Security Affairs newsletter Round 460 by Pierluigi Paganini – INTERNATIONAL EDITION
Security Affairs
FEBRUARY 25, 2024
Iran Crisis Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign U.S.
2024 Authentication Government Military 
105 
Threat actors exploit Ivanti VPN bugs to deploy KrustyLoader Malware
Security Affairs
JANUARY 31, 2024
In early January 2024, software firm Ivanti reported that threat actors were exploiting two zero-day vulnerabilities ( CVE-2023-46805, CVE-2024-21887 ) in Connect Secure (ICS) and Policy Secure to remotely execute arbitrary commands on targeted gateways. The second flaw, tracked as CVE-2024-21887 (CVSS score 9.1)
Join 55,000+
Insiders
Sign Up for our Newsletter
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Trending Sources
China-linked APT Volt Typhoon exploited a zero-day in Versa Director
Security Affairs
AUGUST 27, 2024
China-linked APT Volt Typhoon exploited a zero-day vulnerability, tracked as CVE-2024-39717 , in Versa Director, to deploy a custom webshell on breached networks. Exploitation requires successful authentication by a user with the necessary privileges. Versa Director servers between June 12 and mid-July 2024.
North Korea-linked hackers target construction and machinery sectors with watering hole and supply chain attacks
Security Affairs
AUGUST 6, 2024
According to the South Korean authorities, the government of Pyongyang’s goal is to steal intellectual property and trade secrets from the South. In January 2024, the Kimsuky APT group was spotted distributing malware through the website of a construction industry association in South Korea.
Experts warn of mass exploitation of Ivanti Connect Secure VPN flaws
Security Affairs
JANUARY 16, 2024
Last week, software firm Ivanti reported that threat actors are exploiting two zero-day vulnerabilities (CVE-2023-46805, CVE-2024-21887) in Connect Secure (ICS) and Policy Secure to remotely execute arbitrary commands on targeted gateways. is an Authentication Bypass issue that resides in the web component of Ivanti ICS 9.x,
Russia-linked APT28 compromised Ubiquiti EdgeRouters to facilitate cyber operations
Security Affairs
FEBRUARY 28, 2024
. “As early as 2022, APT28 actors had utilized compromised EdgeRouters to facilitate covert cyber operations against governments, militaries, and organizations around the world.” and foreign governments and military, security, and corporate organizations. ” reads the joint report.
North Korea-linked APT37 exploited IE zero-day in a recent attack
Security Affairs
OCTOBER 19, 2024
A North Korea-linked threat actor, tracked as APT37 (also known as RedEyes, TA-RedAnt, Reaper, ScarCruft , Group123 ), exploited a recent Internet Explorer zero-day vulnerability, tracked as CVE-2024-38178 (CVSS score 7.5), in a supply chain attack. ” reads the advisory published by Microsoft, which addressed the flaw in August.
Let's personalize your content