ValleyRAT’s multi-stage malware is silently invading Windows machines, targeting Chinese speakers with sophisticated control techniques. The malware’s components, including RemoteShellCode and RuntimeBroker, enable extensive surveillance and command execution.

SolarWinds patched a critical vulnerability in Web Help Desk, addressing a severe remote code execution flaw. The update fixes a Java deserialization issue with a CVSS score of 9.8, requiring immediate installation to prevent exploitation.

Malicious ads disguised as Google products are spreading malware and phishing scams, locking browsers and redirecting victims to fake pages. The attackers use stolen accounts and rotating URLs to execute their schemes.

Top Malware Reported in the Last 24 Hours

Ransomware actors use new EDR killer

Sophos analysts discovered a new tool called EDRKillShifter being used by cybercriminals in an attempted ransomware attack. This tool is designed to disable endpoint protection software and is delivered through a multi-step process. It is used to deploy various EDR killer variants which exploit vulnerable drivers to disable endpoint security. The attackers may have acquired the loader tool from the dark net, and the final payloads are developed separately.

ValleyRAT campaign targets Chinese speakers

FortiGuard Labs discovered an ongoing ValleyRAT campaign targeting Chinese speakers. ValleyRAT is a multi-stage malware that uses various techniques to monitor and control victims' machines. The campaign involves several components, including RemoteShellCode, RuntimeBroker, Payload Downloader, and ValleyRAT. The malware loads these components and executes them to achieve its malicious intent. ValleyRAT, furthermore, is capable of graphically monitoring user activities, delivering arbitrary plugins, and executing arbitrary commands, posing a serious threat to Windows users.

New Gafgyt variant enters the scene

Researchers at Aqua Nautilus have identified a new variant of the Gafgyt botnet that targets machines with weak SSH passwords to expand the botnet network and mine cryptocurrency using GPU power. The attack flow begins with a successful brute force attempt on an SSH server with a weak password. The attacking server, part of the botnet, executes shell commands via the SSH connection and transfers the main payloads for crypto mining. The infected device scans the internet for other vulnerable machines to launch similar attacks.

Top Vulnerabilities Reported in the Last 24 Hours

SolarWinds releases HotFix

SolarWinds released a hotfix for a critical vulnerability in Web Help Desk, which could be exploited remotely to execute arbitrary code. The vulnerability is a Java deserialization remote code execution issue (CVE-2024-28986) with a CVSS score of 9.8. Although it requires authentication for exploitation, SolarWinds recommends that all customers upgrade to Web Help Desk 12.8.3 and install the hotfix as soon as possible. The hotfix adds a JAR file, modifies two other files, and requires manual modification of a file in the product’s config directory.

Vulnerable app in Pixel devices

Google's own Pixel devices shipped with a dormant app called Showcase.apk, exposing them to potential attacks and malware. The software, developed by Smith Micro for Verizon, has excessive system privileges and downloads a configuration file over unsecure HTTP, making the device vulnerable to potential attacks. While Google claims it's not a platform or Pixel vulnerability and the app is no longer being used, they plan to remove it from supported devices. However, the app's presence on the devices requires physical access and user password for exploitation.

Top Scams Reported in the Last 24 Hours

**Scammers target Google products **

Criminals have been using malicious ads related to Google products to distribute malware and phishing scams. They impersonated Google's entire product line, used Looker Studio to lock browsers, and redirected victims to a fake Google home page. The fraudsters leveraged stolen or free accounts and Google's APIs to create rotating malicious URLs for the browser lock. The criminals also used tech support scam tactics to deceive victims.