Threat Intelligence

Researchers detected the vulnerability CVE-2021-40444 that targets a remote code execution flaw in MSHTML used to render web content inside Office documents

CloudSEK DRP discovered a threat actor claiming to have compromised Uber, the American mobility service provider. To demonstrate the legitimacy of the claims, the actor has posted unauthorized messages on the HackerOne page of the company.

CloudSEK Threat Intelligence Advisory on KashmirBlack, infects sites that use outdated software, exploits CVE-2017-9841 in CMS platforms.

CloudSEK Threat Intelligence Advisory on Joker malware, masquerades as legitimate mobile apps on Google Play store infecting Android devices.

RCE vulnerability targeting MS Exchange servers that enable attackers to compromise Internet-facing instances. The zero-day vulnerability is being actively exploited by threat actors to target Windows users.

CloudSEK Threat Intelligence Advisory on Ttint IoT botnet, a Mirai variant, targeting Tenda AC15 AC1900 routers, exploiting CVE-2020-10987.

There is a Critical VMWare zero-day command injection with escalated privileges, affecting six product lines, there is no vendor patch yet.

An RCE vulnerability in Zimbra webmail servers being actively exploited to target multiple organizations worldwide. The exploit was used to launch a spear phishing campaign against Europe.