SecuriTricks - privilege-escalation

Case of Attacks Targeting MS-SQL Servers to Install Ammyy Admin

A series of attacks targeting poorly managed MS-SQL servers have been identified, involving the installation of Ammyy Admin, a remote control tool. The attackers exploit vulnerable servers, execute commands to gather system information, and use WGet to install additional malware. The installed malw…

privilege escalation

brute force

Published: April 22, 2025

Downloadable IOCs: 0

FOG Ransomware Spread by Cybercriminals Claiming Ties to DOGE

An investigation of nine malware samples revealed FOG ransomware being distributed by cybercriminals impersonating the Department of Government Efficiency (DOGE). The ransomware, spread via email and phishing attacks, is concealed in a ZIP file named 'Pay Adjustment.zip'. The infection chain involv…

Published: April 21, 2025

Downloadable IOCs: 6

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

A critical vulnerability (CVE-2025-30406) in Gladinet CentreStack and Triofox software has been discovered and is being actively exploited. The flaw involves hardcoded cryptographic keys in configuration files, allowing attackers to abuse ASPX ViewState for remote code execution. Affected versions …

cobalt strike

privilege escalation

remote code execution

Published: April 15, 2025

Linked vulnerabilities : CVE-2025-30406

Downloadable IOCs: 6

Exploitation of CLFS zero-day leads to ransomware activity

A zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS) has been exploited against targets in IT, real estate, finance, software, and retail sectors across multiple countries. The exploit, deployed by PipeMagic malware and attributed to Storm-2460, enables privilege…

Published: April 9, 2025

Linked vulnerabilities : CVE-2025-24983 (CVSS 7.0), CVE-2025-29814 (CVSS 9.3), CVE-2025-29824 (CVSS 7.8)

Downloadable IOCs: 0

Analysis of Lazarus Group's Attack Targeting Windows Web Servers

The Lazarus group has been targeting Windows web servers, particularly in South Korea, installing webshells and C2 scripts to use compromised servers as proxies. The attacks involve multiple stages, including the use of LazarLoader malware and privilege escalation tools. The C2 scripts act as proxi…

Published: March 11, 2025

Downloadable IOCs: 0

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

The Black Basta and Cactus ransomware groups have incorporated BackConnect malware into their attack strategies to maintain persistent control over compromised systems. The attackers use social engineering tactics, including email flooding and impersonation of IT support, to gain initial access. Th…

onedrive exploitation

Published: March 3, 2025

Downloadable IOCs: 0

November 18 Advisory: Active Exploitation of Critical RCE in Palo Alto Networks PAN-OS [CVE-2024-0012 and CVE-2024-9474]

Two critical vulnerabilities in Palo Alto Networks PAN-OS, CVE-2024-0012 and CVE-2024-9474, have been disclosed. CVE-2024-0012 is an authentication bypass allowing unauthenticated remote attackers to gain admin privileges, while CVE-2024-9474 is an authenticated privilege escalation bug. These can …

authentication bypass

pan-os

critical vulnerability

Published: November 18, 2024

Downloadable IOCs: 0

Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012

A critical authentication bypass vulnerability (CVE-2024-0012) in Palo Alto Networks PAN-OS software allows unauthenticated attackers to gain administrator privileges on affected devices. The issue affects PAN-OS versions 10.2, 11.0, 11.1, and 11.2, but not Cloud NGFW or Prisma Access. Limited expl…

authentication bypass

pan-os

Published: November 18, 2024

Downloadable IOCs: 0

G700: The Next Generation of Craxs RAT

G700 RAT, an advanced variant of Craxs RAT, targets Android devices and cryptocurrency applications. It employs sophisticated techniques like privilege escalation, phishing, and malicious APK distribution to infiltrate devices. The malware bypasses authentication, captures sensitive data, and manip…

transaction hijacking

sms interception

g700 rat

Published: November 4, 2024

Downloadable IOCs: 3

Chinese Hackers Toolkit Uncovered And Activity History Uncovered

A Chinese hacking group called 'You Dun' was discovered through an exposed open directory, revealing their comprehensive attack infrastructure. The group utilized sophisticated reconnaissance tools and exploited Zhiyuan OA software via SQL injection attacks, targeting South Korean pharmaceutical or…

Published: October 28, 2024

Linked vulnerabilities : CVE-2021-25003

Downloadable IOCs: 7

Understanding the Initial Stages of Web Shell and VPN Threats: An MXDR Analysis

This analysis examines two cybersecurity incidents: a web shell attack and a VPN compromise. The web shell attack involved uploading malicious files to a server, executing commands, creating a local admin account, and attempting to establish persistence. The VPN compromise led to lateral movement, …

Published: October 24, 2024

Linked vulnerabilities : CVE-2020-1472

Downloadable IOCs: 1

DarkComet RAT: Technical Analysis of Attack Chain

This analysis examines the Remote Access Trojan (RAT) DarkComet, detailing its capabilities, distribution methods, and technical operations. The malware alters file attributes, establishes communication with malicious domains, modifies process privileges, and gathers system information. It employs …

Published: October 23, 2024

Downloadable IOCs: 1

Attackers Target Exposed Docker Remote API Servers With perfctl Malware

An unknown threat actor is exploiting exposed Docker Remote API servers to deploy the perfctl malware. The attack sequence involves probing the server, creating a Docker container with specific settings, and executing a Base64 encoded payload. The payload escapes the container, creates a bash scrip…

container exploitation

Published: October 21, 2024

Downloadable IOCs: 6

Advanced Cyberattacks Against UAE and Gulf Regions

Earth Simnavaz, also known as APT34 and OilRig, has been actively targeting governmental entities in the UAE and Gulf region. The group employs sophisticated tactics, including a backdoor that exploits Microsoft Exchange servers for credential theft and the use of CVE-2024-30088 for privilege escal…

Published: October 14, 2024

Linked vulnerabilities : CVE-2024-30088 (CVSS 7.0)

Downloadable IOCs: 17

perfctl: A Stealthy Malware Targeting Millions of Linux Servers

A sophisticated Linux malware named 'perfctl' has been actively targeting millions of servers worldwide for the past 3-4 years. It exploits over 20,000 types of misconfigurations to compromise Linux systems. The malware employs advanced evasion techniques, including rootkits, process masquerading, …

Published: October 4, 2024

Linked vulnerabilities : CVE-2023-33246, CVE-2021-4034, CVE-2021-4043

Downloadable IOCs: 9

The Nanshou Campaign - Hackers' Arsenal Grows Stronger

This comprehensive analysis details a sophisticated cyber campaign targeting over 50,000 Windows servers worldwide, primarily in the healthcare, telecommunications, media, and IT sectors. The campaign exploited vulnerabilities in MS-SQL and phpMyAdmin, dropping advanced payloads like crypto-miners …

privilege escalation

vulnerability exploitation

Published: September 16, 2024

Linked vulnerabilities : CVE-2014-4113

Downloadable IOCs: 28

StopRansomware: RansomHub Ransomware

RansomHub is a ransomware-as-a-service variant that has targeted over 210 victims across various critical infrastructure sectors since February 2024. It employs a double-extortion model, encrypting systems and exfiltrating data. The ransom note provides victims with a client ID and instructions to …

ransomware-as-a-service

critical-infrastructure

CVE-2020-0787

lateral-movement

Published: August 30, 2024

Linked vulnerabilities : CVE-2020-1472, CVE-2023-46604, CVE-2023-22515, CVE-2020-0787, CVE-2017-0144, CVE-2023-3519, CVE-2023-27997, CVE-2023-48788, CVE-2023-46747

Downloadable IOCs: 14

Ransomware attackers introduce new EDR killer to their arsenal

An analysis by security researchers has uncovered the existence of a new tool called EDRKillShifter, which is used by threat actors to disable endpoint protection software during ransomware attacks. The tool is designed to terminate antivirus and endpoint detection and response (EDR) solutions on t…

Published: August 16, 2024

Downloadable IOCs: 2

Analysis of CoinMiner Attacks Targeting Web Servers

The report details two separate attack cases targeting a Korean medical institution's web server, resulting in the installation of CoinMiners. The targeted server was a Windows IIS server, likely with PACS software installed. In both attacks, web shells were uploaded, and system information was col…

Published: June 24, 2024

Linked vulnerabilities : CVE-2021-1732

Downloadable IOCs: 59

DISGOMOJI Malware Used to Target Indian Government

Volexity identified a cyber-espionage campaign by a suspected Pakistan-based threat actor tracked as UTA0137 targeting government entities in India. The campaign leveraged the DISGOMOJI malware, a Golang-based Linux trojan that uses Discord for command and control via emojis. Key capabilities inclu…

Published: June 18, 2024

Linked vulnerabilities : CVE-2024-3400, CVE-2022-0847

Downloadable IOCs: 149

Tag: privilege-escalation

Attack reports

Case of Attacks Targeting MS-SQL Servers to Install Ammyy Admin

FOG Ransomware Spread by Cybercriminals Claiming Ties to DOGE

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

Exploitation of CLFS zero-day leads to ransomware activity

Analysis of Lazarus Group's Attack Targeting Windows Web Servers

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

Analysis of an incident involving a web shell used as a backdoor

Threat Actors Use CVE-2019-18935 to Deliver Reverse Shells and JuicyPotatoNG

Investigating A Web Shell Intrusion With Managed XDR

Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603)

Brain Cipher Ransomware uses CVE-2023-28252

Declawing PUMAKIT

The Curious Case of an Excellent Resume

Gafgyt Malware Broadens Its Scope in Recent Attacks

Raspberry Robin Analysis

November 18 Advisory: Active Exploitation of Critical RCE in Palo Alto Networks PAN-OS [CVE-2024-0012 and CVE-2024-9474]

Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012

G700: The Next Generation of Craxs RAT

Chinese Hackers Toolkit Uncovered And Activity History Uncovered

Understanding the Initial Stages of Web Shell and VPN Threats: An MXDR Analysis

DarkComet RAT: Technical Analysis of Attack Chain

Attackers Target Exposed Docker Remote API Servers With perfctl Malware

Advanced Cyberattacks Against UAE and Gulf Regions

perfctl: A Stealthy Malware Targeting Millions of Linux Servers

The Nanshou Campaign - Hackers' Arsenal Grows Stronger

StopRansomware: RansomHub Ransomware

Ransomware attackers introduce new EDR killer to their arsenal

Analysis of CoinMiner Attacks Targeting Web Servers

DISGOMOJI Malware Used to Target Indian Government