Security researchers detected a number of malicious adult websites that push a fake ransomware, which in reality is a data wiper. Adult Websites Pushing a Fake Ransomware Instead of encrypting the victim’s data, the ransomware acts as a wiper, attempting…
Security researchers have detailed a new, multi-functional malware. Called LilithBot, the malware is associated with the Eternity Project threat group which has been active since at least January 2022. Another Addition to the Eternity Project’s Malware Arsenal The Eternity threat…
![ProxyNotShell Zero-Day Mitigations Can Be Bypassed [CVE-2022-41040]](https://cdn.sensorstechforum.com/wp-content/uploads/2022/06/software-vulnerability-alert-sensorstechforum-1024x585.jpg "ProxyNotShell Zero-Day Mitigations Can Be Bypassed [CVE-2022-41040]")
Two new zero-day vulnerabilities in Microsoft Exchange were recently reported by Microsoft and GTSC researchers. The two vulnerabilities, identified as CVE-2022-41040 and CVE-2022-41082, are known collectively as the ProxyNotShell exploit. CVE-2022-41040 is a server-side request forgery issue which can be…
The Prilex malware is back once again in three new versions. The malware has slowly been evolving from ATM-focused towards modular point-of-sale (PoS) malware. The Brazilian threat actor behind it has carried out “one of the largest attacks on ATMs…
We’re in the season of aggressive malware campaigns, evident by the increased number of attacks detected and analyzed by security researchers. One specific type of malware is especially important to carrying out successful distribution campaigns – the dropper. NullMixer is…
The Emotet malware is once again making the titles. According to a new AdvIntel report, so far in 2022, a total of 1,267,598 Emotet infections have been detected worldwide, with significant peaks between February and March, and June and July.…
This week Apple released an emergency update to address a new zero-day vulnerability that affects macOS and iOS. CVE-2022-32917 Zero-Day: Overview Reports indicate that the zero-day has already been exploited in the wild. Tracked as CVE-2022-32917 and reported anonymously, the…
There’s a new dangerous Linux malware circling the web. Dubbed Shikitega, the malware has been infecting both Linux computers and IoT devices with additional payloads. How Does the Shikitega Malware Operate to Infect a Linux System? Discovered by T&T Alien…
Cybersecurity researchers just uncovered another phishing-as-a-service [PaaS] platform. Called EvilProxy, the platform is specialized in reverse proxy phishing campaigns aiming to circumvent MFA [multi-factor authentication] mechanisms. EvilProxy: Reverse Proxy Phishing-as-a-Service Platform In computer networking, reverse proxy is a server situated…
A security loophole affecting Google Chrome, Apple’s Safari and Mozilla Firefox was recently discovered by security researcher Jeff Johnson. The flaw could enable malicious pages to automatically overwrite clipboard content without the need of user interaction. Chrome, Safari and Firefox…
A high severity vulnerability in the TikTok Android app has been fixed. The flaw could enable attackers to take over user accounts by tricking users into clicking a malicious link. Discovered by Microsoft, the vulnerability has already been fixed. Related…
ModernLoader is a new remote access trojan detected by Cisco Talos researchers. ModernLoader Campaigns in the Wild More specifically, the researchers analyzed three separate, but related campaigns in the period March-June 2022 that delivered ModernLoader, RedLine and several cryptocurrency miners.…
Agenda is a new strain of Golang ransomware specifically targeting healthcare and education organizations in Indonesia, Thailand, South Africa, and Saudi Arabia. Discovered by Trend Micro researchers, Agenda ransomware can reboot compromised systems in safe mode and can attempt to…
A Turkish-based cryptocurrency mining malware (crypto miner) campaign has been detected. Called Nitrokod and discovered by the Check Point Research team, the campaign has infected machines across 11 countries with a XMRig crypto miner. Nitrokod Cryptominer Campaign: Some Details The…
A new report by NCC Group sheds light on the threat landscape for the past month (July 2022). Apparently, ransomware attacks are once again on the rise, with LockBit being the most active ransomware in the wild. What else has…
The LockBit ransomware group is now working towards improving its protection against DDoS attacks as well as adding triple extortion to its malicious operations. These actions are triggered by a recent clash between LockBit criminals and security firm Entrust. LockBit…
Another critical Atlassian vulnerability has been reported in numerous API endpoints of Bitbucket Server and Data Center. The vulnerability in question is CVE-2022-36804, a command injection issue in version 7.0.0 of Bitbucket Server and Data Center. CVE-2022-36804: Atlassian Bitbucket Server…
MagicWeb is the name of a new post-exploitation (post-compromise) tool discovered and detailed by Microsoft security researchers. The tool is attributed to the Nobelium APT (advanced persistent threat) group which uses it to maintain persistent access to compromised systems. This…
GitLab revealed a critical vulnerability for branches 15.1, 15.2, and 15.3 of its community and enterprise editions. The vulnerability, identified as CVE-2022-2884 and rated 9.9 on the CVSS scale, could enable a threat actor to carry out remote command execution…
CVE-2022-2588, also known as Dirty Cred, is an eight-year old vulnerability in the Linux kernel that has been described as “as nasty as Dirty Pipe”. The Connection Between CVE-2022-2588 and CVE-2022-0847 Dirty Pipe, or CVE-2022-0847, was disclosed earlier this year…
