Threat Intelligence

CloudSEK threat intelligence advisory on MS Exchange RCE vulnerability, dubbed CVE-2020-16875, that allows attackers highest user privileges.

A post on a cybercrime forum is advertising Slycer Ransomware, a Python-based malware that encrypts files and sends its decryption key to the attacker

The severity of the newly identified vulnerability CVE-2022-1388 is present in the F5 BIG-IP. The vulnerability was identified by F5 internally and a patch was released but the difference in code allowed threat actors to make a working exploit for the CVE.

CloudSEK Threat Intel has detected a threat actor selling a list of systems on the Internet that are vulnerable to CVE-2018-13379 which is a Fortinet SSL VPN path traversal vulnerability.

CloudSEK Threat Intelligence Advisory on Conti ransomware: Human-operated and possible successor of Ryuk, with advanced capabilities.

CloudSEK Threat Intelligence Advisory on UNC1945, hacker group that utilizes critical flaw CVE-2020-14871 to compromise corporate networks

CloudSEK’s Threat Research team has analyzed the MS Office RCE 0day vulnerability that has been dubbed as Follina and has been given the CVE-2022-30190. The attack vector and the vulnerability very closely resembles CVE-2021-40444.

Andrastea threat actor group announced a data breach from MBDA, a European missile manufacturer having ties to NATO. Military sketches, documents underlying NATO’s requirements, and SOPs were exposed.