SmartScreen Vulnerability: CVE-2024-21412 Facts and Fixes

Credit to Author: Trend Micro Research| Date: Tue, 13 Feb 2024 00:00:00 +0000

This entry aims to provide additional context to CVE-2024-21412, how it can be used by threat actors, and how Trend protects customers from this specific vulnerability.

Read more

CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day

Credit to Author: Peter Girnus| Date: Tue, 13 Feb 2024 00:00:00 +0000

The APT group Water Hydra has been exploiting the zero-day Microsoft Defender SmartScreen vulnerability (CVE-2024-21412) in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day Initiative.

Read more

Unveiling Atlassian Confluence Vulnerability CVE-2023-22527: Understanding and Mitigating Remote Code Execution Risks

Credit to Author: Jagir Shastri| Date: Wed, 07 Feb 2024 00:00:00 +0000

In this blog entry, we discuss CVE-2023-22527, a vulnerability in Atlassian Confluence that has a CVSS score of 10 and could allow threat actors to perform remote code execution.

Read more

Unifying Cloud Security Beyond Siloes

Credit to Author: Alifiya Sadikali| Date: Tue, 06 Feb 2024 00:00:00 +0000

Attacks don’t stay in siloes, and neither should your security solutions. Explore the benefits of a cybersecurity platform that consolidates security across multiple layers—including the cloud—for more proactive risk management.

Read more

Pawn Storm Uses Brute Force and Stealth Against High-Value Targets

Credit to Author: Feike Hacquebord| Date: Wed, 31 Jan 2024 00:00:00 +0000

Based on our estimates, from approximately April 2022 until November 2023, Pawn Storm attempted to launch NTLMv2 hash relay attacks through different methods, with huge peaks in the number of targets and variations in the government departments that it targeted.

Read more

CVE-2023-36025 Exploited for Defense Evasion in Phemedrone Stealer Campaign

Credit to Author: Peter Girnus| Date: Fri, 12 Jan 2024 00:00:00 +0000

This blog delves into the Phemedrone Stealer campaign’s exploitation of CVE-2023-36025, the Windows Defender SmartScreen Bypass vulnerability, for its defense evasion and investigates the malware’s payload.

Read more

Opening Critical Infrastructure: The Current State of Open RAN Security

Credit to Author: Salim S.I.| Date: Fri, 01 Dec 2023 00:00:00 +0000

The Open Radio Access Network (ORAN) architecture provides standardized interfaces and protocols to previously closed systems. However, our research on ORAN demonstrates the potential threat posed by malicious xApps that are capable of compromising the entire Ran Intelligent Controller (RIC) subsystem.

Read more

CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits

Credit to Author: Peter Girnus| Date: Mon, 20 Nov 2023 00:00:00 +0000

We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.

Read more

Cerber Ransomware Exploits Atlassian Confluence Vulnerability CVE-2023-22518

Credit to Author: Sophia Nilette Robles| Date: Fri, 10 Nov 2023 00:00:00 +0000

We encountered the Cerber ransomware exploiting the Atlassian Confluence vulnerability CVE-2023-22518 in its operations.

Read more