labs analyzed a multi-stage campaign delivered via a malicious Excel macro that ultimately deploys a Python-based info-stealer to harvest browser cookies and login data. Stages use obfuscated batch/VBScript downloaders hosted on public platforms and…
Analysis of ransomware gang leak site data reveals significant activity over 2023. As groups formed — or dissolved — and tactics changed, we synthesize our findings.
The post Ransomware Retrospective 2024: Unit 42 Leak Site Analysis appeared first on Unit 42….
CyberNiggers, a racist threat group, has resurfaced on Breach Forums with IntelBroker playing a central leadership role in its cyber operations. The piece outlines their targets (including GE and DARPA-linked data), recruitment dynamics, and how initial-access…
Pony (Fareit or Siplog) is a long-running loader/stealer malware that also functions as a botnet, used for information theft and to deploy other malware in victim infrastructures for over a decade. It spreads via phishing, compromised websites, and fake softwa…
Scaly Wolf operated an infostealer campaign against Russian organizations by delivering the White Snake malware through phishing emails that used password-protected archives. The lures shifted from Roskomnadzor-themed messages to other agencies and prosecutors…
Cybereason warns of Ivanti Connect Secure VPN zero-day exploitation disclosed in January 2024, with exploitation reportedly occurring as early as December 2023 and escalating after PoC release. The attacks enable unauthenticated or authenticated command execut…