November 15, 2024 at 02:40PM A malware botnet is exploiting a critical zero-day vulnerability (CVE-2024-11120) in unsupported GeoVision devices for potential DDoS and cryptomining attacks. Approximately 17,000 devices are at risk, primarily in the U.S. Signs of compromise include overheating and slow performance. Replacement with supported models is advised. **Meeting Takeaways:** 1. **Vulnerability Overview**: – … Read more
November 7, 2024 at 02:48PM Thousands of users, particularly of applications like AutoCAD and Foxit PDF editor, have fallen victim to the “SteelFox” malware campaign, active since February 2023. This sophisticated malware, distributed through illegal torrents, uses advanced encryption for stealthy data theft and cryptomining, affecting over 11,000 individuals across multiple countries. ### Meeting Notes … Read more
October 30, 2024 at 03:44AM Trend Micro researchers identified an attacker exploiting the CVE-2023-22527 vulnerability in Atlassian Confluence to execute remote code for cryptomining via the Titan Network. The attacker performed reconnaissance, installed Titan binaries on compromised machines, and connected them to the Cassini Testnet, aiming for financial gain through delegated proof of stake rewards. … Read more
October 22, 2024 at 10:30AM Trend Micro reports attacks on Docker remote API servers, deploying SRBMiner to mine XRP cryptocurrency. Attackers use the gRPC protocol over h2c to bypass security measures. They probe for public Docker APIs, upgrade connections, and execute malicious commands. Users are advised to enhance security measures to prevent unauthorized access. **Meeting … Read more
October 22, 2024 at 05:46AM Trend Micro researchers report a cyberattack targeting Docker remote API servers to deploy the SRBMiner cryptominer for mining XRP cryptocurrency. The attacker exploited the gRPC protocol over h2c to bypass security measures, checked Docker API availability, and deployed the miner, emphasizing the need for improved security configurations in Docker environments. … Read more
October 3, 2024 at 11:01AM A potent and elusive Linux malware, “perfctl,” has been wreaking havoc worldwide for years, targeting millions of servers and compromising thousands. It utilizes a plethora of exploits to gain initial access, and its ambitions expand beyond cryptomining and proxyjacking. Recommendations for mitigating this threat include patching vulnerabilities, restricting file execution, … Read more
October 3, 2024 at 10:39AM Summary: The Linux malware “perfctl” has evaded detection for at least three years, targeting servers for cryptomining purposes. It exploits misconfigurations and known vulnerabilities to gain initial access, deploys rootkits for evasion, and communicates with threat actors over TOR. Aqua Nautilus offers detection and mitigation strategies to combat perfctl’s activities. … Read more
September 12, 2024 at 09:36AM Bad actors target Internet-exposed Selenium Grid instances for illicit cryptocurrency mining and proxyjacking. The lack of authentication makes these instances vulnerable. Threat actors exploit this to carry out malicious actions, including deploying crypto miners and proxyware solutions EarnFM and IPRoyal Pawn. Organizations are urged to configure authentication to prevent abuse. … Read more
September 12, 2024 at 06:09AM Threat actors are targeting Internet-exposed Selenium Grid servers for cryptomining, proxyjacking, and potentially more malicious activities. With thousands of exposed servers, hackers have been deploying automated malware to hijack them. Furthermore, the lack of authentication and outdated versions of Selenium Grid servers pose a significant security risk. Improperly secured servers … Read more
August 22, 2024 at 11:51AM Log4j zero-day exploits continue to be a threat despite being discovered two years ago. Cybercriminals are still targeting unpatched corporate systems, deploying malware scripts and crypto-currency miners. Nation-state actors have incorporated Log4j exploits into their toolkits, and eradicating the issue is challenging due to software dependencies. Datadog Security Labs recently … Read more