Cookie Settings

This website uses cookies and similar technologies to provide essential functionality and improve your experience. Some features, such as demo scheduling and chat support, require marketing cookies to function. By clicking "Accept All", you consent to all cookies. Alternatively, you can customize your preferences, but note that declining marketing cookies will limit certain website features.

Cyware Announces Healthcare TIP

•

Check it Out

Skip to main content

Cyware Daily Threat Intelligence

Cyware Daily Threat Intelligence - Featured Image

Daily Threat Briefing • Oct 11, 2023

In an unprecedented incident, an internet-wide zero-day bug in HTTP/2 has fueled the largest-ever DDoS attacks. The attack, dubbed Rapid Reset, exploited a bug in the HTTP/2 protocol that is used in about 60% of all web applications. It marks a new chapter in the evolution of DDoS threats. Meanwhile, Microsoft patched a couple of actively exploited zero-day vulnerabilities in Skype for Business and WordPad applications. While the Skype bug could be abused to view sensitive information in a way that exposes internal network details, the other bug could lead to information disclosure, such as NTLM hashes.

A fresh attack event has occurred in the semiconductor supplier space wherein threat actors leveraged a critical vulnerability to deploy Mythic’s Athena Agent, granting them full control over compromised systems. Experts noted traction for the exploit within the dark web community soon after the incident.

Top Breaches Reported in the Last 24 Hours

PLAY ransomware group claims 7 new victims

The PLAY ransomware group has claimed seven new victims: Hughes Gill Cochrane Tinetti, Saltire Energy, Centek Industries, NachtExpress Austria, WCM Europe, Starr Finley, and an unknown entity. These organizations, located in various parts of the world, appear to have no apparent connection, highlighting the indiscriminate nature of the attacks. PLAY ransomware is known for employing a dual-extortion approach, first extracting victim network data before encrypting it.

Manufacturing tech provider hit by cyberattack

Volex, one of the world's largest manufacturing technology providers for data and power transmission cables, suffered a cyberattack that impacted its IT systems across multiple international sites. Volex promptly initiated its IT security protocols and engaged third-party experts to investigate and address the incident. The company assured that its sites remained operational, with minimal disruption to production.

Top Malware Reported in the Last 24 Hours

Athena Agent dropped on semiconductor firm

Researchers from Cyble uncovered a targeted spear-phishing attack on a prominent Russian semiconductor supplier. The malicious payload used was Athena Agent of the Mythic C2 framework, designed to grant complete control over compromised systems. The campaign used a deceptive email claiming to be from the Ministry of Industry and Trade of Russia and delivered the payload through an archive file exploiting a critical RCE vulnerability, CVE-2023-38831, in WinRAR.

Advisory against AvosLocker variant

The FBI and the CISA issued a joint advisory to disseminate known IOCs and TTPs related to the AvosLocker ransomware. AvosLocker operates under the RaaS model and has been used by cybercriminal affiliates to compromise organizations across multiple critical infrastructure sectors in the U.S. The advisory provides insights into how these attacks occur and highlights the need for vigilance and strong cybersecurity measures to protect against ransomware attacks. This advisory updates a previous one from March 2022 and includes new IOCs and TTPs.

Top Vulnerabilities Reported in the Last 24 Hours

Microsoft addresses 103 flaws, including two zero-days

Microsoft has released its October 2023 Patch Tuesday updates, addressing a total of 103 vulnerabilities in its software. Among these, 13 are rated critical, and 90 are rated important in severity. The update also included two zero-day vulnerabilities that have been actively exploited. The first one affected Microsoft WordPad and could lead to information disclosure, including the leak of NTLM hashes. The other zero-day pertains to Skype for Business and could allow attackers to gain access to internal networks.

Storm-0062 exploits Atlassian security issue

According to Microsoft, a recently disclosed critical privilege escalation vulnerability in Atlassian Confluence Data Center and Server is being actively exploited by a nation-state actor tracked as Storm-0062. The vulnerability, CVE-2023-22515, allows remote attackers to create unauthorized Confluence administrator accounts and access Confluence servers. Atlassian is aware of the exploitation and has released fixes in versions 8.3.3 or later, 8.4.3 or later, and 8.5.2 (Long Term Support release) or later.

Flawed HTTP/2 protocol leads to DDoS attacks

Threat actors have been exploiting a zero-day vulnerability in the HTTP/2 protocol since August to launch the largest DDoS attacks ever seen. Google, Cloudflare, and Amazon Web Services dubbed these as "Rapid Reset" attacks that were caused by the vulnerability tracked as CVE-2023-44487. Google noted that malicious actors were able to reach a peak of 398 million rps in their attacks, far surpassing the previous largest attack at 46 million rps. Patches are yet to be released, but a mitigation strategy recommended by OpenSSF involves closing TCP connections with high create/RST_FRAME ratios.

SAP fixes dozens of bugs

SAP released several security notes as part of its October 2023 Security Patch Day. The most severe note addressed 37 vulnerabilities, including two critical and 20 high-severity issues in the Chromium browser in SAP Business Client. One of the critical flaws was CVE-2023-4863, which has already been exploited and affects the libwebp image rendering library. The update also addressed CVE-2023-5217, another exploited vulnerability. A separate security note addressed a log injection flaw in NetWeaver (CVE-2023-31405), and customers need to implement both the initial patch and the update to be fully protected.

Adobe issues security updates for multiple products

Adobe has released security patches addressing 13 vulnerabilities in Adobe Commerce and Photoshop. In the case of Adobe Commerce, successful exploitation of the flaws could lead to arbitrary code execution, privilege escalation, arbitrary file system read, security feature bypass, and application denial-of-service. The affected versions include Adobe Commerce and Magento Open Source versions 2.4.7-beta1 and earlier. Additionally, Adobe Photoshop was found to have a critical-severity flaw (CVE-2023-26370) that could be exploited for code execution attacks on Windows and macOS systems. Adobe has not detected any active exploits for these vulnerabilities.

Google patches security holes in Chrome 118

Google has released Chrome version 118 to the stable channel, addressing 20 vulnerabilities. The most severe of these was CVE-2023-5218, a critical use-after-free bug in Site Isolation, a Chrome security component designed to prevent sites from stealing data from other sites. While Google did not disclose specific details, this type of vulnerability can lead to sandbox escape and arbitrary code execution. The release also includes fixes for eight medium-severity vulnerabilities and five low-severity issues.

Related Threat Briefings

Jan 16, 2025

Cyware Daily Threat Intelligence, January 16, 2025

Threat actors continue to exploit misconfigurations and vulnerabilities to spread malware and disrupt systems. A newly discovered MikroTik botnet of 13,000 devices abuses SPF DNS flaws to spoof 20,000 domains, bypassing email security and delivering malware via fake DHL-themed emails. At the same time, adversaries are embedding rogue code in image files to spread VIP Keylogger and 0bj3ctivity Stealer, leveraging phishing emails and Base64-encoded payloads to compromise systems. The CERT/CC warned of newly discovered vulnerabilities affecting over 660,000 Rsync servers. Among the six identified flaws, two—CVE-2024-12084 and CVE-2024-12085—allow remote code execution when combined. Cybercriminals are also weaponizing Google Search ads to steal Google Ads credentials. By directing users to phishing pages hosted on Google Sites, attackers can disguise their schemes under the guise of legitimate Google Ads pages.

Jan 15, 2025

Cyware Daily Threat Intelligence, January 15, 2025

A fresh wave of malware has overtaken over 5,000 WordPress sites, exploiting rogue admin accounts and malicious plugins to siphon sensitive data. With data being funneled to the wp3[.]xyz domain, researchers urge website owners to bolster defenses by blocking this domain. Microsoft’s January 2025 Patch Tuesday brings critical relief with fixes for 159 vulnerabilities, including eight zero-days, three actively exploited. Key patches target SYSTEM-level exploits in Hyper-V and resolve dangerous RCE flaws in Microsoft Access, underscoring the need for immediate updates to prevent potential threats. North Korea's economic tactics continue to evolve, as researchers connected the regime's fake IT worker operations to a crowdfunding scam under the alias Nickle Tapestry. The scam lured victims via IndieGoGo, collecting $20,000 under false promises of innovative wireless memory devices.

Jan 14, 2025

Cyware Daily Threat Intelligence, January 14, 2025

Government officials in Central Asia have been ensnared by APT28’s latest cyberespionage campaign, where leaked Kazakhstan government documents serve as the perfect trap. With tools like HATVIBE and CHERRYSPY, the Russian-linked group casts a wide net to maintain geopolitical sway across key regions. Codefinger, a new ransomware group has introduced a chilling new tactic to the ransomware scene, locking AWS S3 buckets with server-side encryption and customer-provided keys. By exploiting compromised AWS keys, the group targets native AWS software developers, encrypting critical data and threatening deletion within seven days. Imagine logging in with Google, only to find your old startup’s downfall has exposed your data. That’s the reality for millions of former employees, as Google’s Sign in with Google flaw allows new domain owners to access sensitive accounts, leaving users and startups alike vulnerable.

Jan 13, 2025

Cyware Daily Threat Intelligence, January 13, 2025

A newly identified ransomware group, FunkSec, has emerged as a low-cost yet prolific threat, targeting over 80 victims across multiple countries within a month. The group’s tactics include demanding modest ransoms and offering tools for DDoS attacks. FunkSec’s latest ransomware version, FunkSec V1, shows signs of AI-assisted development, adding a layer of sophistication to its operations. A critical vulnerability has put Aviatrix Controller users at significant risk by allowing unauthenticated remote code execution. The flaw, caused by improper API input handling, exposes cloud enterprise environments to malicious activities. While Aviatrix has released patches, early exploitation suggests attackers have already begun leveraging the vulnerability for broader campaigns. Cybercriminals are exploiting Apple iMessage’s phishing protection by manipulating users into disabling link-blocking features. Smishing texts urge recipients to reply with Y to re-enable links, bypassing safeguards and exposing victims to malicious websites.

Jan 10, 2025

Cyware Daily Threat Intelligence, January 10, 2025

China-linked RedDelta has intensified its cyber-espionage activities across Asia, targeting government and political entities across multiple countries. The group used sophisticated spear-phishing tactics to deliver a modified PlugX backdoor. Notable breaches include the Mongolian Ministry of Defense and the Communist Party of Vietnam, underscoring RedDelta’s evolving methods and broad geographical reach. In a deceptive twist, threat actors have created a fake PoC exploit tied to a patched Microsoft Windows LDAP vulnerability to lure security researchers. The malicious PoC, hosted on a repository, drops a PowerShell script upon execution, stealing computer information and sending it to an external FTP server. CrowdStrike uncovered a phishing scheme where attackers impersonated the company, offering fake job opportunities to lure victims. Targets were directed to download a fraudulent CRM application, which bypassed sandbox checks to install a Monero miner. The malware operated stealthily in the background, ensuring persistence through startup scripts and registry entries.

Jan 9, 2025

Cyware Daily Threat Intelligence, January 09, 2025

Malicious actors continue to exploit trusted ecosystems, with researchers uncovering npm packages stealing Solana private keys and exfiltrating them via Gmail. Masquerading as legitimate tools, these packages drain victims' wallets while amplifying their reach through GitHub repositories. Threat actors are actively exploiting a critical flaw in GFI KerioControl firewalls, to achieve remote code execution. Despite a patch released by GFI, attempts to abuse the vulnerability have surged, targeting over 23,800 exposed instances worldwide. Meanwhile, the Fancy Product Designer plugin for WordPress remains vulnerable to critical flaws, including file upload and SQL injection vulnerabilities. With no response from the developer, over 20,000 sites face heightened risk from these exploits.

Jan 8, 2025

Cyware Daily Threat Intelligence, January 08, 2025

The Gayfemboy botnet has emerged as a powerful tool in the Mirai-based arsenal, evolving with zero-day exploits targeting industrial routers and smart home devices. With around 15,000 active bot nodes daily, it uses vulnerabilities in industrial routers to launch high-intensity DDoS attacks exceeding 100 Gbps. A cunning social engineering campaign in the Middle East sees fraudsters posing as government officials to exploit customer trust. Victims are lured into installing remote access software under the guise of resolving purchase complaints. Using tools like RedLine Stealer, the attackers steal credit card details and intercept OTPs. CISA’s KEV catalog now includes critical flaws in Mitel MiCollab and Oracle WebLogic Server, highlighting active exploitation. The vulnerabilities like allow unauthorized access and remote code execution, urging federal agencies to update systems by January 28 to mitigate risks effectively.

Jan 7, 2025

Cyware Daily Threat Intelligence, January 07, 2025

PhishWP, a rogue WordPress plugin, is redefining payment fraud with its ability to mimic trusted platforms. By harvesting card details, one-time passwords, and more in real time, this plugin enables sophisticated phishing attacks. Its arsenal includes browser profiling, obfuscation, and fake confirmation emails, delaying detection while users unknowingly fall victim. Android’s January Security Bulletin underscores the urgency of patching critical vulnerabilities in devices running Android 12 to 15. With flaws enabling remote code execution without permissions, Google’s update addresses risks in System, Framework, and hardware components. Hardware giants MediaTek, HPE, and Dell have issued patches for severe vulnerabilities in their products. MediaTek patched a critical modem flaw, Dell resolved privilege escalation vulnerabilities, and HPE addressed issues in SAN switches.

Jan 6, 2025

Cyware Daily Threat Intelligence, January 06, 2025

Discord users are being lured by fake offers to beta test new video games, only to end up downloading malware. Scammers send direct messages posing as game developers, providing a password-protected installer link that spreads multiple info-stealers. The scam leverages installers like NSIS and MSI, making it harder to identify malicious intent until it's too late. Deep learning models face a new threat with BARWM, a backdoor attack method utilizing DNN-based steganography. This advanced technique embeds imperceptible triggers into inputs, bypassing detection while maintaining high attack success rates. Sophos has patched three critical vulnerabilities in its firewall, addressing risks like SQL injection, weak credential management, and code injection. While no active exploitation has been reported, users are strongly urged to upgrade to version 21.0 GA or later.

Jan 3, 2025

Cyware Daily Threat Intelligence, January 03, 2025

Open-source ecosystems once again face scrutiny as a supply chain attack compromises the Nomic Foundation and Hardhat through malicious npm packages. With 20 rogue packages, attackers leverage Ethereum smart contracts to evade takedown, posing risks to development environments and financial security. Disguised as a 'Telegram Premium' app, the newly uncovered Android malware FireScam blends info-stealing and spyware capabilities. Delivered through a fake website, it requests excessive permissions, intercepts sensitive data, and communicates with C2 servers to execute additional malicious payloads, escalating the threat to Android users. macOS users are urged to update iTerm2 after a critical flaw was discovered in its SSH integration feature. Affecting versions 3.5.6 through 3.5.10, the vulnerability exposed sensitive user data by logging it on remote hosts.

Jan 2, 2025

Cyware Daily Threat Intelligence, January 02, 2025

Malware targeting firmware is crossing alarming new thresholds. Security researchers unveiled a UEFI bootkit proof-of-concept capable of compromising the Windows kernel during the boot process. Operating beneath traditional antivirus protections, this bootkit showcases the dangers of persistent threats that survive reboots. Secure boot configurations and firmware updates are vital defenses against such sophisticated exploits. LegionLoader, a malware that has evolved since its 2019 debut, is proving to be a formidable threat. Known also as Satacom and CurlyGate, it deploys malicious tools like Chrome extensions, spreads via drive-by downloads, and uses encryption to evade detection. Its primary targets include financial accounts and sensitive user data. A new vulnerability called DoubleClickjacking has emerged, introducing a clever twist to traditional clickjacking attacks. Exploiting the timing between double clicks, this technique bypasses security measures like X-Frame-Options.

Dec 23, 2024

Cyware Daily Threat Intelligence, December 23, 2024

Compromised npm packages are yet another reminder of the fragility of supply chains in the digital age. Threat actors inserted cryptomining malware into popular packages, impacting hundreds of thousands of users before developers patched and re-released them. The malicious code executed via npm's postinstall script, emphasizing the need for vigilance and prompt updates in package management. IBM’s Cognos Analytics platform has been diagnosed with critical vulnerabilities that could undermine system security and expose sensitive data. Flaws like CVE-2024-51466, an Expression Language Injection vulnerability, and CVE-2024-40695, tied to poor file validation, affect several versions of the platform. IBM recommends urgent upgrades to patched versions to safeguard enterprise systems. In the murky world of Phishing-as-a-Service (PhaaS), FlowerStorm has emerged as a dangerous new player, potentially taking over from the now-defunct Rockstar2FA. With majority of its attacks focused on U.S. users, the platform is setting its sights on key sectors, raising fresh alarms for cybersecurity defenders.