Over the past few weeks, there has been a significant increase in reported activity associated with Iranian state-sponsored or state-affiliated cyber threat groups. One of these cyber threat actors was observed targeting US and foreign organizations in various sectors.
Voldemort, a recently discovered backdoor, is spreading through a malware campaign that impersonates tax agencies. Beginning on August 5, the campaign sent over 20,000 messages to over 70 organizations worldwide. The daily malicious message count continues to rise.
The Cybersecurity and Infrastructure Security Agency recently co-authored a joint cybersecurity advisory regarding the RansomHub ransomware group. Since it was first observed in February, RansomHub has become one of the most prolific ransomware threats.
Incident reports indicating that a new version of the well-known sextortion email scam is currently circulating. This version now includes a photo of the recipient's home, likely found via online mapping applications. The targeted individual's home address could have been easily obtained.
Analysts recently discovered at least one Advanced Persistent Threat (APT) actor actively exploiting CVE-2024-39717. The vulnerability impacts Versa’s Director GUI platform, which potentially allows malicious files to be uploaded by users with Provider-Data-Center-Admin and more.
The education sector is a primary focus for threat actors, ranking among the most vulnerable sectors globally. This susceptibility stems from the vast collection of valuable data, a general deficit in cybersecurity awareness, and extensive, prevalent vulnerabilities.
The NJCCIC’s email security solution observed a recent surge in campaigns disseminating 404 Keylogger infostealing malware. Also known as SnakeKeylogger, is both a downloader and an information-stealing malware. This malware-as-a-service can steal credentials, etc.
This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. #StopRansomware advisories include information help organizations.
The FBI, CISA, and the Department of Defense Cyber Crime Center (DC3) released a Joint Cybersecurity Advisory to warn network defenders that, as of August 2024, a group of Iran- based cyber threat actors continues to exploit US and foreign organizations.
Multiple vulnerabilities have been discovered in SolarWinds Web Help Desk (WHD), the most severe of which could allow for remote code execution. Successful exploitation of the most severe vulnerability could allow for remote code execution in the context of the system.
