MagicWeb is the name of a new post-exploitation (post-compromise) tool discovered and detailed by Microsoft security researchers. The tool is attributed to the Nobelium APT (advanced persistent threat) group which uses it to maintain persistent access to compromised systems. This…
GitLab revealed a critical vulnerability for branches 15.1, 15.2, and 15.3 of its community and enterprise editions. The vulnerability, identified as CVE-2022-2884 and rated 9.9 on the CVSS scale, could enable a threat actor to carry out remote command execution…
CVE-2022-2588, also known as Dirty Cred, is an eight-year old vulnerability in the Linux kernel that has been described as “as nasty as Dirty Pipe”. The Connection Between CVE-2022-2588 and CVE-2022-0847 Dirty Pipe, or CVE-2022-0847, was disclosed earlier this year…
DarkTortilla is a sophisticated and highly configurable crypter malware that delivers popular infostealers and remote access trojans including AgentTesla, AsyncRAT, Redline and NanoCore. What Is the DarkTortilla Crypter? A crypter is a type of software that has the capabilities to…
![VibeProfile Mac Virus - How to Remove [Free Guide]](https://cdn.sensorstechforum.com/wp-content/uploads/2020/05/apple-security-sensorstechforum-1024x584.jpg "Apple Fixed Two Actively Exploited Zero-Days [CVE-2022-32893]")
Two zero-days were fixed by Apple in the following operating systems – macOS, iOS and iPadOS. The zero-days, known as CVE-2022-32893 and CVE-2022-32894, have been exploited in the wild against exposed devices. CVE-2022-32893 and CVE-2022-32894 in macOS, iOS and iPadOS…
An actively exploited, highly severe zero-day vulnerability has been fixed in Google Chrome desktop. The vulnerability has been assigned the CVE-2022-2856 identifier. Details about CVE-2022-2856 According to the official description, CVE-2022-2856 relates to an insufficient validation of untrusted input in…
![SOVA Android Malware Upgraded with a Ransomware Module [.enc Files]](https://cdn.sensorstechforum.com/wp-content/uploads/2022/02/android-trojan-sensorstechforum-1024x585.jpg "SOVA Android Malware Upgraded with a Ransomware Module [.enc Files]")
SOVA is an Android banking trojan that first appeared in an underground forum in September 2021. Even the first iterations of the malware had plenty of functionalities, with the most recent ones updated with new features and code improvements. SOVA…
Orchard is the name of a new botnet taking advantage of Bitcoin’s creator Satoshi Nakamoto’s account transaction information to generate DGA [Domain Generation Algorithms] domain names. This is done to conceal the botnet’s command-and-control infrastructure. “Because of the uncertainty of…
GwisinLocker is a new ransomware family targeting South Korean industrial and pharmaceutical companies. Capable of compromising both Windows and Linux systems, GwisinLocker has been coded by a relatively unknown threat actor, called Gwisin (meaning ghost or spirit in Korean). Security…
VMware recently released another set of patches addressing a number of vulnerabilities in several products. The vulnerabilities (CVE-2022-31656, CVE-2022-31657, CVE-2022-31658, CVE-2022-31659, CVE-2022-31660, CVE-2022-31661, CVE-2022-31662, CVE-2022-31663, CVE-2022-31664, CVE-2022-31665) were reported privately. The severity scores of the flaws vary from 4.7 to…
The well-known LockBit ransomware has been receiving significant updates, as evident by the reports of several cybersecurity vendors. New Version of LockBit Observed in the Wild According to SentinelLabs, a new iteration of the ransomware has been deployed in the…
New auto-starting malware on the Google Play Store has been identified. HiddenAds Android Malware The malware is propagated with the help of malicious apps masquerading themselves as cleaner and optimization apps for device management. The Android apps were distributed on…
Security researchers recently uncovered a large network of fake investment scamming sites targeting specific European countries and North America. Fake Investment Phishing Sites Targeting European Countries The network consists of at least 11,000 domains that target the United Kingdom, Belgium,…
Security researchers share a new trend in phishing campaigns which now utilize the so-called IPFS URLs as payload. The discovery comes from TrustWave researchers who came across a site called the Chameleon Phishing page. Websites like this one can change…
Security researchers detail a new phishing-as-a-service (Phaas) platform in a recently released report. The platform is an example of how initial access brokers gain a foothold in organizations’ networks. Robin Banks is the name of a new PhaaS platform which,…
Unsecured wi-fi networks have proven to be a gateway to many attacks. More particularly, poorly configured access point encryption (or services that allow data to be sent without being encrypted) has been outlined as one of the biggest threats to…
Security researchers detailed the discovery of a new, previously undetected malware sample specifically designed to target the Linux environment. The malware showcases sophisticated capabilities and is “an intricate framework developed for targeting Linux systems,” Intezer researchers said in their technical…
Security researchers reported the discovery of a new cross-platform ransomware strain coded to target Windows, Linux, and ESXi systems. Meet the New Cross-Platform Luna Ransomware Discovered by Kaspersky’s Darknet Threat Intelligence monitoring system, the so-called Luna ransomware is advertised on…
Apple has released fixes addressing 37 software vulnerabilities in its operating systems iOS, iPadOS, macOS, tvOS, and watchOS. The flaws affect different parts of iOS and macOS and could be used for escalation of privilege, arbitrary code execution, information disclosure…
A new macOS backdoor is making rounds in the wild in targeted attacks aiming to steal sensitive information. CloudMensis macOS Backdoor: What’s Known So Far The backdoor, called CloudMensis, is exclusively using public cloud storage services to communicate with the…
