According to Cloudflare's 2024 Application Security report, threat actors are exploiting proof-of-concept (PoC) exploits within as little as 22 minutes of their public release. The report, covering May 2023 to March 2024, reveals heightened scanning for CVE vulnerabilities, with Apache and Coldfusion products among the most targeted. Notably, CVE-2024-27198, an authentication bypass in JetBrains TeamCity, exemplifies the trend towards rapid exploit deployment shortly after vulnerabilities are disclosed.
Censys has issued a warning that over 1.5 million Exim mail transfer agent (MTA) instances remain vulnerable to CVE-2024-39929, allowing threat actors to bypass security filters. The flaw affects Exim versions up to 4.97.1 and stems from mishandling multiline RFC2231 header filenames, enabling the delivery of malicious executable attachments. While a proof-of-concept exists, active exploitation has not been reported. As of July 10, 2024, vulnerable servers are predominantly located in the United States, Russia, and Canada, posing a significant risk to email security.
Rite Aid, the third-largest drugstore chain in the US, has acknowledged a data breach following a June cyberattack attributed to the RansomHub ransomware group. The breach affects customers across its 1,700 pharmacy stores in 16 states. Rite Aid is actively investigating the incident and preparing data breach notifications for affected customers. With assistance from external cybersecurity experts, the company has restored compromised systems and resumed normal operations, emphasizing their commitment to safeguarding personal information.
Decentralized finance (DeFi) cryptocurrency domains hosted on Squarespace are under attack by coordinated DNS hijacking incidents. Attackers are altering DNS records to redirect visitors to phishing sites that steal cryptocurrency wallets. DNS hijacking involves modifying Domain Name System settings to reroute traffic from legitimate websites to malicious pages, often achieved through compromising DNS servers or accounts with DNS service providers. These attacks aim to exploit vulnerabilities in domain management to deceive users and steal sensitive financial information.
Netgear has issued a critical alert advising users to update their WiFi 6 router firmware to address vulnerabilities including stored cross-site scripting (XSS) and authentication bypass flaws. The XSS vulnerability in the XR1000 Nighthawk router (fixed in firmware version 1.0.0.72) and authentication bypass in CAX30 Nighthawk AX6 models (fixed in firmware version 2.2.2.2) could allow attackers to hijack sessions, redirect to malicious sites, or gain unauthorized access to administrative interfaces. Netgear encourages prompt updates to mitigate potential risks associated with these security weaknesses.
Palo Alto Networks Unit 42 has uncovered a brief DarkGate malware campaign utilizing public-facing Samba file shares to spread Visual Basic Script (VBS) and JavaScript files from March to April 2024. Targeting North America, Europe, and Asia, the campaign highlights threat actors' use of legitimate services for malicious ends. DarkGate, evolving since 2018 into a malware-as-a-service (MaaS), enables remote control, code execution, cryptocurrency mining, and more, with increased activity following the QakBot takedown in 2023.
Snowblind, a new banking malware, is a sophisticated and insidious threat designed to exploit vulnerabilities in Android security features. This malware operates with a high level of stealth, making it particularly dangerous for unsuspecting users, especially those engaged in mobile banking. So, let's delve into what Snowblind malware is, how it exploits Android security features, and how it targets banking customers.
Read more insights here:
Top eight Malware Types org should defend
Malware, a malicious software, provides cybercriminals with unauthorized access to computer systems. It includes various types of software code, each with its distinct methods to impact the affected systems. These can range from stealing sensitive information and data to causing system-wide outages and damage. Protecting against malware involves using antimalware software, keeping systems updated, and being cautious when downloading files or clicking on links.
Read more insights here:
CVE-2024-34102: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier are vulnerable to an XXE (XML External Entity) attack, allowing attackers to execute arbitrary code. By sending a specially crafted XML document containing external entity references, attackers can exploit this flaw without requiring user interaction. Adobe recommends updating to patched versions to mitigate this security risk.
CVE-2024-20399: A vulnerability in Cisco NX-OS Software's CLI allows a local, authenticated attacker to execute arbitrary commands as root on the affected device's operating system. This occurs due to inadequate validation of arguments passed to certain configuration CLI commands. Exploitation requires Administrator credentials, enabling the attacker to manipulate commands and gain root privileges on the system. Cisco recommends applying necessary updates to mitigate this security risk.
CVE-2024-38080: This vulnerability allows an authenticated threat actor to execute code with SYSTEM privileges, posing significant risk if exploited, especially in guest OS environments. While Microsoft hasn't detailed the extent of exploitation, the potential impact is severe, particularly for ransomware attacks. Users utilizing Hyper-V are urged to promptly test and deploy the update to mitigate this critical security risk.
CVE-2024-38112: The impact of this bug is labeled as "Spoofing," though the specific spoofing target isn't detailed. Microsoft previously used this term for NTLM relay attacks, though that's unlikely here. Further analysis is expected from the researcher who reported it. Fortunately, exploitation requires user interaction, but users' tendency to click links poses a significant risk.
CVE-2024-35264: This is an 8.1 CVSSv3-rated RCE vulnerability impacting .NET and Visual Studio, marking the third zero-day patched by Microsoft this month. Though details were disclosed before patch release, no exploitation in the wild was reported. Exploitation involves winning a race condition, reflected in its "Exploitation Less Likely" rating.
CVE-2024-38021: This is an 8.8 CVSSv3-rated RCE vulnerability affecting Microsoft Office 2016, categorized as "Exploitation More Likely." It enables attackers to gain elevated privileges, including write, read, and delete capabilities, by bypassing the Protected View Protocol with a malicious link. Successful exploitation involves enticing users through phishing attacks to click the link, granting access to local NTLM credentials for achieving RCE.
Prudential Financial disclosed that a February data breach compromised the personal information of over 2.5 million individuals. Detected on February 5, the breach allowed attackers to access administrative and user data, as well as employee and contractor accounts. In March, Prudential informed the Maine Attorney General's Office that over 36,000 people had sensitive information, including names and ID numbers, stolen during the incident.
A threat actor compromised Ethereum's mailing list provider, sending phishing emails to over 35,000 addresses with a link to a malicious crypto-draining site. The breach, disclosed by Ethereum in a blog post, had no material impact on users. The attack occurred on June 23, using the email address 'updates@blog.ethereum.org' and targeting 35,794 addresses. The phishing message falsely announced a collaboration with Lido DAO, promising a 6.8% APY on staked Ethereum.
Evolve Bank & Trust is notifying 7.6 million Americans of a data breach following a LockBit ransomware attack. Initially misattributed to the U.S. Federal Reserve, the leaked data was confirmed to belong to Evolve. An employee's click on a malicious link allowed LockBit to access and download Evolve's database. While customer funds remain safe, several fintech customers, including Affirm, Wise, and Bilt, were affected. Evolve is now sending breach notifications as per its latest update.
In an extortion campaign against Ticketmaster, hackers leaked nearly 39,000 print-at-home tickets for 154 upcoming events, including concerts by Pearl Jam and Foo Fighters. The threat actor 'Sp1derHunters' is behind the leak, selling data stolen from Snowflake accounts. This follows an April breach where credentials were stolen via malware, leading to the download of databases from 165 organizations. Despite Ticketmaster's claims of robust anti-fraud measures, hackers continue to demand millions in extortion, recently leaking Taylor Swift ticket barcodes.
Neiman Marcus disclosed a May 2024 data breach exposing over 31 million customer email addresses, according to Troy Hunt of Have I Been Pwned. Despite Neiman Marcus reporting 64,472 impacted individuals to the Maine Attorney General, the breach also compromised names, contact details, birth dates, gift card info, and more. Hunt confirmed the legitimacy of the data, intending to notify affected subscribers promptly. Neiman Marcus declined to comment on Hunt's findings but referred to their data security notification on the incident.
AT&T has reported a major data breach where call logs for 109 million customers were stolen from its Snowflake database between April 14 and 25, 2024. The breach affects nearly all mobile customers, including those using mobile virtual network operators (MVNOs), with data spanning from May 2022 to January 2023. Stolen details include telephone numbers, interaction records, call durations, and in some cases, cell site identification numbers, raising significant privacy concerns among users and regulatory scrutiny.
The Unfurling Hemlock threat actor has been deploying up to ten malware types simultaneously, infecting systems with hundreds of thousands of malicious files since February 2023. Described as a "malware cluster bomb" by Outpost24's KrakenLabs, this method spreads various malware, including information stealers, botnets, and backdoors. KrakenLabs has identified over 50,000 unique files linked to the group.
The BlackSuit ransomware gang has claimed responsibility for a cyberattack on KADOKAWA corporation, threatening to publish stolen data unless a ransom is paid. The Japanese media conglomerate, which includes FromSoftware, experienced service outages across multiple websites due to the June 8 attack. The ransomware impacted most of KADOKAWA's and its subsidiaries' operations, including the popular video-sharing platform Niconico.
The new Brain Cipher ransomware targeted Indonesia's temporary National Data Center on June 20, encrypting government servers and disrupting services like immigration and passport control. The attack impacted over 200 government agencies, with Brain Cipher demanding $8 million in Monero for decryption and non-disclosure of allegedly stolen data. The attackers hinted at stolen data in negotiation chats, indicating a potential leak.
The new ransomware-as-a-service (RaaS) Eldorado, active since March, targets VMware ESXi and Windows systems, claiming 16 victims in the U.S. across real estate, education, healthcare, and manufacturing. Group-IB researchers observed Eldorado promoting their service on RAMP forums, seeking skilled affiliates to expand their operations.
Microsoft has patched a high-severity MSHTML spoofing vulnerability (CVE-2024-38112) that was actively exploited for 18 months to launch malicious scripts while bypassing security features. Discovered by Haifei Li of Check Point Research and disclosed in May 2024, the flaw was fixed in the July 2024 Patch Tuesday updates.
New ViperSoftX variants evade detection by using Microsoft's .NET Framework common language runtime (CLR) to execute PowerShell commands within AutoIt scripts. This method leverages CLR as an execution engine, loading code in AutoIt, which is generally trusted by security solutions.
Stay updated with "Cybersecurity News and Trends from Intelliroot." For the latest stories shaping the cybersecurity landscape, follow us on LinkedIn or visit our Cybersecurity News and Trends page.
