Tag: 2024-11-04

8 Attack Reports | 142 Vulnerabilities

Attack reports

Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT

APT36, also known as Transparent Tribe, is a Pakistan-based threat actor targeting Indian government and military entities. Their campaigns utilize ElizaRAT, a Windows Remote Access Tool that has evolved to enhance evasion techniques and C2 communication. Recent campaigns employ cloud services like…
espionage
rat
stealer
transparent tribe
apt36
cloud services
2024-11-04
apolostealer
Published: November 4, 2024
Downloadable IOCs: 23

G700: The Next Generation of Craxs RAT

G700 RAT, an advanced variant of Craxs RAT, targets Android devices and cryptocurrency applications. It employs sophisticated techniques like privilege escalation, phishing, and malicious APK distribution to infiltrate devices. The malware bypasses authentication, captures sensitive data, and manip…
obfuscation
phishing
android
cryptocurrency
craxs rat
privilege escalation
2024-11-04
apk distribution
transaction hijacking
sms interception
g700 rat
Published: November 4, 2024
Downloadable IOCs: 3

Recent Keylogger Attributed to North Korean Group Andariel

A new keylogger, attributed to the North Korean group Andariel (APT45), has been linked to targeted attacks against U.S. organizations. The malware captures keystrokes and mouse activity, storing data in an encrypted archive. It employs anti-analysis techniques like code obfuscation through junk co…
persistence
anti-analysis
keylogger
apt45
2024-11-04
andariel keylogger
hook procedures
clipboard theft
Published: November 4, 2024
Downloadable IOCs: 1

DDoS-for-Hire Platform dstat[.]cc Disrupted; Suspects Arrested

German law enforcement authorities have successfully disrupted dstat[.]cc, a criminal service facilitating distributed denial-of-service (DDoS) attacks. The platform provided recommendations and evaluations of stresser services, making DDoS attacks accessible to users without advanced technical ski…
ddos
botnet
cybercrime
2024-11-04
law enforcement
stresser services
drug trafficking
Published: November 4, 2024
Downloadable IOCs: 1

Attacker Abuses Victim Resources to Reap Rewards from Titan Network

An attacker exploited the Atlassian Confluence vulnerability CVE-2023-22527 to achieve remote code execution for cryptomining via the Titan Network. The malicious actor gathered system details using public IP lookup services and various commands. Multiple shell scripts were downloaded and executed …
cryptomining
aws
ssh
remote code execution
CVE-2023-22527
atlassian confluence
2024-11-04
titan network
cassini testnet
aleo-pool
Published: November 4, 2024
Linked vulnerabilities : CVE-2023-22527
Downloadable IOCs: 1

Cryptocurrency Enthusiasts Targeted in Multi-Vector Supply Chain Attack

A sophisticated malware campaign targeting cryptocurrency enthusiasts has been uncovered, utilizing multiple attack vectors including a malicious Python package on PyPI and deceptive GitHub repositories. The multi-stage malware, disguised as cryptocurrency trading tools, aims to steal sensitive dat…
supply-chain
cryptocurrency
data-theft
social-engineering
pypi
github
2024-11-04
multi-stage
gui
cryptoaitools
Published: November 4, 2024
Downloadable IOCs: 2

Analyzing an Encrypted Phishing PDF

This analysis explores the challenges of decoding encrypted PDF documents, particularly in the context of phishing. It explains that while the structure of encrypted PDFs remains visible, strings and streams are encrypted. The article recommends using qpdf, an open-source tool, to decrypt PDFs for …
phishing
2024-11-04
decryption
qpdf
drm
pdf-parser
ciphertext
uri extraction
encrypted pdf
confidentiality
Published: November 4, 2024
Downloadable IOCs: 0

InfoStealer Malware Attacking Meta Business Page To Steal Logins

A sophisticated malvertising campaign is distributing the SYS01 infostealer malware through Meta's advertising platform. The attackers impersonate trusted brands and popular software, targeting primarily senior male demographics. The malware, designed to steal personal data and credentials, is dist…
malvertising
powershell
infostealer
persistence
electron
credential theft
sys01
meta
social media
2024-11-04
Published: November 4, 2024
Downloadable IOCs: 26
Click here to see more Attack Reports

Vulnerabilities

CVE-2024-50523

10.0
    Rainbow-Link
  • All Post Contact Form
Published: November 4, 2024

CVE-2024-50525

10.0
    Helloprint
  • Helloprint
Published: November 4, 2024

CVE-2024-50526

10.0
    Lindeni
  • Multi Purpose Mail Form
Published: November 4, 2024

CVE-2024-50527

10.0
    Stacksmarket
  • Stacks Mobile App Builder
Published: November 4, 2024

CVE-2024-50531

10.0
    Carrcommunications
  • Rsvpmaker
Published: November 4, 2024

CVE-2024-50529

9.9
    Rudrainnovative
  • Training - Courses
Published: November 4, 2024

CVE-2024-50530

9.9
    Myriadsolutionz
  • Stars Smtp Mailer
Published: November 4, 2024

CVE-2024-10035

9.8
    Bg-Tek
  • Coslat
Published: November 4, 2024

CVE-2024-51558

9.8
    63moons
  • Aero
  • Wave 2.0
Published: November 4, 2024

CVE-2024-51136

9.8
    Openimaj
  • Openimaj
Published: November 4, 2024

CVE-2024-51327

9.8
    Projectworlds
  • Travel Management System
Published: November 4, 2024

CVE-2024-48050

9.8
    agentscope
Published: November 4, 2024

CVE-2024-48061

9.8
    langflow
Published: November 4, 2024

CVE-2024-23590

9.1
    Apache Kylin
Published: November 4, 2024

CVE-2024-51661

9.1
    Davidlingren
  • Media Library Assistant
Published: November 4, 2024

CVE-2024-51329

8.8
    Idrsdev
  • Agile-Board
Published: November 4, 2024

CVE-2024-30616

8.8
    Chamilo LMS
Published: November 4, 2024

CVE-2024-51408

8.5
    Appsmith
  • Appsmith
Published: November 4, 2024

CVE-2024-51626

8.5
    Mansurahamed
  • Woocommerce Quote Calculator
Published: November 4, 2024

CVE-2024-20104

8.4
    UNKNOWN
Published: November 4, 2024

CVE-2024-48336

8.4
    Magisk App
Published: November 4, 2024

CVE-2024-48878

8.3
    Zohocorp
  • Manageengine Admanager Plus
Published: November 4, 2024

CVE-2024-36485

8.3
    Zohocorp
  • Manageengine Adaudit Plus
Published: November 4, 2024

CVE-2024-38408

8.2
    Qualcomm
  • Wsa8845h Firmware
  • Wsa8845h
  • Wsa8845 Firmware
  • Wsa8845
  • Wsa8840 Firmware
  • Wsa8840
  • Wsa8835 Firmware
  • Wsa8835
  • Wsa8832 Firmware
  • Wsa8832
  • Wsa8830 Firmware
  • Wsa8830
  • Wsa8815 Firmware
  • Wsa8815
  • Wsa8810 Firmware
  • Wsa8810
  • Wcn7881 Firmware
  • Wcn7881
  • Wcn7880 Firmware
  • Wcn7880
  • Wcn7861 Firmware
  • Wcn7861
  • Wcn7860 Firmware
  • Wcn7860
  • Wcn6755 Firmware
  • Wcn6755
  • Wcn6740 Firmware
  • Wcn6740
  • Wcn3988 Firmware
  • Wcn3988
  • Wcn3980 Firmware
  • Wcn3980
  • Wcn3950 Firmware
  • Wcn3950
  • Wcd9395 Firmware
  • Wcd9395
  • Wcd9390 Firmware
  • Wcd9390
  • Wcd9385 Firmware
  • Wcd9385
  • Wcd9380 Firmware
  • Wcd9380
  • Wcd9375 Firmware
  • Wcd9375
  • Wcd9370 Firmware
  • Wcd9370
  • Wcd9360 Firmware
  • Wcd9360
  • Wcd9341 Firmware
  • Wcd9341
  • Wcd9340 Firmware
  • Wcd9340
  • Sxr2250p Firmware
  • Sxr2250p