Threat Bounty Content Acceptance Since the launch of the Threat Bounty Program, SOC Prime has been providing skilled and enthusiastic detection engineers to align their skills with the actual and real-time demand for threat detection content. During the year 2023, we continued to align the efforts of the Threat Bounty members with the Platform evolution, […]
Hot on the heels of the critical CVE-2024-0204 vulnerability disclosure in Fortra’s GoAnywhere MFT software, another critical flaw arrests the attention of cyber defenders. Recently, Jenkins developers have addressed nine security bugs affecting the open-source automation server, including a critical vulnerability tracked as CVE-2024-23897 that can lead to RCE upon its successful exploitation. With PoCs […]
Advancing Our Shared Understanding of Adversary TTPs and Empowering Defenders Boston, MA—SOC Prime, provider of the world’s largest and most advanced platform for collective cyber defense, today announced it has become the MITRE ATT&CK® Benefactor, supporting the evolution of the ATT&CK framework to empower research into emerging threats and promote knowledge sharing on a global […]
Another day, another critical vulnerability on the radar. This time, it’s a critical authentication bypass (CVE-2024-0204) affecting Fortra’s GoAnywhere MFT software, which is largely used by enterprises globally for secure file transfer purposes. Hot on the heels of the nefarious flaw in Atlassian’s Confluence Server and Data Center, CVE-2024-0204 might be promptly added to the […]
Adversaries carry out high-profile in-the-wild attacks by weaponizing RCE vulnerabilities impacting Atlassian Confluence servers. A newly uncovered RCE vulnerability in the Confluence Data Center and Confluence Server has been observed under active exploitation just a few days after its discovery. The critical flaw tracked as CVE-2023-22527 with the highest possible CVSS score of 10.0 affects […]
Just slightly over a week after the UAC-0050 group’s attack against Ukraine leveraging Remcos RAT, Quasar RAT, and Remote Utilities, adversaries reemerge in the cyber threat arena. CERT-UA has recently notified defenders of the ongoing group’s campaign involving mass email distribution and masquerading the senders as State Service of Special Communications and Information Protection of […]
Critical zero-day vulnerabilities impacting external-facing systems pose severe threats to multiple organizations that rely on them, exposing them to risks of RCE and system compromise, just like the active exploitation of the FortiOS SSL-VPN flaw caused havoc in January 2023. Recently, Chinese state-sponsored hacking groups have been observed exploiting two zero-day vulnerabilities tracked as CVE-2023-46805 […]
At the end of 2023, the nefarious UAC-0050 group loomed in the cyber threat arena, targeting Ukraine using Remcos RAT, a common malware from the group’s offensive toolkit. In the first decade of January 2024, UAC-0050 reemerges to strike again, exploiting Remcos RAT, Quasar RAT, and Remote Utilities. UAC-0050 Offensive Activity Overview Based on the […]
Recent cybersec reports unveil a series of attacks in which hackers take advantage of YouTube channels to spread the Lumma malware variant. Lumma malicious strain designed for stealing sensitive data has been in the limelight since 2022, actively promoted by adversaries on hacking websites and continuously undergoing multiple updates and enhancements. This blog article gains […]
Hard on the heels of the phishing campaign against Ukraine spreading Remcos RAT, another offensive operation relying on a similar adversary toolkit comes to the scene. At the end of December 2023, Trendmicro researchers reported CERT-UA about suspicious military-related files sent through a series of new phishing attacks against Ukraine. The uncovered malicious activity aimed […]