#CybersecurityAdvisory

Active Kubernetes RCE Attack Relies on Known OpenMetadata Vulns

by

April 17, 2024 at 03:31PM OpenMetadata’s open source metadata repository has been actively exploited since April, allowing threat actors to execute cyberattacks against unpatched Kubernetes clusters. Researchers identified five vulnerabilities affecting versions preceding v1.3.1. Cybercriminals are leveraging these vulnerabilities for cryptocurrency mining and may engage in further malicious activities. OpenMetadata administrators are urged to update … Read more

State-Sponsored Hackers Exploit Zero-Day to Backdoor Palo Alto Networks Firewalls

by

April 12, 2024 at 04:48PM A zero-day vulnerability (CVE-2024-3400) in Palo Alto Networks firewalls has been exploited by threat actor ‘UTA0218’ for over two weeks. The issue permits unauthorized execution of code with root privileges. Palo Alto is expected to release patches by April 14. Organizations are urged to take immediate mitigation steps and be … Read more

Critical Infrastructure Organizations Warned of Phobos Ransomware Attacks

by

March 1, 2024 at 08:57AM US government agencies issued a warning about ongoing Phobos ransomware attacks targeting critical infrastructure sectors. Operating since May 2019, Phobos employs a ransomware-as-a-service (RaaS) model, with tactics such as phishing emails, IP scanning, and use of remote access tools. Recommendations for mitigations and indicators of compromise are provided. From the … Read more

Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways

by

February 29, 2024 at 01:35PM The Cybersecurity and Infrastructure Security Agency (CISA) and its partners have issued a joint Cybersecurity Advisory to warn about cyber threat actors exploiting vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Threat actors can bypass authentication, craft malicious requests, and execute arbitrary commands with elevated privileges. Organizations are … Read more

#StopRansomware: Phobos Ransomware

by

February 29, 2024 at 10:42AM The joint Cybersecurity Advisory (CSA) highlights the Phobos ransomware threat, observed as recently as February 2024. It describes the ransomware’s tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and provides recommendations from the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information … Read more

North Korean hackers linked to defense sector supply-chain attack

by

February 19, 2024 at 03:26PM The BfV and NIS issued a joint advisory warning of cyber-espionage operations by North Korean actors targeting the global defense sector. The attacks focus on stealing military technology and utilizing tactics like supply-chain attacks and social engineering. The advisory provides detailed steps and recommends security measures such as limiting access, … Read more

FBI: Play ransomware breached 300 victims, including critical orgs

by

December 18, 2023 at 11:29AM The FBI, CISA, and ASD’s ACSC jointly warn that the Play ransomware gang has targeted approximately 300 organizations globally between June 2022 and October 2023, impacting critical infrastructure. The group employs unconventional tactics, including stealing sensitive data and using a custom VSS Copying Tool. Organizations are urged to address vulnerabilities … Read more

Hackers exploit MagicLine4NX zero-day in supply-chain attack

by

November 24, 2023 at 01:20PM The National Cyber Security Centre (NCSC) and Korea’s National Intelligence Service (NIS) have warned that the North Korean Lazarus hacking group has been breaching companies using a zero-day vulnerability in the MagicLine4NX software. The group primarily targets South Korean institutions and is known for utilizing supply-chain attacks and zero-day vulnerabilities … Read more

#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability

by

November 21, 2023 at 11:29AM This joint Cybersecurity Advisory (CSA) aims to provide network defenders with information about the LockBit 3.0 ransomware and its exploitation of the CVE-2023-4966 vulnerability affecting Citrix NetScaler web application delivery control (ADC) and NetScaler Gateway appliances. The CSA includes tactics, techniques, and indicators of compromise (IOCs) obtained from various organizations, … Read more