SecuriTricks - vulnerability

SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea

BlackBerry's researchers have uncovered a new campaign by the nation-state threat actor SideWinder. The group employs sophisticated techniques, such as utilizing carefully crafted phishing emails with visual lures designed to target specific organizations. The campaign aims to compromise ports and …

espionage

phishing

Published: July 30, 2024

Linked vulnerabilities : CVE-2017-11882, CVE-2017-0199

Downloadable IOCs: 47

Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android

ESET researchers discovered a vulnerability named EvilVideo that allows attackers to share malicious Android payloads disguised as video files through Telegram for Android. The exploit makes the malicious files appear as multimedia content, tricking users into installing malware. The vulnerability …

Published: July 23, 2024

Downloadable IOCs: 1

CVE-2024-4577 Exploits in the Wild One Day After Disclosure

One of the most recent examples of this onslaught lies in a critical vulnerability discovered in PHP (versions 8.1.*, before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8). The vulnerability is caused by the way PHP and CGI handlers parse certain Unicode characters, which can enable an attack…

Published: July 11, 2024

Downloadable IOCs: 17

Increase In The Exploitation Of Microsoft SmartScreen Vulnerability CVE-2024-21412

Cyble analyzes an ongoing campaign exploiting a Microsoft SmartScreen vulnerability to deliver stealers through spam emails. The campaign employs lures related to healthcare, transportation, and tax notices to trick users into downloading malicious payloads. It utilizes techniques like DLL sideload…

Published: July 11, 2024

Downloadable IOCs: 12

Ransomware: Activity Levels Remain High Despite Disruption

While overall activity levels dipped slightly in the first quarter of 2024, the number of claimed attacks remained high, with LockBit accounting for over 20%. The report explores the changing tactics employed by ransomware actors, including the exploitation of vulnerabilities, the use of Bring-Your…

Published: July 11, 2024

Linked vulnerabilities : CVE-2024-4577 (CVSS 9.8)

Downloadable IOCs: 27

Attack Case against HFS (HTTP File Server) Server (Suspected CVE-2024-23692)

A remote code execution vulnerability (CVE-2024-23692) in the HFS (HTTP File Server) program has allowed attackers to execute malicious commands on vulnerable systems. Various attack cases exploiting this vulnerability have been observed, leading to the installation of malware such as coin miners, …

Published: July 3, 2024

Linked vulnerabilities : CVE-2024-23692 (CVSS 9.8)

Downloadable IOCs: 14

Exploiting CVE-2021-40444 to Infiltrate Systems

A recently detected attack exploited a vulnerability in Microsoft Office to deploy spyware called MerkSpy. The initial vector was a deceptive Word document posing as a job description. Opening it triggered the exploitation of CVE-2021-40444, allowing arbitrary code execution. This downloaded an HTM…

Published: July 2, 2024

Linked vulnerabilities : CVE-2021-40444

Downloadable IOCs: 6

Malware Targets Message Queuing Services Applications

The report describes a recent campaign targeting Apache RocketMQ platforms, where attackers exploited a known vulnerability (CVE-2023-33246) to gain remote code execution on the systems. They then downloaded and executed the Muhstik malware, which provides persistence, evades detection, performs la…

Published: June 6, 2024

Linked vulnerabilities : CVE-2023-33246

Downloadable IOCs: 21

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin

A recent surge of malicious JavaScript code has been observed targeting websites using vulnerable versions of the LiteSpeed Cache plugin for WordPress. The malware injects code into critical WordPress files or the database, creating unauthorized admin users like 'wpsupp-user.' It exploits the vulne…

Published: May 9, 2024

Downloadable IOCs: 6

Tag: vulnerability

Attack reports

Web Scanning SonicWall for CVE-2021-20016 - Update

Post-Exploitation Activities Observed from the Samsung MagicINFO 9 Server Flaw

Apache Tomcat: CVE-2025-24813: Active Exploitation

CVE-2025-29927: Next.js Middleware Authorization Bypass Flaw

Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns

Mirai Bot now incorporating (malformed?) DrayTek Vigor Router Exploits

Further insights into Ivanti CSA 4.6 vulnerabilities exploitation

NGC4020 Attacks: DameWare Mini Remote Control Vulnerability

Zyxel vulnerability exploited by 'Helldown' ransomware group

Botnets Never Die: An Analysis of the Large Scale Botnet AIRASHI

Threat actors attempt to exploit a flaw in Four-Faith routers

Cleo Software Actively Being Exploited in the Wild

Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575)

FortiManager fgfmd vulnerability indicators

New macOS vulnerability, "HM Surf", could lead to unauthorized data access

Unmasking CVE-2024-38178: The Silent Threat of Windows Scripting Engine

Analysis of two arbitrary code execution vulnerabilities affecting WPS Office

Major Payment Disruption: Ransomware Strikes Indian Banking Infrastructure

Increased Activity Against Apache OFBiz CVE-2024-32113

SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea

Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android

CVE-2024-4577 Exploits in the Wild One Day After Disclosure

Increase In The Exploitation Of Microsoft SmartScreen Vulnerability CVE-2024-21412

Ransomware: Activity Levels Remain High Despite Disruption

Attack Case against HFS (HTTP File Server) Server (Suspected CVE-2024-23692)

Exploiting CVE-2021-40444 to Infiltrate Systems

Malware Targets Message Queuing Services Applications

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin