Short Summary:
In 2024, the manufacturing sector has become a primary target for cyber attacks, particularly ransomware, leading to significant financial and operational disruptions. Key threat actors include various ransomware …
Tag: IOT
Summary: MediaTek has released a Product Security Bulletin in October 2024 detailing critical vulnerabilities in its chipsets that could lead to remote code execution, privilege escalation, and denial-of-service attacks. The …
Threat Actor: UserSec | UserSec Victim: Global Cybersecurity Defenses | Global Cybersecurity Defenses Price: Not disclosed Exfiltrated Data Type: N/A
Key Points :
UserSec has launched a new DDoS attack…
Short Summary
Read More
The Gorilla Botnet, a new botnet family, emerged in September 2024, launching over 300,000 DDoS attack commands across 113 countries, with China and the U.S. being the most …
Summary: Recent cyber espionage campaigns linked to China have targeted U.S. internet service providers, with the Salt Typhoon operation focusing on intelligence gathering and potential disruptions. Investigations are ongoing to …
Summary: The article discusses the vulnerabilities found in Automatic Tank Gauge (ATG) systems that monitor fuel storage, highlighting the risks posed by their exposure to the Internet. It emphasizes the …
Summary of “What Comes Next in Open Source?”
Summary of “What Comes Next in Open Source?”The video discusses the evolving landscape of open source AI models, emphasizing the recent …
Summary: A critical security flaw (CVE-2024-7490) in the Microchip Advanced Software Framework (ASF) could allow remote code execution due to a stack-based overflow vulnerability. Additionally, a severe zero-click vulnerability (CVE-2024-20017) …
Summary: Researchers from Lumen’s Black Lotus Labs have identified a new botnet named Raptor Train, primarily composed of compromised SOHO and IoT devices, believed to be controlled by the China-linked …
Short Summary
Read More
In mid-2023, Black Lotus Labs uncovered a significant botnet named “Raptor Train,” believed to be operated by the Chinese threat actors known as Flax Typhoon. This botnet has …
Summary: The FCC is launching a voluntary cybersecurity labeling program to help consumers identify products that meet specific cybersecurity standards, including a new U.S. Cyber Trust Mark. This initiative aims …
Summary: A new report reveals that over 1.3 million Android TV streaming boxes have been infected with the Vo1d backdoor malware, allowing attackers to gain full control of the devices. …
Short Summary
Read More
The Sekoia TDR team has uncovered new developments related to the Quad7 botnet operators, who are compromising various SOHO routers and VPN appliances. The operators are evolving their …
Short Summary:
EclecticIQ analysts have researched ransomware operations, particularly focusing on SCATTERED SPIDER, a group targeting cloud infrastructures in the insurance and financial sectors. They employ social engineering tactics, including …
Short Summary: The FBI, CISA, and NSA have assessed that Russian GRU Unit 29155 is responsible for cyber operations targeting global entities for espionage and sabotage since 2020. They have…
Read More
Summary: JFrog’s security research team has identified a new supply chain attack technique called “Revival Hijack,” which allows malicious actors to hijack removed PyPI packages, potentially leading to widespread malware …
Summary: Forescout’s 2024H1 Threat Review highlights a significant increase in vulnerabilities and ransomware attacks in the first half of 2024 compared to the same period in 2023, emphasizing the need …
Short Summary
Read More
The Unit 42 Managed Threat Hunting team has identified a variant of WikiLoader, known as WailingCrab, which is being delivered through SEO poisoning and spoofing of GlobalProtect VPN …
Short Summary: The healthcare sector is increasingly targeted by cybercriminals, with data breaches costing an average of USD 9.77 million per incident. The rise of Ransomware-as-a-Service (RaaS) and vulnerabilities in…
Read More
Summary: Malicious hackers are exploiting a critical vulnerability in the AVM1203 security camera to spread a variant of the Mirai malware, which targets Internet of Things (IoT) devices for distributed …
Short Summary:
The article discusses a new variant of Copybara, an Android malware family that has been active since November 2023. This malware is primarily spread through voice phishing attacks …
Short Summary:
Aqua Nautilus researchers have identified a new variant of the Gafgyt botnet that targets machines with weak SSH passwords. This botnet executes binaries from memory to expand its …
Summary: A new variant of the Gafgyt botnet is exploiting weak SSH passwords to compromise machines for cryptocurrency mining, particularly targeting cloud-native environments. This evolution highlights a shift in focus …
Summary: Researchers have identified significant vulnerabilities in solar power management platforms operated by Solarman and Deye, which could allow attackers to control solar inverters and disrupt the electricity grid. These …
Summary: A recent Forescout report reveals that many OT/IoT routers are running outdated software components with known vulnerabilities, posing significant security risks. The analysis of firmware from various vendors highlights …
Summary: Sporting events create extensive consumer engagement and interconnected networks that enhance experiences but also introduce significant cybersecurity risks. Businesses and fans must be aware of these vulnerabilities and implement …
Threat Actor: Advanced Cybercriminals | Advanced Cybercriminals Victim: Organizations with EDR Solutions | Organizations with EDR Solutions Price: $3,700 Exfiltrated Data Type: Sensitive Information
Key Points :
The DIANA framework…Summary: The White House has announced a $15 million scholarship initiative by EC-Council aimed at enhancing cybersecurity education for over 50,000 students across North America. This initiative is part of …
Summary: Researchers have revealed that tens of thousands of Ubiquiti SOHO devices remain vulnerable to a five-year-old bug, CVE-2017-0938, despite a patch being available. The exposed devices can be exploited …
Summary: The Apache Foundation’s OFBiz framework, a Java-based ERP solution, recently faced a critical security vulnerability that could allow remote command execution. Despite its lower prevalence compared to commercial ERP …
Threat Actor: Malicious Actors | malicious actors Victim: Ubiquiti | Ubiquiti Price: N/A Exfiltrated Data Type: Device information and owner details
Key Points :
Over 20,000 Ubiquiti devices, including G4…Threat Actor: Unknown | DDoS attack Victim: Microsoft | Microsoft Price: Estimated impact of millions in lost revenue and service disruption Exfiltrated Data Type: N/A
Key Points :
On July…Summary: A critical local privilege escalation vulnerability (CVE-2024-41637) has been identified in RaspAP, an open-source project for managing wireless access points on Raspberry Pi, allowing attackers to gain root access …
Summary: NVIDIA has patched a high-severity vulnerability in its Jetson series computing boards that could allow denial of service, code execution, and privilege escalation in AI systems. The flaw, tracked …
Summary: The SonicWall 2024 Mid-Year Cyber Threat Report reveals a significant surge in malware-based threats, with a 30% increase in the first half of 2024 compared to the previous year, …
Summary: The European Union is facing a significant increase in brute-force cyberattacks on corporate and institutional networks, primarily attributed to Russian threat actors exploiting Microsoft infrastructure to evade detection. This …
Table of contents
Key Takeaways
Sekoia.io investigated the mysterious 7777 botnet (aka. Quad7 botnet), published by the independent researcher Gi7w0rm inside the “The curious case of the 7777 botnet” blogpost.…
Read More
Summary: Multiple threat actors are exploiting the PHP vulnerability CVE-2024-4577 to deliver various malware families, including Gh0st RAT, RedTail cryptominers, and XMRig.
Threat Actor: Multiple threat actors are exploiting the …
Summary: This content highlights the latest vulnerabilities and their severity in various Microsoft products, including .NET and Visual Studio, Active Directory Rights Management Services, Azure CycleCloud, and Azure DevOps.
Threat …
Threat Actor: DeathNote Hackers | DeathNote Hackers Victim: Department of Education | Department of Education Price: Not specified Exfiltrated Data Type: Not specified
Key Points :
Data breaches were the…Summary: The content discusses the security and privacy challenges brought about by the proliferation of Internet of Things (IoT) devices, with a focus on vulnerabilities found in TVs, smart plugs, …
Summary: This content discusses a high-severity vulnerability in Traeger grills that could be exploited by threat actors to control the grills remotely, potentially ruining BBQ cookouts.
Threat Actor: Unknown threat …
Summary: Microsoft has discovered and disclosed two significant vulnerabilities in Rockwell Automation’s PanelView Plus devices, which could be remotely exploited by unauthenticated attackers to execute remote code and initiate denial-of-service …
Summary: The content discusses the approaching Q-Day, when a quantum computer can break most forms of modern encryption, leaving our societies vulnerable to cyberattacks.
Threat Actor: Quantum computers | Quantum …
Summary: The content discusses the projected growth of spending on operational technology (OT) cybersecurity and the factors driving this increase.
Threat Actor: N/A Victim: N/A
Key Point :
Enterprise spending…Summary: P2PInfect, a dormant peer-to-peer malware botnet, has recently become active and is deploying a ransomware module and a cryptominer in attacks on Redis servers.
Threat Actor: P2PInfect | P2PInfect …
Summary: This content discusses active attacks targeting end-of-life Zyxel NAS boxes after the disclosure of critical vulnerabilities.
Threat Actor: Mirai-like botnet | Mirai-like botnet Victim: Zyxel NAS devices | Zyxel …
CVE-2024-33001 – SAP NetWeaver and ABAP Platform VulnerabilityJune 24, 2024Donot APT Group – Active IOCsJune 24, 2024
Analysis SummaryThe Mirai botnet is a type of malware that infects Internet …
Introduction
Read More
The Hi-Tech Crime Trends report by Group-IB highlights a growing cybercriminal focus on Apple devices due to their increasing popularity. This shift has led to a rise in malware …
Overview
Read More
On May 7, 2024, Devcore Principal Security Researcher Orange Tsai discovered and reported a critical Remote Code Execution (RCE) vulnerability, CVE-2024-4577, to the PHP official team. This vulnerability stems …