CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits

We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.

https://www.trendmicro.com/en_us/research/23/k/cve-2023-46604-exploited-by-kinsing.html


🎖@malwr

Aggressive Malign Influence Threatens to Shape US 2024 Elections

Russia, China, Iran, domestic violent extremists (DVEs), and hacktivist groups will very likely conduct influence operations at varying levels of magnitude and sophistication to shape or disrupt the United States (US) 2024 elections in pursuit of strategic geopolitical goals.

https://www.recordedfuture.com/aggressive-malign-influence-threatens-us-2024-elections


🎖@malwr

OilRig’s persistent attacks using cloud service-powered downloaders

ESET researchers document a series of new OilRig downloaders, all relying on legitimate cloud service providers for C&C communications

https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/


🎖@malwr

Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit

In this blog entry, we discuss the technical details of CVE-2023-50164, a critical vulnerability that affects Apache Struts 2 and enables unauthorized path traversal.

https://www.trendmicro.com/en_us/research/23/l/decoding-cve-2023-50164--unveiling-the-apache-struts-file-upload.html


🎖@malwr

Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity

This report is a little different than our typical content. We were able to analyze data from a perspective we typically don’t get to see… a threat actor’s host! In …

https://thedfirreport.com/2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity/


🎖@malwr

Year in Malware 2023: Recapping the major cybersecurity stories of the past year

Relive Talos' top stories from the past year as we recap the top malware and other threats that came our way.

https://blog.talosintelligence.com/year-in-malware-2023-timeline/


🎖@malwr

Azure Serial Console Attack and Defense - Part 2

This is the second installment of the Azure Serial Console blog, which provides insights to improve defenders’ preparedness when investigating Azure Serial Console activity on Azure Linux virtual machines. While the first blog post discussed various tracing activities, such as using Azure activity and Sysmon logs on Windows virtual machines to trace serial console activity, this blog outlines how to enable logging for Azure Linux virtual machines using Sysmon for Linux to capture and how to send these events to a log analytics workspace.

https://msrc.microsoft.com/blog/2023/12/azure-serial-console-attack-and-defense-part-2/


🎖@malwr

ESET Threat Report H2 2023

A view of the H2 2023 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts

https://www.welivesecurity.com/en/eset-research/eset-threat-report-h2-2023/


🎖@malwr

Operation HamsaUpdate: A Sophisticated Campaign Delivering Wipers Puts Israeli Infrastructure at Risk

On December 19th, the Israel National Cyber Directorate released an urgent alert warning regarding a phishing campaign actively targeting Israeli customers using F5’s network devices. We’ve labeled this campaign Operation HamsaUpdate. It features the deployment of a newly developed wiper malware that targets both Windows and Linux servers. The campaign leverages a convincingly written email...

https://intezer.com/blog/research/stealth-wiper-israeli-infrastructure/


🎖@malwr