Search: “asp.net”

9 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 100 Exploit / PoC 32 Malware 19 Ransomware 16 Data breach 13 Threat actor 11 Industry 7 Policy & legal 4 AI tools & infra 4 Advisory 4 Phishing & fraud 3 Research 1 AI safety & security 1

SeverityAll critical 122 high 50 medium 21 low 18 info 4

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.

The Hacker NewsAug 27, 18:33 UTC · 20d agoThreat actor in the wildCVE-2022-0995 CVE-2021-3156 CVE-2015-5287+8 CVEs

Multiple threat actors exploited Progress Telerik bug to breach U.S. federal agency

Security AffairsMar 16, 10:58 UTC · Mar 16, 2023Threat actor CVE-2019-18935

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.

Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.

The Hacker Newsupdated 05:41 UTC · 2h agofirst Sep 16, 15:27 UTC · 16h agoThreat actor in the wild 3 sources CVE-2020-0688 CVE-2019-0708 CVE-2021-26855+1 CVEs

Search: “asp.net”

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Multiple threat actors exploited Progress Telerik bug to breach U.S. federal agency

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools

Swallowing the Snake’s Tail: Tracking Turla Infrastructure

Microsoft pins on-prem SharePoint attacks on Chinese threat actors

SOC files: an APT41 attack on government IT services in Africa

Threat actors are probing Microsoft Exchange servers for ProxyShell flaws

Zealot Campaign leverages NSA exploits to deliver Monero miners of both Windows and Linux servers