Tag: 2024-12-20

8 Attack Reports | 86 Vulnerabilities

Attack reports

Christmas "Gift" Delivered Through SSH

A malicious file named "christmas_slab.pdf.lnk" was discovered, utilizing Windows' built-in SSH support to deliver malware. The LNK file executes ssh.exe to transfer and run a PE file from a remote server. The attack leverages the SSH/SCP protocol, taking advantage of its widespread availability on…
lnk file
ssh
2024-12-20
Published: December 20, 2024
Downloadable IOCs: 1

BellaCPP: Discovering a new BellaCiao variant written in C++

A new C++ variant of the BellaCiao malware, dubbed BellaCPP, has been discovered by researchers. This variant shares similarities with the original .NET-based BellaCiao, including domain generation and SSH tunneling capabilities. BellaCPP was found on a machine also infected with a .NET BellaCiao s…
c++
charming kitten
2024-12-20
bellaciao
bellacpp
Published: December 20, 2024
Downloadable IOCs: 2

Now You See Me, Now You Don't: Using LLMs to Obfuscate Malicious JavaScript

This article discusses an adversarial machine learning algorithm that uses large language models (LLMs) to generate novel variants of malicious JavaScript code at scale. The algorithm iteratively transforms malicious code to evade detection while maintaining its functionality. The process involves …
2024-12-20
wormgpt
fraudgpt
Published: December 20, 2024
Downloadable IOCs: 5

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

Two npm packages, @rspack/core and @rspack/cli, were compromised in a supply chain attack, allowing the publication of malicious versions containing cryptocurrency mining malware. The attack targeted specific countries and aimed to execute XMRig cryptocurrency miner on Linux hosts. The malicious ve…
linux
xmrig
npm
crypto mining
2024-12-20
rspack
Published: December 20, 2024
Downloadable IOCs: 1

Recent Cases of Watering Hole Attacks, Part 1

This analysis focuses on a watering hole attack targeting a Japanese university research laboratory website in 2023. The attack used social engineering to trick users into downloading and executing malware disguised as an Adobe Flash Player update. The malware, identified as a modified Cobalt Strik…
social engineering
cobalt strike
cobalt strike beacon
anti-analysis
cloudflare workers
watering hole
japan
2024-12-20
tips.exe
malware injection
system32.dll
flashupdateinstall.exe
university
Published: December 20, 2024
Linked vulnerabilities : CVE-2022-1388
Downloadable IOCs: 10

Cyberattack: UAC-0125 using the theme "Army+" (CERT-UA#12559)

A cyber attack attributed to UAC-0125 has been identified, involving websites mimicking the official 'Army+' app page. These sites, hosted on Cloudflare Workers, prompt users to download a malicious executable. The EXE file, an NSIS installer, contains a decoy .NET file, Python interpreter, Tor fil…
sandworm
openssh
cloudflare workers
nsis
tor
2024-12-20
apt44
uac-0125
army+
Published: December 20, 2024
Downloadable IOCs: 6

cShell DDoS Bot Attack Case Targeting Linux SSH Server (screen and hping3)

A new DDoS malware strain named cShell is targeting poorly managed Linux servers through SSH services. The threat actor uses brute force attacks to gain initial access, then installs the cShell bot developed in Go language. cShell exploits Linux tools 'screen' and 'hping3' to perform various DDoS a…
linux
ddos
botnet
ssh
brute-force
2024-12-20
carm
hping3
go-language
cshell
screen
Published: December 20, 2024
Downloadable IOCs: 1

Araneida Scanner: Cracked Acunetix Web App & API Scanner Discovered

Silent Push Threat Analysts have uncovered the Araneida Scanner, a cracked version of Acunetix being used for illegal purposes. The scanner is employed for offensive reconnaissance, user data scraping, and vulnerability exploitation. It was detected during a partner's reconnaissance effort, prompti…
credential theft
reconnaissance
telegram
2024-12-20
araneida scanner
web vulnerability
data scraping
cracked acunetix
Published: December 20, 2024
Downloadable IOCs: 13
Click here to see more Attack Reports

Vulnerabilities

CVE-2022-32203

9.8
    Huawei
  • Cv81-Wdm Firmware
  • Cv81-Wdm
Published: December 20, 2024

CVE-2024-12571

9.8
    LotsOfLocales Store Locator for WordPress with Google Maps Plugin
Published: December 20, 2024

CVE-2024-56337

9.8
    Apache Tomcat
Published: December 20, 2024

CVE-2024-55509

9.8
    CodeAstro Complaint Management System
Published: December 20, 2024

CVE-2024-51466

9.0
    IBM Cognos Analytics
Published: December 20, 2024

CVE-2024-12829

8.8
    Arista
  • Ng Firewall
Published: December 20, 2024

CVE-2024-37758

8.8
    Digiteam
Published: December 20, 2024

CVE-2022-32144

8.6
    Huawei
Published: December 20, 2024

CVE-2024-56357

8.1
    grist-core
Published: December 20, 2024

CVE-2024-56358

8.1
    grist-core
Published: December 20, 2024

CVE-2024-56359

8.1
    grist-core
Published: December 20, 2024

CVE-2024-40695

8.0
    IBM Cognos Analytics
Published: December 20, 2024

CVE-2024-12831

7.8
    Arista
  • Ng Firewall
Published: December 20, 2024

CVE-2023-42867

7.8
    Apple
  • Garageband
Published: December 20, 2024

CVE-2024-12677

7.8
    UNKNOWN
Published: December 20, 2024

CVE-2024-56334

7.8
    systeminformation
Published: December 20, 2024

CVE-2020-13712

7.8
    oMG2000 running MGOS
    MG90 running MGOS
Published: December 20, 2024

CVE-2024-56335

7.6
    vaultwarden
Published: December 20, 2024

CVE-2024-54538

7.5
    Apple
  • Ipados
  • Iphone Os
  • Macos
  • Tvos
  • Visionos
  • Watchos
Published: December 20, 2024

CVE-2022-32204

7.5
    Huawei
  • Cv81-Wdm Firmware
  • Cv81-Wdm
Published: December 20, 2024

CVE-2022-34159

7.5
    Huawei
  • Cv81-Wdm Firmware
  • Cv81-Wdm
Published: December 20, 2024

CVE-2024-44195

7.5
    macOS Sequoia
Published: December 20, 2024

CVE-2024-21549

7.5
    spatie/browsershot
Published: December 20, 2024

CVE-2024-12014

7.5
    eSigna
Published: December 20, 2024

CVE-2024-55470

7.5
    Oqtane Framework
Published: December 20, 2024

CVE-2024-12830

7.3
    Arista
  • Ng Firewall
Published: December 20, 2024

CVE-2024-7726

6.8
    Kioxia PM6
    Kioxia PM7
    Kioxia CM6
Published: December 20, 2024

CVE-2024-28767

6.8
    IBM Security Directory Integrator
Published: December 20, 2024

CVE-2024-56331

6.8
    Uptime Kuma
Published: December 20, 2024

CVE-2024-12678

6.5
    Nomad Community Edition
    Nomad Enterprise
Published: December 20, 2024

CVE-2024-55471

6.5
    Oqtane Framework
Published: December 20, 2024

CVE-2024-11776

6.4
    PCRecruiter Extensions plugin for WordPress
Published: December 20, 2024

CVE-2024-11411

6.4
    Spotlightr plugin for WordPress
Published: December 20, 2024

CVE-2024-11774

6.4
    Outdooractive Embed plugin for WordPress
Published: December 20, 2024

CVE-2024-11775

6.4
    Particle Background plugin for WordPress
Published: December 20, 2024

CVE-2024-11783

6.4
    Financial Calculator plugin for WordPress
Published: December 20, 2024

CVE-2024-11784

6.4
    Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin
Published: December 20, 2024

CVE-2024-11878

6.4
    Category Post Slider plugin for WordPress
Published: December 20, 2024

CVE-2024-11893

6.4
    Spoki - Chat Buttons and WooCommerce Notifications plugin for WordPress
Published: December 20, 2024

CVE-2024-12506

6.4
    NACC WordPress Plugin
Published: December 20, 2024

CVE-2024-12509

6.4
    Embed Twine plugin for WordPress
Published: December 20, 2024

CVE-2024-9619

6.4
    WP SHAPES plugin for WordPress
Published: December 20, 2024

CVE-2024-12832

6.3
    Arista
  • Ng Firewall
Published: December 20, 2024

CVE-2024-56351

6.3
    Jetbrains
  • Teamcity
Published: December 20, 2024

CVE-2024-11331

6.1
    WordPress WooCommerce Products Extract for IceCat
Published: December 20, 2024

CVE-2024-11806

6.1
    PKT1 Centro de envios plugin for WordPress
Published: December 20, 2024

CVE-2024-11812

6.1
    Wtyczka SeoPilot dla WP plugin for WordPress
Published: December 20, 2024

CVE-2021-40959

6.1
    MONITORAPP Application Insight Web Application Firewall (AIWAF)
Published: December 20, 2024

CVE-2024-11811

6.1
    Feedify - Web Push Notifications plugin for WordPress
Published: December 20, 2024

CVE-2024-56356

5.9
    Jetbrains
  • Teamcity
Published: December 20, 2024

CVE-2024-44211

5.5
    Apple
  • Macos
Published: December 20, 2024

CVE-2024-44292

5.5
    Apple
  • Macos
Published: December 20, 2024

CVE-2024-44293

5.5
    Apple
  • Macos
Published: December 20, 2024

CVE-2024-56353

5.5
    Jetbrains
  • Teamcity
Published: December 20, 2024

CVE-2024-56354

5.5
    Jetbrains
  • Teamcity
Published: December 20, 2024

CVE-2024-11108

5.4
    Serious Slider WordPress plugin
Published: December 20, 2024

CVE-2024-5955

5.4
    Trellix ePolicy Orchestrator
Published: December 20, 2024

CVE-2024-11297

5.3
    Page Restriction WordPress (WP) – Protect WP Pages/Post plugin
Published: December 20, 2024

CVE-2024-56349

5.3
    Jetbrains
  • Teamcity
Published: December 20, 2024

CVE-2024-12840

5.0
    Satellite
Published: December 20, 2024

CVE-2024-10555

4.8
    WordPress Button Plugin MaxButtons
Published: December 20, 2024

CVE-2024-10706

4.8
    Download Manager WordPress plugin
Published: December 20, 2024

CVE-2024-8968

4.7
    WordPress Button Plugin MaxButtons WordPress plugin
Published: December 20, 2024

CVE-2024-55342

4.7
    Piranha CMS
Published: December 20, 2024

CVE-2024-55341

4.7
    Piranha CMS
Published: December 20, 2024

CVE-2024-44223

4.6
    Apple
  • Macos
Published: December 20, 2024

CVE-2024-44231

4.6
    Apple
  • Macos
Published: December 20, 2024

CVE-2024-56352

4.6
    Jetbrains
  • Teamcity
Published: December 20, 2024

CVE-2024-56355

4.6
    Jetbrains
  • Teamcity
Published: December 20, 2024

CVE-2024-9503

4.3
    Maintenance & Coming Soon Redirect Animation plugin for WordPress
Published: December 20, 2024

CVE-2024-56348

4.3
    Jetbrains
  • Teamcity
Published: December 20, 2024

CVE-2024-56350

4.3
    Jetbrains
  • Teamcity
Published: December 20, 2024

CVE-2024-55186

4.3
    oqtane Framework
Published: December 20, 2024

CVE-2024-12841

4.3
    Emlog
  • Emlog
Published: December 20, 2024

CVE-2024-12842

4.3
    Emlog Pro
Published: December 20, 2024

CVE-2024-12843

4.3
    Emlog
  • Emlog
Published: December 20, 2024

CVE-2024-12844

4.3
    Emlog
  • Emlog
Published: December 20, 2024

CVE-2024-12845

3.5
    Emlog
  • Emlog
Published: December 20, 2024

CVE-2020-9250

3.3
    Huawei smart phone
Published: December 20, 2024

CVE-2024-44298

3.3
    Apple
  • Macos
Published: December 20, 2024

CVE-2024-10385

None
    DirectAdmin Evolution Skin
Published: December 20, 2024

CVE-2024-12867

None
    Arctic Security Arctic Hub
Published: December 20, 2024

CVE-2024-56329

None
    Laravel Jetstream Socialstream Package
Published: December 20, 2024

CVE-2024-56330

None
    Stardust
Published: December 20, 2024

CVE-2024-56333

None
    Onyxia-API
Published: December 20, 2024

CVE-2024-40875

None
    Absolute Secure Access
Published: December 20, 2024
Click here to see more Vulnerabilities