Skip to main content
To Customer Support To Customer Support

Threat Intel Hub

Experts share their insights on protecting against cyber threats and staying ahead of evolving security risks.

35556 Topics
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
China-linked Salt Typhoon APT compromised more US telecoms than previously known

January 6, 2025 By Pierluigi Paganini China-linked Salt Typhoon group that breached multiple US telecoms compromised more firms than previously known, WSJ says.The China-linked cyberespionage group Salt Typhoon targeted more US telecoms than previously known, as The Wall Street Journal reported.According to WSJ, wich cited people familiar with the matter, the Chinese cyberspies also compromised Charter Communications and Windstream.The threat actors exploited vulnerabilities in network devices from security major vendor, including Cisco and Fortinet.Last week, a White House official confirmed that China-linked APT group Salt Typhoon has breached a ninth U.S. telecoms company as part of a cyberespionage campaign aimed at telco firms worldwide.“A White House official said Friday the US identified a ninth telecommunications company impacted by a wide-ranging Chinese espionage effort and that further steps are planned to curb cyberattacks from Beijing.” reported Bloomberg. >>Full Art

20
Jasper_The_Rasper
Moderator
5 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Eagerbee backdoor deployed against Middle Eastern govt orgs, ISPs

January 6, 2025 By Bill Toulas New variants of the Eagerbee malware framework are being deployed against government organizations and internet service providers (ISPs) in the Middle East.Previously, the malware was seen in attacks conducted by Chinese state-backed threat actors who Sophos tracked as 'Crimson Palace.'According to a new report by Kaspersky researchers, there's a potential connection to a threat group they call 'CoughingDown,' based on code similarities and IP address overlaps."Because of the consistent creation of services on the same day via the same webshell to execute the EAGERBEE backdoor and the CoughingDown Core Module, and the C2 domain overlap between the EAGERBEE backdoor and the CoughingDown Core Module, we assess with medium confidence that the EAGERBEE backdoor is related to the CoughingDown threat group" explains Kaspersky. >>Full Article<<

40
Jasper_The_Rasper
Moderator
5 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Code Execution Flaw Found in Nuclei Vulnerability Scanner

A vulnerability in Nuclei’s template signature verification system could have allowed attackers to execute arbitrary code. January 6, 2025 By Ionut Arghire A security defect in the Nuclei vulnerability scanner could have allowed threat actors to execute arbitrary code using custom code templates.Relying on simple YAML-based templates, Nuclei is a highly popular vulnerability scanner that can be used with a broad range of assets and which has more than 21,000 stars on GitHub and over 2.1 million downloads.Tracked as CVE-2024-43405 (CVSS score of 7.8) and affecting Nuclei versions between 3.0.0 and 3.3.1, the code execution issue was identified in the template signature verification process.“The vulnerability stems from a discrepancy between how the signature verification process and the YAML parser handle newline characters, combined with the way multiple signatures are processed. This allows an attacker to inject malicious content into a template while maintaining a valid signature for

50
Jasper_The_Rasper
Moderator
5 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Dental group lied through teeth about data breach, fined $350,000

 January 6, 2025 By Pieter Arntz A US chain of dental offices known as Westend Dental LLC denied a 2020 ransomware attack and its associated data breach, instead telling their customers that data was lost due to an “accidentally formatted hard drive.”Unfortunately for the organization, the truth was found out. Westend Dental agreed to settle several violations of the Health Insurance Portability and Accountability Act (HIPAA) in a penalty of $350,000.In October 2020, Westend Dental was attacked by the Medusa Locker ransomware group. Medusa Locker is a type of ransomware that operates under a Ransomware-as-a-Service (RaaS) model, primarily targeting large enterprises in sectors such as healthcare and education. This ransomware is known for employing double extortion tactics, which means they encrypt victims’ data while also threatening to release sensitive information unless a ransom is paid. >>Full Article<<

20
Jasper_The_Rasper
Moderator
5 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
PLAYFULGHOST backdoor supports multiple information stealing features

January 6, 2025 By Pierluigi Paganini PLAYFULGHOST is a new malware family with capabilities including keylogging, screen and audio capture, remote shell access, and file transfer/execution.Google researchers analyzed a new malware family called PLAYFULGHOST that supports multiple features, including keylogging, screen and audio capture, remote shell, and file transfer/execution.The PLAYFULGHOST backdoor shares functionality with Gh0st RAT whose source code was publicly released in 2008.The backdoor is distributed through:Phishing emails with themes such as “code of conduct” to trick users into downloading the malware. Bundling the malicious code with popular applications, like LetsVPN, and distributed it through SEO poisoning. Mandiant researchers observed the following additional malware families and utilities accompanied with PLAYFULGHOST:Malware / Utility Description Use Case BOOSTWAVE BOOSTWAVE is a shellcode that acts as in-memory dropper for an appended Portable Executabl

20
Jasper_The_Rasper
Moderator
6 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
published in Vulnerability Vault
Vulnerable Moxa devices expose industrial networks to attacks

January 6, 2025 By Bill Toulas Industrial networking and communications provider Moxa is warning of a high-severity and a critical vulnerability that impact various models of its cellular routers, secure routers, and network security appliances.The two seurity issues allow remote attackers to get root privileges on vulnerable devices and to execute arbitrary commands, which could lead to arbitrary code execution.Risks on Moxa routersMoxa devices are used in environments with industrial automation and control systems from transportation, utilities and energy, and telecommunications sectors.On Friday, the vendor issued an urgent warning for the following two vulnerabilities:CVE-2024-9138 (8.6, high severity score): Hard-coded credentials that enable authenticated users to escalate privileges to rootCVE-2024-9140 (9.3, critical severity score): OS command injection flaw caused by exploiting improper input restrictions, leading to arbitrary code executionThe second flaw is particularly dan

70
Jasper_The_Rasper
Moderator
6 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Apple security updates and Rapid Security Responses 6th January 2025

Apple security updates and Rapid Security Responses 6th January 2025  Name and information link Available for Release date iOS 18.2.1 and iPadOS 18.2.1 This update has no published CVE entries. iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later 06 Jan 2025  https://support.apple.com/en-us/100100

40
Jasper_The_Rasper
Moderator
6 hours ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Vulnerability Summary for the Week of December 30, 2024 Released Jan 06, 2025

Document IDSB25-006 The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores.Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is comp

80
TripleHelix
Moderator
10 hours ago
C
Administrator
ConnorMThreat Research Analyst
published in Ransomware Spotlight
Cyber News Rundown: Black Basta ransomware claims breach of Ascension Healthcare

Recently, the threat actors behind the Black Basta ransomware group claimed responsibility for the data breach of Ascension healthcare, which exposed sensitive records for over 5.6 million individuals, including patients and employees. The initial attack occurred back in May, when an employee fell victim to a phishing attack and downloaded a malicious file on the internal Ascension network.Clop ransomware adds 66 victim companies to their leak siteFollowing the breach of the Cleo data transfer program, the Clop ransomware group has added 66 victim companies to their dark web leak site, with a 48-hour deadline to respond for negotiations before being fully outed. The breach of Cleo allowed the threat actors to gain network access to the victim companies and compromise a significant amount of data from each one. This is the second major data-transfer attack performed by the Clop ransomware group and is still unclear if it surpasses the magnitude of the MOVEit vulnerability attack from 20

243
ProTruckDriver
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
New York Hospital Says Ransomware Attack Data Breach Impacts 670,000

Richmond University Medical Center has been investigating a ransomware attack since May 2023 and it recently determined that it affects 670,000 people.  January 3, 2025 By Eduard Kovacs The Richmond University Medical Center in New York has been investigating a ransomware attack since May 2023 and it recently determined that the incident resulted in a data breach affecting more than 670,000 people. The healthcare facility, which serves residents in Staten Island, New York, suffered significant disruptions in May 2023 after being targeted in a ransomware attack. It took the organization several weeks to restore impacted services.An initial forensic investigation showed that the hospital’s electronic health record systems were not compromised, but it was later determined that other files may have been accessed or exfiltrated from Richmond University Medical Center’s network in early May. “Once the investigation determined what files may have been accessed or removed from our network, we

50
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
FireScam Android Malware Packs Infostealer, Spyware Capabilities

The FireScam Android infostealer monitors app notifications and harvests credentials and financial data and sends it to a Firebase database. January 3, 2025 By Ionut Arghire A recently identified Android malware described as an information stealer and spyware has broad monitoring capabilities that allow it to harvest and exfiltrate sensitive information from numerous applications, threat landscape management company Cyfirma reports.Dubbed FireScam, the malware is distributed disguised as the ‘Telegram Premium’ application, through a phishing website that mimics the legitimate RuStore application store.The phishing website, hosted on the github[.]io domain, serves a dropper named ‘ru.store.installer’, which installs FireScam on devices running Android 8 and newer.Once installed on the victim’s device, the dropper requests permissions to query and list all installed applications, to access and modify external storage, to delete and install applications, and to update applications without

30
Jasper_The_Rasper
Moderator
3 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft December 2024 Security Updates (Patch Tuesday)

This release consists of the following 72 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?System Center Operations Manager CVE-2024-43594Microsoft Office CVE-2024-43600Microsoft Edge (Chromium-based) CVE-2024-49041Microsoft Defender for Endpoint CVE-2024-49057Microsoft Office CVE-2024-49059Microsoft Office SharePoint CVE-2024-49062GitHub CVE-2024-49063Microsoft Office SharePoint CVE-2024-49064Microsoft Office Word CVE-2024-49065Microsoft Office SharePoint CVE-2024-49068Microsoft Office Excel CVE-2024-49069Microsoft Office SharePoint CVE-2024-49070Windows Task Scheduler CVE-2024-49072Windows Mobile Broadband CVE-2024-49073Windows Kernel-Mode Drivers CVE-2024-49074Windows Remote Desktop Services CVE-2024-49075Windows Virtualization-Based Security (VBS) Enclave CVE-2024-49076Windows Mobile Broadband CVE-2024-49077Windows Mobile Broadband CVE-2024-49078Microsoft Office Publisher CVE-2024-49079Windows IP Routing Management Snapin CVE-2024-49080Win

6512
TripleHelix
Moderator
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
XWorm Malware Targeting CPA Firms During Tax Season

As tax filing deadlines approach, we always see an increase of tax-themed attacks and this year is no exception. Everyone should be on guard as attacks posing as IRS notifications and tax preparation companies are prevalent. However, it is also important to remember that the tax preparers themselves are at a heightened risk. The potential troves of sensitive data which could be exposed through a malware breach on a CPA or Tax Service network makes for an extremely attractive target for malicious actors. And given the nature of what they do with taking on unknown clients and receiving financial documents they must remain extremely vigilant.One threat group we have observed targeting CPA firms in recent years past we again recently spotted using similar tactics as in recent years to infect targets with a remote access trojan. This example purports to be tax documents attached and contains a link to a zip file download.If the user downloads and extracts the ZIP archive, they will see two

90
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Malware Alert: Targeted Attacks Determined to Infect Specific Users

We recently discovered a highly targeted malware attack only sent to only a handful of customers who possibly have personal connections to Ukraine. The attacks focused on select users at three separate organizations, an election company that serves both businesses and governments along with two other organizations dealing with influential public advertising and marketing. Over the course of three days, we saw the same threat actor attempting to infect the same specific users using separate and distinct malware families.The first attack purports to be from the Central Office of the Security Service (SBU) of Ukraine. The theme was around an investigation into the legalization of income and soliciting information from the recipient contained within the [.]ZIP attachment. In both attacks, they utilized bitbucket as its command and control (C2) communication to deploy payloads. It also utilizes the same C2 IP (185[.]70[.] 104[.]90) which resolves to hostkey[.]ru in Moscow.If the [.]ZIP is e

20
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Credit Card Details Still in Many Attackers Crosshairs

Phishing threats have evolved over the years as threat actors have found more inventive ways to raise the stakes from a financial perspective. For example, revenue from BEC’s and Ransomware is estimated well into the Billions (USD) on an annual basis, netting threat actors’ massive profits. Despite this, we do still see attacks aimed an PII and credit card details to be leveraged in fraudulent transactions.One of these recent attacks leveraged a Netflix theme, stating the recipient’s account has been placed on hold until their payment details are updated. The message urged the user to update their payment details by clicking on a link within the message. Following the link leads to the attacker-controlled and realistically named domain (processingsolution24[.]com) for credit card “processing”. However, this domain has been registered by the threat actor and is not related to legitimate Netflix billing. If the user enters their card details, it would be posted to a PHP page at otl[.]su.

20
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Brand Cohesion in Multiple Layers of Microsoft Bookings Attacks

Microsoft remains the most spoofed brand in phishing attacks in the new year. The number of variations of theme within the Microsoft brand is quite extensive. To put it plainly, if it is a Microsoft business/consumer service, mostly likely we have seen a multitude of phishing attacks invoking it to dupe users into falling victim.A recent attack added a rare new twist by invoking the Microsoft Bookings (Scheduling tool) to instill a sense of legitimacy in the mind of the recipients. It purported to be an “Encrypted EFT Invoice Payment” with a link to the invoice, which the user would need to click on to retrieve. The link leverages ncv.microsoft[.]com, Microsoft Dynamics customizable survey offering that is abused heavily by threat actors for attacks like these. Through abuse of this Microsoft service the actors obscure the malicious nature of the URL as a Microsoft domain would not arouse suspicion for most everyone taking the time to look. Utilizing Dynamics also servers to keep the b

10
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Holiday Shoppers Beware: Shipping Notification Lures Abound

Holiday shopping is in full swing and for many people, that means their inboxes are inundated with shipping notifications. Attackers utilize shipping themed attack vectors year-round but never so often as during the holiday season.  These are effective lures for threat actors to either deliver malware or harvest credentials from unsuspecting users.One very convincing shipping themed phishing variant observed recently stood out as it was particularly well crafted. This attack would easily pass they eye test given the convincing wording and visuals of both the email, as well as the phishing page.As we have seen quite frequently in a variety of phishing attacks over the past several months, ipfs[.]com is being leveraged to host this DHL branded credential harvesting page.This example happened to be DHL themed, but these are frequently observed posing as USPS, UPS, FedEx etc. And not only is this a very popular social engineering tactic in credential harvesting attacks but also with malwar

30
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Image-based Phishing gaining popularity

Image-based phishing has been prevalent for years, but it has exploded in recent months, especially with the advent of Quishing (the unattractive term recently coined for QR code phishing). In these attacks the entire email body text is contained within the image itself, while the image also serves as a link to a malicious/phishing website. It also follows another popular trend we have recently observed in that it abuses Cloudflare’s CAPTCHA service to deter automated analysis.  The image used in the following attack borrows some assets from legitimate Microsoft emails and induces a sense of urgency in the user claiming that their password expires today. The image link leverages Baidu[.]com which is often referred to as the “Google of China”. We have noticed a significant increase in phishing attacks leveraging this service for re-directs as it is typically viewed as benign in nature.Clicking on the image first directs to this Cloudflare captcha page where the verification box just nee

20
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
YPO Phishing Attack Leaves Data Exposed

Threat actors continually search for novel social engineering tactics to avoid arousing suspicion and to disguise their payloads. Sometimes they fail to take the necessary action required to conceal their activity.  A recent attack we quarantined was posing as a message regarding joining a YPO Global Leadership Committee. It stated, “a comprehensive Dossier that delves deeper into what being a part of this esteemed committee means,” was attached (via HTML) to the message.When opening the html attachment, you are presented with a Microsoft OWA themed login portal in your default browser.Upon further analysis to determine where the attackers were posting the stolen credentials, we discovered an open directory on the site which showed the compromised data of previous victims who were not using our email threat protection. This open directory, of course, leaves the compromised data open to anyone who goes to look and not just the threat actor. Also contained in the directory was the attack

10
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
While Cryptocurrency Adoption Grows: So Does Attack Surface

With over 420 million investors worldwide and expanding every day, cryptocurrency ownership is a widening attack surface. What is more, with many casual investors into the cryptocurrency market many newly minted owners may find themselves in an unfamiliar territory given that they may be new to the platform, exchanges and general process surrounding cryptocurrency which can help play into the hands of attackers.We continue to capture many unique cryptocurrency attacks targeting customer wallets. One of the latest versions was masquerading as a legal claim resolution for held crypto funds regarding the Voyager platform bankruptcy. Voyager filed for bankruptcy back in August of 2022 after citing volatility in Crypto markets and default of a loan made to Three Arrows Capital. This news left platform users reeling while scrambling to discover if their funds would be recovered and that process would drag on for many months with much uncertainty. Threat actors would, naturally, never let a g

20
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Customized Attacks Leverage Facebook and IPFS

Threat actors have long used social media content for both reconnaissance and as a data source to customize phishing attacks to enhance credibility. This example was attempting to masquerade as a Voice2eMail message. However, each message comes customized to the target organization as the inserted image in the email changes depending on the company being targeted. The attacker-generated emails pull the image from the target companies Facebook profile and insert it into the custom-branded message. This is done to try to convince the user this message originated from their own voicemail system, and this makes for a very compelling attack.If the company did not have a Facebook presence or photo, a generic Microsoft image is inserted. To disguise the true nature of the URL, these attacks abused LinkedIn’s “slinks,” a feature that businesses can use in their LinkedIn profile for tracking marketing and ad campaign metrics. This LinkedIn service will serve as a redirect to a second destinatio

10
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Human Resource Emails Deliver Modular Phishing Pages

A clever social engineering approach we often see involves attacker crafting emails that pose as internal HR communications. This “employee performance report” campaign purporting to be the recipients own HR department also contained multiple payloads which is becoming increasingly popular. These attackers are using a look-a-like domain of intended recipient. The email lures its target by claiming to include a list of employees that are being promoted in the performance report, this is a clever tactic to entice users into interacting with the link or attached file.However, cleverer than the tactic used in the email lure is the functionality of the phishing site delivered in the payload URL. Cloudflare’s R2 cloud storage service is being leveraged by these threat actors to host a modular credential harvesting page that is customized depending on the target domain. For demonstration purposes, we manually added test@microsoft.com to the end of the payload link to show the site pulling the

20
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Spoofed Microsoft Teams Invites are Popular Lure

Unquestionably one of the most spoofed brands, in email attacks, over the past several years has been Microsoft. Recently, threat actors have continued with some clever spoofed Microsoft Teams emails. One of the most popular variations of MS Teams attacks mimic the legitimate emails sent when a user is added to a Teams group. This example originated in Hungary from the domain godmanmedicals[.]store. Generic tld’s, such as [.]store, are commonly abused at times when hosting companies conduct yearly registration deals to promote a specific gtld. This domain was registered thru Namecheap who currently offers the first year for [.]store tld’s at .98 (USD), threat actors love a bargain as much as anyone.The payload link leads to a phishing portal that mimics the MS 365 OWA login portal design. However, this actor removed all the Microsoft branding and favicon with the likely goal of avoiding security product detections and keep the page active for a longer duration.In addition to removing t

20
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Formbook(Xloader) Malware Distribution Snapshot

Fraudulent purchase orders and shipping notifications have been two common recurring themes for distributors of multiple different malware families. This malicious attack, shown below, presented itself as a shipment status notification from TNT Express. TNT is a shipping and logistics company operating in more than two hundred countries and was acquired by FedEx in 2016 but still retains the TNT branding outside the US. It stated shipment paperwork was attached but was a disguised [.]gz file presenting itself as a PDF. Double extensions such as this combination should always be a big red flag. Upon extracting the gzip archive an executable was inside that turned out to be XLoader. XLoader is a stealthy rebranded version of Formbook(info-stealer) offered in licensed subscriptions via the malware-as-a service model. It is cross-platform capable of infecting both Windows and macOS.Below is an underground forum XLoader ad, published by bleepingcomputer in 2021, when it started to become no

00
TroyGIll
Community Manager
3 days ago
TroyGIll
Community Manager
TroyGIllCommunity Manager
published in Phish Tank
Meta Ad Violation Leads to Credential Theft

Marketing on Meta-owned platforms have become part and parcel for many organizations. Threat actors are keenly aware of this and often craft phishing attacks looking to capitalize on this fact. Our analysts frequently run across phishing emails attempting to leverage Meta ads in one way or another.Recently, an interesting Meta ad violation campaign targeted many users claiming that their ad accounts had been temporarily disabled with the goal of stealing their Meta credentials.The “SUBMIT” link leads to a Meta branded page, hosted on Google’s web[.]app domain, which includes a captcha checkbox and Meta branding.Continuing to the next page includes a fictitious report number and requires some basic information to begin the rebuttal process on this ad violation and collects basic personal information. After agreeing to the terms with the checkbox on and clicking “Submit” a password prompt is displayed. By design the page will always state an incorrect password was entered to farm all pos

00
TroyGIll
Community Manager
3 days ago

Badges

Show all badges

Join the Conversation

Terms & Conditions