CATEGORIES

Adversary Intelligence

Articles in Blog Posts

September 17, 2024

Negotiation fails: Threat actor leaks 440 GB of data from Fortinet’s Sharepoint

On 12 September 2024, CloudSEK's XVigil platform discovered a threat actor named “Fortibitch” leaking 440GB of data allegedly exfiltrated from Fortinet's SharePoint repository. The actor attempted to extort the company but, after unsuccessful negotiations, released the data. It remains unclear if ransomware was used in the breach, as it was not mentioned by the actor. "Fortibitch" referenced the Ukrainian hacking group DC8044, though no direct connection is established between them. Based on available information, it is believed with medium confidence that the threat actor is based in Ukraine.

Written by

CloudSEK TRIAD

September 16, 2024

Navigating the Cyber Threat Landscape: A Comprehensive Report on Recent Attacks and Vulnerabilities in Mexico

Mexico has seen a surge in cyberattacks, with hacktivist groups targeting finance, government, and education. Key threats include data breaches and protests, along with illegal firearm sales online. Strengthening cybersecurity is crucial to protect sensitive data and maintain stability.

Written by

CloudSEK TRIAD

September 7, 2024

Guarding the Green and Yellow: Cyber Threats and Insights for Brazil's Independence Day

The report highlights a surge in cyberattacks in Brazil ahead of Independence Day, with defacement attacks targeting government websites and critical sectors like Finance and Gambling. Team R70 is identified as the most active threat group. The report urges stronger cybersecurity measures to protect against these threats.

Written by

CloudSEK TRIAD

September 3, 2024

Securing Labor Day: Navigating the Rising Tide of Phishing Scams and Fraudulent Job Offers

Phishing scams and fake job offers have risen with the growth of remote work and economic uncertainty. Cybercriminals use deceptive emails and social engineering to target job seekers. This blog highlights the methods, impacts, and the urgent need for strong cybersecurity measures to combat these threats.

Written by

CloudSEK TRIAD

August 23, 2024

Cyber Shadows Over Ukraine: An Independence Day Perspective

The article "Cyber Shadows Over Ukraine" highlights the increased cyber threats Ukraine faces around its Independence Day, particularly from groups like NoName and the Russian Cyber Army. These attacks, primarily targeting government and critical infrastructure, underscore the need for Ukraine to bolster its cybersecurity defenses to ensure the safety and resilience of its national systems during this vulnerable period

Written by

CloudSEK TRIAD

August 9, 2024

Cybersecurity in Focus: Recent Threats Targeting Singapore Amid National Day Celebrations

The report "Cybersecurity in Focus: Recent Threats Targeting Singapore Amid National Day Celebrations" highlights the escalating cyber threats faced by Singapore in recent months. These include a surge in ransomware attacks impacting over 30 victims across 15 industry sectors, with notable breaches involving Singapore's Ministry of Finance and Moneylenders Credit Bureau. Hacktivist groups have also intensified their activities, leading to significant data breaches, including the sale of personal data of Singaporean citizens on underground forums. The report emphasizes the urgent need for enhanced cybersecurity measures to protect sensitive information and mitigate the growing risks.

Written by

CloudSEK TRIAD

Articles in Threat Intelligence

November 15, 2023

Critical CSRF Vulnerability in IBM CICS TX - CVE-2023-42027 Demands Immediate Action

CVE-2023-42027 IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multi platforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts

November 6, 2023

CVE-2023-43792 baserCMS is a website development framework vulnerable to Code Injection attacks

CVE-2023-43792 is a code injection vulnerability in the mail form of baserCMS versions 4.6.0 to 4.7.6. This vulnerability allows an attacker to inject arbitrary code into the baserCMS application, which could then be executed by other users of the application.

November 6, 2023

CVE-2023-4197 Vulnerability in Dolibarr ERP CRM 18.0.1 Allows PHP Code Injection

CVE-2023-4197 Improper input validation in Dolibarr ERP CRM v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code

September 8, 2023

Hoze shell script dropped along with XMRig miners on misconfigured SSH Servers by Brute Forcing

CloudSEK’s Threat Intelligence Team uncovered a campaign, actively running from the past 1.8 years, that attacks and brute forces the SSH. 

September 4, 2023

3,20,000+ Patient Records From Ayush Jharkhand Gov. In Shared On Dark Web Hacking Forums

A hacker known as Tanaka has exposed over 320,000 patient records from ayush.jharkhand.gov.in, detailing personal and medical information. The 7.3 MB database leak includes sensitive data from the AYUSH ministry's site

August 28, 2023

Rogue Scripts Are Exploiting OTP Verification APIs To Send Heaps of OTP SMSes, Hold The Potential Of Triggering Service Disruptions.

Discover how CloudSEK's AI-powered XVigil platform identified concerning GitHub repositories mentioning Indian companies and their APIs.

Join 10,000+ subscribers

Keep up with the latest news about strains of Malware, Phishing Lures,
Indicators of Compromise, and Data Leaks.