Netskope Report Details Exponential Increase in Microsoft Sway QR Code Phishing

Summary On 27 August 2024, Cybersecurity researchers from Netskope released a new report calling attention to a new QR code phishing, also known as quishing, campaign that leverages Microsoft Sway infrastructure to host fake pages, highlighting the abuse of legitimate cloud offerings for malicious purposes. In July 2024, Netskope Threat Labs tracked a 2,000-fold increase in traffic to…

Read More

FIN7 Found Hosting Malicious Domains Hosted on Tech Internal Infrastructure

Summary Team Cymru, Silent Push, and Stark Industries Solutions have released a report detailing a collaborative investigation between all three entities targeting the financial threat group, FIN7. Despite past disruptions, FIN7 remains active, employing a range of tactics to evade detection. Silent Push’s research identified a significant number of domains linked to FIN7, a portion of…

Read More

Researchers Exploit Vulnerabilities to Exploit Industrial Remote Access Gateways

Summary Several security vulnerabilities in the industrial remote access solution Ewon Cosy+ can be abused to gain root privileges to the devices and stage follow-on attacks, according to new data unveiled at DEF CON 32. The elevated access could then be weaponized to decrypt encrypted firmware files and encrypted data such as passwords in configuration files, and even get…

Read More

Polyfill Supply Chain Attack Highlights Risks of Third-party Code in Modern Web Applications

The recent discovery of a website supply chain attack using the cdn.polyfill[.]io domain has left many websites vulnerable to malicious code injection. Once a trusted resource for adding JavaScript polyfills to websites, the domain has recently become the epicenter of a significant website supply chain attack. How the Attack Unfolded Funnull, a Chinese company, acquired…

Read More

New GoGra Backdoor Deployed Against South Asia Media Organization via Cloud Services in Widespread Cyberespionage Operation

Context On 7 August 2024, Symantec researchers published the technical details of multiple cyberespionage campaigns leveraging legitimate cloud services to deliver new malware to multiple organizations, several government or military and one media firm. One such new malware, the backdoor designated GoGra, has been observed delivering to a media organization located in South Asia. Technical…

Read More