Talos Incidents Response reports active exploitation of Cisco IOS XE Web UI vulnerabilities CVE-2023-20198 and CVE-2023-20273, delivering a Lua-based implant named BadCandy to compromised devices. The operation includes unauthorized local user creation, privil…
FortiGuard Labs observed the IZ1H9 Mirai-based campaign expand with 13 exploit payloads targeting numerous router, camera, and device vendors to achieve remote code execution and grow its botnet. The campaign uses shell-script downloaders (e.g., l.sh), XOR-obf…
PT Pelabuhan Indonesia (Persero), trading as Pelindo, is Indonesian state-owned port operation company that offers an integrated port service throughout Indonesia.
MedusaLocker ransomware targets the hospital and healthcare sectors and uses AES and RSA encryption to lock victims’ data. The analysis outlines its techniques for persistence, privilege escalation, service/process termination, shadow copy deletion, network pr…
Wordfence warns of a critical unauthenticated vulnerability in Royal Elementor Addons and Templates for WordPress that lets attackers upload PHP files and achieve remote code execution, risking a full site compromise. Attacks have been active since mid-2023 wi…
Threat researchers uncovered a fake Android APK masquerading as the RedAlert – Rocket Alerts app, hosted on a deceptive site and designed to harvest extensive device data. The malware collects sensitive information and sends it to the attacker’s server, using …
Dark Angels Linux ESXi ransomware targeted Johnson Controls’ VMware ESXi servers in September 2023 and encrypts files using AES-256. SentinelOne’s analysis finds substantial overlap with RagnarLocker’s ESXi variant, suggesting shared code and victimology betwe…
The advisory describes active exploitation of CVE-2023-22515 in Atlassian Confluence Data Center and Server, enabling threat actors to create unauthorized Confluence administrator accounts and gain initial access. It also covers post-exploitation data exfiltra…
The article analyzes multi-stage supply-chain infections where threat actors trojanize GitHub repositories and malicious PyPi packages to deliver Python-based droppers and information stealers. Key techniques include a novel “exec smuggling” pattern (whitespac…
Phylum detected a typosquatted NuGet package that delivered the SeroXen RAT, demonstrating how open-source ecosystems can be abused. The post details the typosquatted package, its obfuscated payload chain (PowerShell, batch scripts, DLLs), and download-count a…
Recent AgentTesla campaigns show the malware spreading via CHM and PDF attachments, using a Gzip-compressed CHM lure that downloads a PowerShell script to start the infection. The chain employs layered Base64-encoded payloads and a .NET loader DLL to inject Ag…
ASEC reports ShellBot malware is now installed on poorly managed Linux SSH servers using hexadecimal IP addresses for its download URLs. The campaign features DDoS PBot v2.0 with IRC-based C2 and hex-encoded endpoints used to evade URL detection. #ShellBot #DD…
Stayin’ Alive is an active campaign in Asia primarily targeting the telecom sector and government organizations, with activity in Kazakhstan, Uzbekistan, Pakistan, and Vietnam. The operation relies on disposable downloaders/loaders and DLL side-loading, all li…
ToddyCat is an advanced APT actor whose latest activity expands its loader and post-exploitation toolkit, detailing how it compromised public-facing servers, loaded a Ninja Trojan, and moved to data collection and exfiltration using multiple loaders and droppe…
The article analyzes Lazarus Group’s Volgmer backdoor and Scout downloader, detailing how Volgmer operated from 2014 and how Scout began replacing Volgmer around 2022, including their C2, encryption, and anti-forensic techniques. It also covers dropper behavio…