Today’s roundup
Zero-Day Vulnerability Found in Atlassian Confluence Data Center and Server
Major Phishing Campaign Targets Financial Institutions Worldwide
New Ransomware Group "BlackSuit" Emerges, Targets Healthcare Sector
Supply Chain Attack Compromises Popular Open-Source Library
Data Breach Exposes Millions of Customer Records at TechGiant Inc.
CISA Warns of Critical Vulnerabilities in Apache ActiveMQ
Microsoft Releases Emergency Out-of-Band Patch for Exchange Server Zero-Day
Iranian-Backed APT Group Targets Critical Infrastructure in Middle East
New Follina-like Vulnerability Discovered in Windows MSHTML
Summary
Atlassian disclosed a critical, actively exploited unauthenticated RCE zero-day (CVE-2023-22527) in Confluence Data Center and Server. Workarounds are available as patches are not yet released.
A sophisticated, potentially state-sponsored phishing campaign is targeting global financial institutions. Attackers use customized spear-phishing emails to deliver new banking Trojan variants.
"BlackSuit," a new ransomware group, has emerged, primarily targeting healthcare organizations with a double-extortion model. Its TTPs show similarities to the defunct Royal ransomware, suggesting a possible rebrand.
A supply chain attack compromised "SafeCode-JS," a popular open-source library. Malicious code injected into a dependency enables data theft from applications. Developers must update immediately.
TechGiant Inc. reported a data breach affecting over 50 million customer records, including names, emails, and encrypted passwords. The breach is attributed to a misconfigured cloud database.
CISA warns of critical RCE vulnerabilities (CVE-2023-46604) in Apache ActiveMQ, with public PoC exploits and active exploitation detected. Organizations are urged to update without delay.
Microsoft released an emergency out-of-band patch for a critical Exchange Server zero-day (CVE-2023-XXXXX) allowing privilege escalation. The flaw is actively exploited in targeted attacks; immediate patching is required.
An Iranian-backed APT group, "Charming Kitten" (APT35), is targeting critical infrastructure in the Middle East. The group employs custom malware and sophisticated spear-phishing for access and persistence.
A new "Follina-like" vulnerability (CVE-2023-YYYYY) was found in Windows MSHTML, allowing RCE via crafted Office documents. While not yet exploited, it presents a significant risk, and Microsoft is developing a patch.
Want to dig deeper?
Cyber Groups
| Magic Hound | TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35, Mint Sandstorm |
Malware Families