ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Pulse Secure

0 mentions in 7 days · 3 in 30 days · 4 total · first seen · last

Search everything

Timeline

DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims

DoJ corrected its statement to say US federal agencies were targets, not confirmed victims, of China-linked group QTFY's intrusions.

The US Department of Justice revised its press release to list NASA, the Federal Reserve, Department of Energy, DoJ, HHS, NIH and the US Senate as 'among the targets' of QTFY (aka QT AND QTCYBER), rather than victims. QTFY, active since 2018 and linked to Nanjing Xinjiuwei Network Technology Co with payments suggesting MSS sponsorship, operates the QScan vulnerability scanning platform and QTRouter obfuscation network, which underpin the Fast Labyrinth encrypted ORB relay network built from infected IoT devices and leased VPSs. The FBI seized qtproxy[.]xyz, qt-proxy[.]org and qt-team[.]com, disrupting QScan and QTRouter, while Lumen Black Lotus Labs reported the actor industrialized ORB networks for China-linked espionage. A 2019 NASA intrusion attempt exploited CVE-2019-11510, a critical Pulse Secure VPN flaw.

The Hacker News · 17d agoThreat actor in the wildCVE-2019-115101

Officials disrupt Chinese espionage operation that hit multiple federal agencies

FBI and DOJ seized QTFY infrastructure, disrupting a Chinese state-sponsored group that compromised federal agencies and critical infrastructure since 2018.

Authorities seized three domains powering QScan and QTRouter, the hacking suite of QTFY, a Chinese government-funded group operating through front company Nanjing Xinjiuwei Network Technology. Targets include the Departments of Energy, Justice, and Health and Human Services, the Federal Reserve, NASA, NIH, financial institutions, defense contractors, utilities, telecoms, and hospitals; the group exploited zero-days in Ivanti, Pulse Secure, Fortinet, Citrix, and others, intruding three DOE national labs in September 2024. QScan carried over 200 proof-of-concept exploits and processed more than two million scanning tasks in a single day in 2024.

CyberScoop · 21d agoThreat actor in the wild1

US takes down alleged Chinese hacking tools used against Federal Reserve, DOJ and Senate

DOJ takes down QScan and QTRouter Chinese obfuscation platforms used to breach Federal Reserve, DOE, DOJ, and Senate since 2018.

The DOJ and FBI seized domains hard-coded into QScan and QTRouter, platforms run by Nanjing Xinjiuwei Network Technology Company and used by China's Ministry of State Security and PLA. QScan automatically infected IoT devices worldwide which were absorbed into QTRouter, allowing attackers to disguise intrusions as originating from other countries or local sources. Victims included the Federal Reserve, Department of Energy, DOJ, US Senate, NASA, HHS, NIH, plus hospitals, telecoms, power companies, financial institutions, and defense contractors. The FBI investigated QTFY since 2018, tracing a 2019 NASA incident through Pulse Secure VPN exploitation.

The Record · 21d agoThreat actor in the wild

Threat Brief: Maze Ransomware

Unit 42 issued a threat brief on Maze ransomware, noting an uptick across industries and exploitation of Pulse VPN and IE flaws for initial access.

Palo Alto Networks detected an uptick in Maze ransomware samples across finance, healthcare, government, and other sectors. Maze, a variant of ChaCha ransomware first seen in May 2019, is distributed via weaponized Word/Excel attachments and the Spelevo exploit kit leveraging CVE-2018-15982 and CVE-2018-4878, and has used CVE-2019-11510 (Pulse VPN) and CVE-2018-8174 (Internet Explorer). Operators establish a foothold, escalate privileges, move laterally, and exfiltrate files before encryption for extortion leverage.

Palo Alto Unit 42 · Aug 17, 2026Ransomware in the wildCVE-2018-15982CVE-2018-4878CVE-2019-11510+1 CVEs

Related CVEs

  • CVE-2019-1151010.0100%
    Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
    Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known.
    · Ivanti Pulse Connect Secure KEV ransomware PoC ×2large
  • CVE-2018-48787.890%
    Use-After-Free RCE in Adobe Flash Player before 28.0.0.161
    CVE-2018-4878 is a use-after-free (CWE-416) in Adobe Flash Player before 28.0.0.161, caused by a dangling pointer in the Primetime SDK's media-player handling of listener objects. An attacker triggers it by persuading a user to open attacker-controlled Flash content — typically a malicious SWF delivered via email, Office documents, or malvertising/exploit kits — because the CVSS vector (AV:L, UI:R) requires local user interaction. Successful exploitation yields arbitrary code execution with the privileges of the user running Flash. Anyone running a vulnerable Flash Player was exposed, including Red Hat Enterprise Linux Desktop/Server/Workstation users running Red Hat's packaged Flash plugin. The flaw was exploited as a zero-day in January–February 2018 (documented by McAfee and distributed alongside the Fallout exploit kit), and it remains in CISA's KEV with known ransomware use.
    · adobe Flash Player all versions before 28.0.0.161 · redhat Enterprise Linux Desktop (flash-plugin) Flash Player component before 28.0.0.161 KEV ransomware PoC ×2mass
  • CVE-2018-159827.889%
    Use-After-Free in Adobe Flash Player Allows Arbitrary Code Execution
    CVE-2018-15982 is a use-after-free flaw (CWE-416) in Adobe Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier, in which Flash frees memory that is subsequently reused, corrupting process memory. It is triggered when Flash processes crafted Flash content, most notably embedded in Microsoft Office documents, requiring a user to open or view the malicious content (CVSS attack vector is local with user interaction required). Successful exploitation gives the attacker arbitrary code execution with the privileges of the user viewing the content. Affected users include anyone running the listed Flash Player versions, including the Flash Player Installer and the Adobe-supplied Flash plugin shipped with Red Hat Enterprise Linux Desktop, Server and Workstation. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15) with known ransomware use, a public exploit is available on Exploit-DB, and EPSS assigns a top-percentile 89.1% probability of exploitation within 30 days.
    · Adobe Flash Player 31.0.0.153 and earlier, and 31.0.0.108 and earlier · Adobe Flash Player Installer Same affected ranges as Flash Player (31.0.0.153 and earlier / 31.0.0.108 and earlier) KEV ransomware PoC mass
  • CVE-2018-81747.588%
    Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine
    CVE-2018-8174 is an out-of-bounds write (CWE-787) in the Microsoft Windows VBScript engine, caused by the way it handles objects in memory. An attacker triggers it by convincing a user to visit a specially crafted website or open crafted content that invokes the VBScript engine (for example via Internet Explorer or a document preview), requiring user interaction. Successful exploitation yields remote code execution with the privileges of the logged-on user, enabling program installation, data theft and account takeover. All listed Windows client and server releases are affected: Windows 7, 8.1, RT 8.1, Windows 10 (1607-1803), and Windows Server 2008/2008 R2, 2012/2012 R2, 2016. Exploitation is in the wild: the flaw was fixed in the May 2018 Patch Tuesday, is listed in CISA KEV with known ransomware use, and public PoCs (0patch, ExploitDB 44741) and exploit kit usage have been documented; EPSS puts its 30-day exploitation probability at 88.5%.
    · microsoft windows 10 1607, 1703, 1709, 1803 (pre-May 2018 security updates) · microsoft windows 7 all supported builds prior to the May 2018 security update KEV ransomware PoC ×2mass

Appears with

threat actor QTFY 3victim NASA 3organization FBI 3victim NIH 2victim Department of Energy 2organization Black Lotus Labs 2product QScan 2product Pulse Secure VPN 2product QTRouter 2organization Ministry of State Security 2victim Federal Reserve 2organization Palo Alto Networks 1organization NSA 1organization PLA 1organization Nanjing Xinjiuwei Network Technology 1malware PlugX 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.