Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit

In this blog entry, we discuss the technical details of CVE-2023-50164, a critical vulnerability that affects Apache Struts 2 and enables unauthorized path traversal.

https://www.trendmicro.com/en_us/research/23/l/decoding-cve-2023-50164--unveiling-the-apache-struts-file-upload.html


🎖@malwr

Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity

This report is a little different than our typical content. We were able to analyze data from a perspective we typically don’t get to see… a threat actor’s host! In …

https://thedfirreport.com/2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity/


🎖@malwr

Year in Malware 2023: Recapping the major cybersecurity stories of the past year

Relive Talos' top stories from the past year as we recap the top malware and other threats that came our way.

https://blog.talosintelligence.com/year-in-malware-2023-timeline/


🎖@malwr

Azure Serial Console Attack and Defense - Part 2

This is the second installment of the Azure Serial Console blog, which provides insights to improve defenders’ preparedness when investigating Azure Serial Console activity on Azure Linux virtual machines. While the first blog post discussed various tracing activities, such as using Azure activity and Sysmon logs on Windows virtual machines to trace serial console activity, this blog outlines how to enable logging for Azure Linux virtual machines using Sysmon for Linux to capture and how to send these events to a log analytics workspace.

https://msrc.microsoft.com/blog/2023/12/azure-serial-console-attack-and-defense-part-2/


🎖@malwr

ESET Threat Report H2 2023

A view of the H2 2023 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts

https://www.welivesecurity.com/en/eset-research/eset-threat-report-h2-2023/


🎖@malwr

Operation HamsaUpdate: A Sophisticated Campaign Delivering Wipers Puts Israeli Infrastructure at Risk

On December 19th, the Israel National Cyber Directorate released an urgent alert warning regarding a phishing campaign actively targeting Israeli customers using F5’s network devices. We’ve labeled this campaign Operation HamsaUpdate. It features the deployment of a newly developed wiper malware that targets both Windows and Linux servers. The campaign leverages a convincingly written email...

https://intezer.com/blog/research/stealth-wiper-israeli-infrastructure/


🎖@malwr

Annual Payment Fraud Intelligence Report: 2023

2023's payment fraud trends predict a persistent underground market and evolving sophisticated cyber-fraud threats in 2024.

https://www.recordedfuture.com/annual-payment-fraud-intelligence-report-2023


🎖@malwr

Intellexa and Cytrox: From fixer-upper to Intel Agency-grade spyware

Talos revealed that rebooting an iOS or Android device may not remove the Predator spyware produced by Intellexa. Intellexa knows if their customers intend to perform surveillance operations on foreign soil.

https://blog.talosintelligence.com/intellexa-and-cytrox-intel-agency-grade-spyware/


🎖@malwr