Search cyberveille.decio.ch

Found 10 bookmarks

Custom sorting

Ongoing Social Engineering Campaign Refreshes Payloads

On June 20, 2024, Rapid7 identified multiple intrusion attempts by threat actors utilizing Techniques, Tactics, and Procedures (TTPs) that are consistent with an ongoing social engineering campaign being tracked by Rapid7.

#rapid7 #EN #2024 #TTPs #Social-engineering #Campaign #analysis #BlackBasta

·rapid7.com·Aug 12, 2024

Ongoing Social Engineering Campaign Refreshes Payloads

Supply Chain Compromise Leads to Trojanized Installers | Rapid7 Blog

Rapid7 investigated suspicious behavior emanating from the installation of Notezilla, RecentX, & Copywhiz. These installers are distributed by Conceptworld.

#rapid7 #EN #2024 #Conceptworld #India #Indian #Software #Hacked #Data-Stealing #Notezilla #RecentX #Copywhiz #Supply-chain-attack

·rapid7.com·Jul 7, 2024

Supply Chain Compromise Leads to Trojanized Installers | Rapid7 Blog

Malvertising Campaign Leads to Execution of Oyster Backdoor

Rapid7 observed a recent malvertising campaign luring users to download malicious installers for popular software like Google Chrome and Microsoft Teams.

#rapid7 #EN #2024 #Malvertising #Oyster #Backdoor

·rapid7.com·Jun 24, 2024

Malvertising Campaign Leads to Execution of Oyster Backdoor

CVE-2024-4978: Backdoored Justice AV Solutions Viewer Software Used in Apparent Supply Chain Attack | Rapid7 Blog

Justice AV Solutions (JAVS) is a U.S.-based company specializing in digital audio-visual recording solutions for courtroom environments. According to the vendor’s website, JAVS technologies are used in courtrooms, chambers and jury rooms, jail and prison facilities, and council, hearing, and lecture rooms. Their company website cites over 10,000 installations of their technologies worldwide.

#rapid7 #EN #2024 #Backdoored #JusticeAV #US #CVE-2024-4978

·rapid7.com·May 23, 2024

CVE-2024-4978: Backdoored Justice AV Solutions Viewer Software Used in Apparent Supply Chain Attack | Rapid7 Blog

Ongoing Malvertising Campaign leads to Ransomware

Rapid7 has observed an ongoing campaign to distribute trojanized installers for WinSCP and PuTTY via malicious ads on commonly used search engines, where clicking on the ad leads to typo squatted domains.

#rapid7 #EN #2024 #Malvertising #Campaign #Ransomware #WinSCP #PuTTY

·rapid7.com·May 14, 2024

Ongoing Malvertising Campaign leads to Ransomware

The Updated APT Playbook: Tales from the Kimsuky threat actor group | Rapid7 Blog

Within Rapid7 Labs we continually track and monitor threat groups. As part of this process, we routinely identify evolving tactics from threat groups in what is an unceasing game of cat and mouse.

#Rapid7 #EN #2024 #APT #TTPs #Kimsuky #Black #Banshee #Thallium #North-Korea

·rapid7.com·Mar 21, 2024

The Updated APT Playbook: Tales from the Kimsuky threat actor group | Rapid7 Blog

Rapid7 flames JetBrains over vulnerability disclosure

Security shop Rapid7 is criticizing JetBrains for flouting its policy against silent patching regarding fixes for two fresh vulnerabilities in the TeamCity CI/CD server. Rapid7 says it reported the two TeamCity vulnerabilities in mid-February, claiming JetBrains soon after suggested releasing patches for the flaws before publicly disclosing them. Such a move is typically seen as a no-no by the infosec community, which favors transparency, but there's apparently a time and a place for these things.

#theregister #EN #2024 #Rapid7 #flames #JetBrains

·theregister.com·Mar 6, 2024

Rapid7 flames JetBrains over vulnerability disclosure

CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)

In February 2024, Rapid7’s vulnerability research team identified two new vulnerabilities affecting JetBrains TeamCity CI/CD server: CVE-2024-27198 is an authentication bypass vulnerability in the web component of TeamCity that arises from an alternative path issue (CWE-288) and has a CVSS base score of 9.8 (Critical). CVE-2024-27199 is an authentication bypass vulnerability in the web component of TeamCity that arises from a path traversal issue (CWE-22) and has a CVSS base score of 7.3 (High).

#rapid7 #EN #2024 #research #JetBrains #TeamCity #CVE-2024-27198 #CVE-2024-27199

·rapid7.com·Mar 4, 2024

CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)

Patch Tuesday - February 2024

Microsoft is addressing 73 vulnerabilities this February 2024 Patch Tuesday, including two (actually, three!) zero-day/exploited-in-the-wild vulnerabilities, both of which are already included on the CISA KEV list. Today also brings patches for two critical remote code execution (RCE) vulnerabilities, and a critical elevation of privilege vulnerability in Exchange. Six browser vulnerabilities were published separately this month, and are not included in the total.

#rapid7 #EN #2024 #PatchTuesday #february-2024 #CVE-2024-21351 #CVE-2024-21412 #CVE-2024-21413

·rapid7.com·Feb 15, 2024

Patch Tuesday - February 2024

CVE-2024-0204: Critical Authentication Bypass in Fortra GoAnywhere MFT | Rapid7 Blog

On 1/22/24, Fortra published a security advisory on CVE-2024-0204, a critical authentication bypass affecting its GoAnywhere MFT secure managed file transfer product prior to version 7.4.1.

#rapid7 #EN #2024 #Critical #Authentication #Bypass #CVE-2024-0204 #Fortra #GoAnywhere

·rapid7.com·Jan 23, 2024

CVE-2024-0204: Critical Authentication Bypass in Fortra GoAnywhere MFT | Rapid7 Blog