Tag: 2024-12-17

8 Attack Reports | 88 Vulnerabilities

Attack reports

Unpacking the Diicot Malware Targeting Linux Environments

A new malware campaign attributed to the Romanian-speaking Diicot threat group has been discovered targeting Linux systems. The campaign shows significant advancements compared to previous iterations, including modified UPX headers with corrupted checksums, advanced payload staging, and environment…
malware
linux
openssh
xmrig
persistence
cryptomining
brute-force
2024-12-17
reverse-shell
upx
Published: December 17, 2024
Downloadable IOCs: 36

BADBOX Botnet Is Back

The BADBOX botnet, previously thought to be contained, has resurfaced with increased scope and sophistication. Recent findings reveal over 192,000 infected devices, including high-end Yandex 4K QLED Smart TVs and Hisense smartphones, expanding beyond the initially targeted off-brand Android devices…
malware
android
supply chain
botnet
proxy
ad fraud
triada
2024-12-17
badbox
firmware
smart tv
Published: December 17, 2024
Downloadable IOCs: 22

Hidden in Plain Sight: New Attack Chain Delivers Espionage RATs

An advanced persistent threat group, TA397, targeted a Turkish defense organization with a sophisticated attack chain. The campaign used a RAR archive containing a decoy PDF, a shortcut file, and an Alternate Data Stream with PowerShell code. The infection process involved creating a scheduled task…
apt
espionage
rat
south asia
defense sector
scheduled tasks
2024-12-17
turkey
miyarat
wmrat
alternate data streams
Published: December 17, 2024
Downloadable IOCs: 0

Brain Cipher Ransomware uses CVE-2023-28252

Brain Cipher ransomware is suspected of exploiting CVE-2023-28252, a vulnerability previously utilized by the now-inactive Nokowaya Ransomware Group. The exploit, often disguised as 'clfs_eop.exe', targets the Microsoft Windows CLFS Driver for privilege escalation. This vulnerability is being sold …
ransomware
privilege-escalation
2024-12-17
CVE-2023-28252
brain cipher
clfs filename
Published: December 17, 2024
Downloadable IOCs: 2

Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks

Earth Koshchei, an APT group suspected to be sponsored by the Russian SVR, executed a large-scale rogue RDP campaign targeting high-profile sectors. The attack methodology involved spear-phishing emails, red team tools, and sophisticated anonymization techniques. The campaign used an RDP relay, rog…
data exfiltration
spear-phishing
apt29
midnight blizzard
2024-12-17
python remote desktop protocol mitm tool (pyrdp)
roguerdp
tor exit nodes
Published: December 17, 2024
Downloadable IOCs: 421

APT-C-36 (Blind Eagle) continues to target Colombia

APT-C-36, known as Blind Eagle, is suspected to originate from South America and primarily targets Colombia and other South American countries. Since October 2024, the group has been using more diverse and complex attack methods against Colombian entities. Their tactics involve multi-stage payload …
asyncrat
2024-12-17
svg bait
heaven's gate
government impersonation
Published: December 17, 2024
Downloadable IOCs: 4

CoinLurker: The Stealer Powering the Next Generation of Fake Updates

CoinLurker is a sophisticated stealer designed to exfiltrate data while evading detection. Written in Go, it employs advanced obfuscation and anti-analysis techniques, making it highly effective in modern cyberattacks. The malware is delivered through fake update campaigns, leveraging deceptive ent…
cryptocurrency
2024-12-17
coinlurker
Published: December 17, 2024
Downloadable IOCs: 50

How Threat Actors Exploit Brand Collaborations to Target Popular YouTube Channels

Cybercriminals are targeting YouTube creators through sophisticated phishing campaigns that impersonate trusted brands offering collaboration deals. The malware is disguised as legitimate documents and delivered via password-protected files on platforms like OneDrive. Once downloaded, it steals sen…
phishing
social engineering
youtube
brand impersonation
2024-12-17
content creators
Published: December 17, 2024
Downloadable IOCs: 3
Click here to see more Attack Reports

Vulnerabilities

CVE-2024-12356

9.8
    Beyondtrust
  • Privileged Remote Access
  • Remote Support
Published: December 17, 2024

CVE-2024-50379

9.8
    Apache Tomcat
Published: December 17, 2024

CVE-2024-8972

9.8
    Mobil365 Informatics Saha365 App
Published: December 17, 2024

CVE-2024-55515

9.8
    Raisecom MSG1200, MSG2100E, MSG2200, MSG2300
Published: December 17, 2024

CVE-2024-29646

9.8
    radare2
Published: December 17, 2024

CVE-2024-10205

9.4
    Hitachi Ops Center Analyzer
    Hitachi Infrastructure Analytics Advisor
Published: December 17, 2024

CVE-2024-54662

9.1
    Dante
Published: December 17, 2024

CVE-2024-55496

9.1
    1000projects Bookstore Management System PHP MySQL Project
Published: December 17, 2024

CVE-2024-55513

9.1
    Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300
Published: December 17, 2024

CVE-2024-55516

9.1
    Raisecom MSG1200
    Raisecom MSG2100E
    Raisecom MSG2200
    Raisecom MSG2300
Published: December 17, 2024

CVE-2024-31668

9.1
    UNKNOWN
Published: December 17, 2024

CVE-2024-38499

8.8
    CA Client Automation (ITCM)
Published: December 17, 2024

CVE-2024-11999

8.8
    HMI product
Published: December 17, 2024

CVE-2024-12293

8.8
    User Role Editor plugin for WordPress
Published: December 17, 2024

CVE-2024-8326

8.8
    s2Member WordPress plugin
Published: December 17, 2024

CVE-2024-10476

8.0
    BD Diagnostic Solutions
Published: December 17, 2024

CVE-2021-26280

7.9
    UNKNOWN
Published: December 17, 2024

CVE-2024-11422

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12178

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12179

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12191

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12192

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12193

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12194

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12197

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12198

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12199

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12200

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12669

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12670

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-12671

7.8
    Autodesk Navisworks
Published: December 17, 2024

CVE-2024-9624

7.6
    WP All Import Pro plugin for WordPress
Published: December 17, 2024

CVE-2024-36832

7.5
    D-Link DAP-1513 REVA
Published: December 17, 2024

CVE-2024-51479

7.5
    Next.js
Published: December 17, 2024

CVE-2024-51175

7.5
    H3C switch h3c-S1526
Published: December 17, 2024

CVE-2024-9779

7.5
    Open Cluster Management (OCM)
Published: December 17, 2024

CVE-2024-49194

7.3
    Databricks JDBC Driver
Published: December 17, 2024

CVE-2024-12024

7.2
    Metagauss
  • Eventprime
Published: December 17, 2024

CVE-2020-12487

7.0
    Unknown
Published: December 17, 2024

CVE-2024-8475

6.5
    WiFiBurada
Published: December 17, 2024

CVE-2024-9819

6.5
    NG Analyser
Published: December 17, 2024

CVE-2024-37605

6.5
    D-Link DIR-860L
Published: December 17, 2024

CVE-2024-37606

6.5
    D-Link DCS-932L
Published: December 17, 2024

CVE-2024-37607

6.5
    D-Link DAP-2555
Published: December 17, 2024

CVE-2024-52792

6.5
    LDAP Account Manager (LAM)
Published: December 17, 2024

CVE-2024-56142

6.5
    pghoard
Published: December 17, 2024

CVE-2024-11900

6.4
    Portfolio - Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress
Published: December 17, 2024

CVE-2024-11902

6.4
    Slope Widgets plugin for WordPress
Published: December 17, 2024

CVE-2024-11905

6.4
    Animated Counters plugin for WordPress
Published: December 17, 2024

CVE-2024-11906

6.4
    TPG Get Posts plugin for WordPress
Published: December 17, 2024

CVE-2020-12484

6.4
    UNKNOWN
Published: December 17, 2024

CVE-2021-26278

6.3
    UNKNOWN
Published: December 17, 2024

CVE-2024-55514

6.3
    Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300
Published: December 17, 2024

CVE-2024-12239

6.1
    PowerPack Lite for Beaver Builder plugin for WordPress
Published: December 17, 2024

CVE-2024-12219

6.1
    WordPress Stop Registration Spam plugin
Published: December 17, 2024

CVE-2024-12220

6.1
    SMS for WooCommerce plugin for WordPress
Published: December 17, 2024

CVE-2024-12127

6.1
    Sikshya LMS plugin for WordPress
Published: December 17, 2024

CVE-2024-12469

6.1
    WP BASE Booking of Appointments, Services and Events plugin for WordPress
Published: December 17, 2024

CVE-2024-12395

6.1
    WooCommerce Additional Fees On Checkout (Free) plugin for WordPress
Published: December 17, 2024

CVE-2024-55059

6.1
    PHPGurukul Online Birth Certificate System
Published: December 17, 2024

CVE-2021-26279

5.9
    UNKNOWN
Published: December 17, 2024

CVE-2024-10973

5.7
    Keycloak
Published: December 17, 2024

CVE-2021-26281

5.5
    UNKNOWN
Published: December 17, 2024

CVE-2024-55056

5.4
    Phpgurukul Online Birth Certificate System
Published: December 17, 2024

CVE-2024-55057

5.4
    Phpgurukul Online Birth Certificate System
Published: December 17, 2024

CVE-2024-11294

5.3
    Memberful plugin for WordPress
Published: December 17, 2024

CVE-2024-11280

5.3
    PPWP – Password Protect Pages plugin for WordPress
Published: December 17, 2024

CVE-2024-12601

5.3
    Calculated Fields Form plugin for WordPress
Published: December 17, 2024

CVE-2024-54677

5.3
    Apache Tomcat
Published: December 17, 2024

CVE-2024-36831

5.3
    D-Link DAP-1520
Published: December 17, 2024

CVE-2024-49816

4.9
    Ibm
  • Security Guardium Key Lifecycle Manager
Published: December 17, 2024

CVE-2024-55864

4.8
    My WP Customize Admin/Frontend
Published: December 17, 2024

CVE-2023-37940

4.8
    Liferay Portal
    Liferay DXP
Published: December 17, 2024

CVE-2024-52542

4.4
    Dell AppSync
Published: December 17, 2024

CVE-2024-49817

4.4
    Ibm
  • Security Guardium Key Lifecycle Manager
Published: December 17, 2024

CVE-2024-8429

4.3
    WiFiBurada
Published: December 17, 2024

CVE-2024-10356

4.3
    ElementsReady Addons for Elementor plugin for WordPress
Published: December 17, 2024

CVE-2024-49818

4.3
    Ibm
  • Security Guardium Key Lifecycle Manager
Published: December 17, 2024

CVE-2024-55058

4.3
    PHPGurukul Online Birth Certificate System
Published: December 17, 2024

CVE-2024-49819

4.1
    Ibm
  • Security Guardium Key Lifecycle Manager
Published: December 17, 2024

CVE-2024-9654

3.7
    Easy Digital Downloads plugin for WordPress
Published: December 17, 2024

CVE-2024-49820

3.7
    Ibm
  • Security Guardium Key Lifecycle Manager
Published: December 17, 2024

CVE-2024-54125

3.3
    Shonen Jump+ App for Android
Published: December 17, 2024

CVE-2024-42194

3.1
    HCL BigFix Inventory
Published: December 17, 2024

CVE-2024-53144

None
    Linux kernel
Published: December 17, 2024

CVE-2024-56139

None
    pdftools
Published: December 17, 2024

CVE-2024-11993

None
    Liferay Portal
    Liferay DXP
Published: December 17, 2024

CVE-2024-12539

None
    Elasticsearch
Published: December 17, 2024
Click here to see more Vulnerabilities