Tag: 2024-12-19

8 Attack Reports | 106 Vulnerabilities

Attack reports

Welcome to the party, pal!

This end-of-year newsletter discusses cybersecurity trends and personal anecdotes. It emphasizes the importance of multi-factor authentication and password management, highlighting the prevalence of identity-based attacks. The author shares a story about introducing hardware tokens to family member…
multi-factor authentication
password management
badbox
2024-12-19
vulnerability research
trojan/win32.coinminer.r174018
hardware tokens
identity-based attacks
win.worm.bitmin-9847045-0
w32.file.malparent
win32.trojan-stealer.petef.fpskk8
malware detection
coinminer:mbt.26mw.in14.talos
Published: December 19, 2024
Downloadable IOCs: 5

Attackers exploiting a FortiClient EMS vulnerability in the wild

Kaspersky's GERT team identified an attack exploiting a patched vulnerability (CVE-2023-48788) in FortiClient EMS versions 7.0.1 to 7.0.10 and 7.2.0 to 7.2.2. The attackers used SQL injection to infiltrate a company's network through an exposed Windows server. They deployed remote access tools like…
screenconnect
sql injection
forticlient ems
anydesk
credential theft
remote access
lateral movement
mimikatz
CVE-2023-48788
2024-12-19
Published: December 19, 2024
Downloadable IOCs: 0

Security Brief: Threat Actors Gift Holiday Lures to Threat Landscape

As the holiday season approaches, threat actors are exploiting people's desires for deals, jobs, and end-of-year bonuses. Researchers have observed an increase in themed content delivering malware, fraud, and credential phishing campaigns. Examples include a 'Winter Holiday Promotion' campaign deli…
qr codes
remcos rat
credential phishing
2024-12-19
adversary-in-the-middle (aitm)
employment fraud
tycoon phishing-as-a-service (phaas)
open office xml (ooxml)
Published: December 19, 2024
Downloadable IOCs: 0

North Korean group targets nuclear-related organization with new malware

The Lazarus group has evolved its infection chain by targeting employees of a nuclear-related organization with a combination of new and old malware. The attack involved delivering malicious archive files containing trojanized VNC utilities and various malware strains including Ranid Downloader, MI…
supply chain
modular malware
2024-12-19
lpeclient
wordpress c2
cookietime
deathnote campaign
rollmid
servicechanger
ranid downloader
charamel loader
nuclear
trojanized vnc
mistpen
cookieplus
Published: December 19, 2024
Linked vulnerabilities : CVE-2019-0859, CVE-2019-0797
Downloadable IOCs: 1

NotLockBit: A Deep Dive Into the New Ransomware Threat

NotLockBit is an emerging ransomware family that mimics LockBit's behavior while targeting both macOS and Windows systems. Distributed as an x86_64 golang binary, it showcases advanced capabilities including targeted file encryption, data exfiltration, and self-deletion mechanisms. The malware gath…
ransomware
encryption
golang
cross-platform
data-exfiltration
2024-12-19
notlockbit
aws-abuse
self-deletion
Published: December 19, 2024
Downloadable IOCs: 5

Python-Based NodeStealer Version Targets Facebook Ads Manager

The latest variant of NodeStealer has evolved from JavaScript to Python, expanding its data theft capabilities. Trend Micro's MXDR team uncovered this advanced version in a campaign targeting a Malaysian educational institution, linked to a Vietnamese threat group. The malware now targets Facebook …
python
infostealer
dll sideloading
data exfiltration
telegram
spear-phishing
2024-12-19
nodestealer
facebook ads manager
Published: December 19, 2024
Downloadable IOCs: 5

Stealthy Cyber Attacks: LNK Files & SSH Commands Playbook

This analysis explores a rising trend in cyber attacks where threat actors leverage LNK files and SSH commands as initial infection vectors. The attackers use meticulously crafted shortcut files, often disguised as legitimate documents, to execute commands using Living-off-the-Land Binaries (LOLBin…
powershell
evasion techniques
lnk files
rundll32
2024-12-19
hackbrowserdata
scp
living-off-the-land binaries
cyber attacks
ssh commands
Published: December 19, 2024
Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-44228, CVE-2017-11882, CVE-2024-21893
Downloadable IOCs: 6

A new playground: Malicious campaigns proliferate from VSCode to npm

This intelligence details the emergence of malicious campaigns spreading from VSCode to npm. Researchers observed an increasing amount of malicious activity in VSCode Marketplace, with threat actors using npm packages to inject malicious code into VSCode IDE. The campaign initially targeted the cry…
obfuscation
npm
downloader
crypto
software supply chain
2024-12-19
zoom
malicious extensions
vscode
Published: December 19, 2024
Downloadable IOCs: 2
Click here to see more Attack Reports

Vulnerabilities

CVE-2023-4617

10.0
    Govee Home application (Android)
    Govee Home application (iOS)
Published: December 19, 2024

CVE-2021-26102

9.8
    FortiWAN
Published: December 19, 2024

CVE-2024-10244

9.8
    ISDO Software Web Software
Published: December 19, 2024

CVE-2024-55081

9.8
    Chat2DB
Published: December 19, 2024

CVE-2024-12727

9.8
    Sophos Firewall
Published: December 19, 2024

CVE-2024-12728

9.8
    Sophos Firewall
Published: December 19, 2024

CVE-2024-54983

9.8
    Quectel BC95-CNV
Published: December 19, 2024

CVE-2024-54984

9.8
    Quectel BG96
Published: December 19, 2024

CVE-2024-56327

9.8
    pyrage
Published: December 19, 2024

CVE-2024-12626

9.6
    AutomatorWP WordPress plugin
Published: December 19, 2024

CVE-2024-54150

9.1
    cjwt
Published: December 19, 2024

CVE-2024-11984

8.8
    Corporate Training Management System
Published: December 19, 2024

CVE-2020-15934

8.8
    FortiClient for Linux
Published: December 19, 2024

CVE-2024-25131

8.8
    OpenShift Dedicated
Published: December 19, 2024

CVE-2024-47093

8.8
    Nagvis
Published: December 19, 2024

CVE-2024-12729

8.8
    Sophos Firewall
Published: December 19, 2024

CVE-2024-12700

8.8
    UNKNOWN
Published: December 19, 2024

CVE-2024-56200

8.6
    Altair
Published: December 19, 2024

CVE-2021-32589

8.1
    Fortinet FortiManager
    Fortinet FortiAnalyzer
Published: December 19, 2024

CVE-2024-12111

8.0
    OpenText Privileged Access Manager
Published: December 19, 2024

CVE-2022-44512

7.8
    Acrobat Reader DC
Published: December 19, 2024

CVE-2022-44513

7.8
    Acrobat Reader DC
Published: December 19, 2024

CVE-2022-44514

7.8
    Acrobat Reader DC
Published: December 19, 2024

CVE-2022-44518

7.8
    Acrobat Reader DC
Published: December 19, 2024

CVE-2022-44520

7.8
    Adobe Acrobat Reader DC
Published: December 19, 2024

CVE-2022-27595

7.8
    QVPN Device Client
Published: December 19, 2024

CVE-2024-35141

7.8
    IBM Security Verify Access Docker
Published: December 19, 2024

CVE-2024-4229

7.8
    Edgecross Basic Software for Windows
    Edgecross Basic Software for Developers
Published: December 19, 2024

CVE-2024-4230

7.8
    Edgecross Basic Software for Windows
    Edgecross Basic Software for Developers
Published: December 19, 2024

CVE-2024-12569

7.8
    HikVision XProtect Device Pack
Published: December 19, 2024

CVE-2021-26115

7.8
    FortiWAN
Published: December 19, 2024

CVE-2024-12786

7.8
    UNKNOWN
Published: December 19, 2024

CVE-2024-12175

7.8
    Rockwellautomation
  • Arena
Published: December 19, 2024

CVE-2024-54790

7.5
    PHPGurukul Pre-School Enrollment System
Published: December 19, 2024

CVE-2024-55082

7.5
    Stirling-PDF
Published: December 19, 2024

CVE-2023-7005

7.5
    TTLock App
Published: December 19, 2024

CVE-2024-38819

7.5
    Spring Framework
Published: December 19, 2024

CVE-2024-55196

7.5
    GoPhish
Published: December 19, 2024

CVE-2024-53991

7.5
    Discourse
Published: December 19, 2024

CVE-2024-54663

7.5
    Zimbra Collaboration
Published: December 19, 2024

CVE-2023-23354

7.3
    QNAP QuLog Center
Published: December 19, 2024

CVE-2024-11740

7.3
    Download Manager plugin for WordPress
Published: December 19, 2024

CVE-2021-26093

7.3
    FortiWLC
Published: December 19, 2024

CVE-2024-12782

7.3
    Fujifilm Apeos
Published: December 19, 2024

CVE-2024-12787

7.3
    1000projects
  • Attendance Tracking Management System
Published: December 19, 2024

CVE-2024-12788

7.3
    Codezips
  • Technical Discussion Forum
Published: December 19, 2024

CVE-2024-12791

7.3
    Codezips
  • E-Commerce Site
Published: December 19, 2024

CVE-2024-12792

7.3
    Codezips
  • E-Commerce Site
Published: December 19, 2024

CVE-2024-51532

7.1
    Dell PowerStore
Published: December 19, 2024

CVE-2022-27600

6.8
    QNAP QTS
    QNAP QuTS hero
    QNAP QuTScloud
Published: December 19, 2024

CVE-2024-52794

6.8
    Discourse
Published: December 19, 2024

CVE-2024-55603

6.5
    Kanboard
Published: December 19, 2024

CVE-2024-10548

6.5
    WP Project Manager plugin for WordPress
Published: December 19, 2024

CVE-2024-37962

6.5
    Agency Dominion Fusion
Published: December 19, 2024

CVE-2024-45818

6.5
    Xen Hypervisor
Published: December 19, 2024

CVE-2024-49336

6.5
    Ibm
  • Security Guardium
Published: December 19, 2024

CVE-2024-7137

6.5
    Bluetooth SDK (Silicon Labs)
Published: December 19, 2024

CVE-2024-7138

6.5
    Silicon Labs Bluetooth SDK (Bluetooth stack)
Published: December 19, 2024

CVE-2024-7139

6.5
    UNKNOWN
Published: December 19, 2024

CVE-2024-12784

6.3
    itsourcecode Vehicle Management System
Published: December 19, 2024

CVE-2024-12785

6.3
    itsourcecode Vehicle Management System
Published: December 19, 2024

CVE-2024-12789

6.3
    Pbootcms
  • Pbootcms
Published: December 19, 2024

CVE-2024-12794

6.3
    Codezips
  • E-Commerce Site
Published: December 19, 2024

CVE-2024-52896

6.2
    IBM MQ Appliance
Published: December 19, 2024

CVE-2024-52897

6.2
    IBM MQ Appliance
Published: December 19, 2024

CVE-2021-39081

5.9
    IBM Cognos Analytics Mobile for Android
Published: December 19, 2024

CVE-2020-6923

5.7
    HP Linux Imaging and Printing (HPLIP) software
Published: December 19, 2024

CVE-2022-44515

5.5
    Adobe
  • Acrobat
  • Acrobat Dc
  • Acrobat Reader
  • Acrobat Reader Dc
    Microsoft
    Apple
Published: December 19, 2024

CVE-2022-44516

5.5
    Adobe
  • Acrobat
  • Acrobat Dc
  • Acrobat Reader
  • Acrobat Reader Dc
    Microsoft
    Apple
Published: December 19, 2024

CVE-2022-44517

5.5
    Adobe
  • Acrobat
  • Acrobat Dc
  • Acrobat Reader
  • Acrobat Reader Dc
    Microsoft
    Apple
Published: December 19, 2024

CVE-2022-44519

5.5
    Acrobat Reader DC
Published: December 19, 2024

CVE-2023-21586

5.5
    Adobe Acrobat Reader
Published: December 19, 2024

CVE-2023-23356

5.5
    QNAP QuFirewall
Published: December 19, 2024

CVE-2024-45819

5.5
    Xen hypervisor
Published: December 19, 2024

CVE-2021-20553

5.4
    IBM Sterling B2B Integrator Standard Edition
Published: December 19, 2024

CVE-2024-12121

5.4
    WordPress Broken Link Checker | Finder plugin
Published: December 19, 2024

CVE-2020-12819

5.4
    FortiGate
Published: December 19, 2024

CVE-2020-12820

5.4
    FortiOS
Published: December 19, 2024

CVE-2023-30443

5.3
    IBM Db2 for Linux, UNIX and Windows
Published: December 19, 2024

CVE-2024-11768

5.3
    WordPress Download Manager plugin
Published: December 19, 2024

CVE-2024-51471

5.3
    IBM MQ Appliance
Published: December 19, 2024

CVE-2024-49765

5.3
    Discourse
Published: December 19, 2024

CVE-2021-29827

5.2
    IBM InfoSphere Information Server
Published: December 19, 2024

CVE-2023-23357

4.8
    QNAP QuLog Center
Published: December 19, 2024

CVE-2024-2201

4.7
    Linux Kernel
Published: December 19, 2024

CVE-2022-33954

4.6
    IBM Robotic Process Automation
Published: December 19, 2024

CVE-2024-12560

4.3
    WordPress Plugin - Button Block
Published: December 19, 2024

CVE-2024-12331

4.3
    File Manager Pro - Filester plugin for WordPress
Published: December 19, 2024

CVE-2024-12793

4.3
    Pbootcms
  • Pbootcms
Published: December 19, 2024

CVE-2024-54009

4.0
    HPE Alletra Storage MP B10000
Published: December 19, 2024

CVE-2024-12783

3.5
    Angeljudesuarez
  • Vehicle Management System
Published: December 19, 2024

CVE-2024-12790

3.5
    code-projects Hostel Management Site
Published: December 19, 2024

CVE-2024-52589

2.2
    Discourse
Published: December 19, 2024

CVE-2024-11616

None
    Netskope Endpoint DLP
Published: December 19, 2024

CVE-2024-9101

None
    phpLDAPadmin
Published: December 19, 2024

CVE-2024-9102

None
    phpLDAPadmin
Published: December 19, 2024

CVE-2024-12798

None
    logback-core
Published: December 19, 2024

CVE-2024-38864

None
    Checkmk
Published: December 19, 2024

CVE-2024-9154

None
    HMS Networks Ewon Flexy 205
Published: December 19, 2024

CVE-2021-22501

None
    OpenText Operations Bridge Manager
Published: December 19, 2024

CVE-2024-12801

None
    SaxEventRecorder by QOS.CH logback
Published: December 19, 2024

CVE-2024-56159

None
    Astro
Published: December 19, 2024

CVE-2024-11157

None
    Rockwell Automation Arena
Published: December 19, 2024

CVE-2024-11364

None
    Rockwell Automation Arena
Published: December 19, 2024

CVE-2024-12672

None
    Rockwell Automation Arena
Published: December 19, 2024

CVE-2024-54982

None
    Quectel BC25
Published: December 19, 2024
Click here to see more Vulnerabilities