Category: Security News

Microsoft Confirms Exploitation of New Exchange Zero-Day Flaw

مدیر

Microsoft has officially disclosed that it is investigating two zero-day security vulnerabilities affecting Exchange Server 2013, 1016, and 2019 after reports of exploits in the wild. The first vulnerability, CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second vulnerability, CVE-2022-41082, allows when PowerShell to be available to an attacker, the tech giant said. Enables remote code execution (RCE). The company also confirmed that it is aware of “limited targeted attacks” that weaponize flaws to gain basic access to targeted systems, but stressed that authentication access to the vulnerable…

Read More

The impact of several high-severity flaws on the widely used OpenLiteSpeed web server software

مدیر

Several high-severity flaws have been discovered in the open-source OpenLiteSpeed web server, as well as its enterprise variant, which could be used for remote code execution. OpenLiteSpeed is the open-source version of LiteSpeed Web Server, the sixth most popular web server with 1.9 million unique servers worldwide. The first of the three flaws is a directory traversal flaw (CVE-2022-0072, CVSS score: 5.8), which can be exploited to access forbidden files in the main web directory. The remaining two vulnerabilities (CVE-2022-0073 and CVE-2022-0074, CVSS scores: 8.8) are related to an elevation…

Read More

Converting Cryptonite Open-Source Ransomware to Random Cleaner Malware

مدیر

A version of an open-source ransomware toolkit called Kryptonite has been spotted in the wild with wiping capabilities due to its “poor architecture and programming.” Unlike other ransomware variants, Kryptonite is not available to cybercriminal underground markets and was instead offered for free by an actor named CYBERDEVILZ through a GitHub repository until recently. The source code and its sub-branches have since been removed. Written in Python, this malware uses the Fernet module from the cryptographic package to encrypt files with the “.cryptn8” extension. But a new sample analyzed by…

Read More

Converting Cryptonite Open Source Ransomware to Random Cleaner Malware

مدیر

A version of an open-source ransomware toolkit called Kryptonite has been spotted in the wild with wiping capabilities due to its “poor architecture and programming.” Unlike other ransomware variants, Kryptonite is not available to cybercriminal underground markets and was instead offered for free by an actor named CYBERDEVILZ through a GitHub repository until recently. The source code and its sub-branches have since been removed.   Written in Python, this malware uses the Fernet module from the crypto package to encrypt files with the “.cryptn8” extension. But a new sample analyzed…

Read More

The impact of several high-severity flaws on the widely used OpenLiteSpeed web server software

مدیر

Several high-severity flaws have been discovered in the open-source OpenLiteSpeed web server, as well as its enterprise variant, which could be used for remote code execution. “By chaining and exploiting the vulnerabilities, adversaries could compromise a web server and achieve fully privileged remote code execution,” 42 said in a report Thursday. OpenLiteSpeed is the open source version of LiteSpeed Web Server, the sixth most popular web server with 1.9 million unique servers worldwide.   The first of the three flaws is a directory traversal flaw (CVE-2022-0072, CVSS score: 5.8), which…

Read More

Microsoft Confirms Exploitation of New Exchange Zero-Day Flaw in the Wild

مدیر

Microsoft has officially disclosed that it is investigating two zero-day security vulnerabilities affecting Exchange Server 2013, 1016 and 2019 after reports of exploitation in the wild. The first vulnerability, CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second vulnerability, CVE-2022-41082, allows when Powershell is available to an attacker, the tech giant said. Enables remote code execution (RCE). The company also confirmed that it is aware of “limited targeted attacks” that weaponize flaws to gain basic access to targeted systems, but stressed that authentication access to the vulnerable Exchange…

Read More

Researchers attribute Linux-based Cheetscrypt ransomware to Chinese hackers

مدیر

A recently discovered Linux-based ransomware known as Cheerscrypt has been released as the handiwork of a Chinese cyber-espionage group known for executing short-lived ransomware schemes. Emperor Dragonfly uses open source tools written by Chinese developers for Chinese users, the company said in a report shared with The Hacker News. This confirms the claim that the users of Emperor Dragonfly ransomware are located in China. The use of Cheerscrypt is the latest addition to a long list of ransomware families already used by the group in just over a year, including…

Read More

New Malware Families Targeting VMware ESXi Hypervisors

مدیر

According to reports, after taking over systems, attackers use previously unseen implants in VMware virtualization software to take control of infected systems and evade detection. Google’s Mandiant threat intelligence department describes it as a “new malware ecosystem” that affects VMware ESXi, Linux vCenter servers, and Windows virtual machines, allowing attackers to gain permanent access to the hypervisor and execute arbitrary commands. to be According to the cybersecurity vendor, the Hyperjacking attacks involved using vSphere malicious installation packages (VIBs) to secretly infiltrate two implants, called VIRTUALPITA and VIRTUALPIE, on the ESXi…

Read More

Borat RAT Unique triple threat

مدیر

A dashboard for malicious hackers to perform RAT malware activities, creating and compiling malware binaries to launch DDoS attacks on the victim’s system. The RAT also contains code to launch a DDoS attack, which slows down the response service to legitimate users and can even cause the site to go offline. It is important to note that Borat RAT can deliver a ransomware to the victim’s device and thereby encrypt users’ files and collect ransom. The package also contains a key logger executable that monitors keystrokes on victim computers and…

Read More

Researchers warn of widespread exploitation of Zimbra RCE vulnerability

مدیر

The US Cybersecurity and Infrastructure Security (CIS) agency on Thursday added two flaws to its catalog of known vulnerabilities, citing evidence of active exploitation. These two high-severity issues are related to weaknesses in Zimbra’s communication mechanism, both of which can be chained to achieve unauthenticated remote code execution on vulnerable email servers. CVE-2022-27925: (CVSS score: 7.2) CVE-2022-37042: In short, the attacks involve exploiting the authentication bypass flaw to achieve remote code execution on the main server by uploading arbitrary files. Also, more than 1,000 cases have been identified around the…

Read More