Threat Intelligence

CloudSEK Threat Intelligence Advisory on Cerberus Android banking Trojan, source code for which is released on underground forums for free.

CloudSEK threat intelligence advisory on Xanthe cryptomining botnet that targets Linux systems, compromises misconfigured Docker server APIs.

CloudSEK threat intelligence advisory on Anubis Android banking trojan that lures its victims through malicious applications.

CloudSEK reviews the increase in threat actors targeting websites built on Magento, trying to sell administrative level access to such shops.

A new critical authentication bypass vulnerability affecting the web admin console for FortiOS and FortiProxy. Threat actors can easily exploit the vulnerability with a crafted HTTP request.

Category: Vulnerability Intelligence Vulnerability Class: Access of Resource Using Incompatible Type CVE ID: CVE-2022-1096 CVSS:3.0 Score: 9.1 Executive Summary CloudSEK’s Threat Research Team has discovered a breach affecting ~0.5 million users due to an active zero-day vulnerability being exploited in the wild by the RedLine stealer malware. The zero-day vulnerability exploits all the chromium-based […]

A post on a cybercrime forum is advertising the sale of access from multiple regions including the UK, Canada, US, and Brazil.

A post on a TOR-based private cybercrime dark web forum is advertising the source code of an advanced FUD ransomware, dubbed M3rcury.