» Threat Intelligence Blog

Summary Several security vulnerabilities in the industrial remote access solution Ewon Cosy+ can be abused to gain root privileges to the devices and stage follow-on attacks, according to new data unveiled at DEF CON 32. The elevated access could then be weaponized to decrypt encrypted firmware files and encrypted data such as passwords in configuration files, and even get…

The recent discovery of a website supply chain attack using the cdn.polyfill[.]io domain has left many websites vulnerable to malicious code injection. Once a trusted resource for adding JavaScript polyfills to websites, the domain has recently become the epicenter of a significant website supply chain attack. How the Attack Unfolded Funnull, a Chinese company, acquired…

Context On 7 August 2024, Symantec researchers published the technical details of multiple cyberespionage campaigns leveraging legitimate cloud services to deliver new malware to multiple organizations, several government or military and one media firm. One such new malware, the backdoor designated GoGra, has been observed delivering to a media organization located in South Asia. Technical…

Summary Researchers from Proofpoint have released a report warning of threat actors increasingly abusing the Cloudflare Tunnel service in malware campaigns that usually deliver remote access trojans (RATs). First observed in February 2024, the cluster increased activity in May through July, with most campaigns leading to Xworm, a remote access trojan (RAT), in recent months. Community Impact…

Summary Microsoft researchers have uncovered a vulnerability in VMware ESXi hypervisors being exploited by several ransomware operators to obtain full administrative permissions on affected systems. Ransomware groups like Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have exploited this flaw, designated CVE-2024-37085, deploying ransomware such as Akira and Black Basta. The issue was disclosed to VMware, which released a security update. RH-ISAC Members who utilize VMware products in…